Add blob to frame-src in CSP for iD

Fixes #2582 Closes #2583
2020-04-09 18:42:17 +01:00 · 2020-04-09 18:42:17 +01:00 · 66ec3cd845
commit 66ec3cd845
parent 7e11d27512
1 changed files with 4 additions and 0 deletions
--- a/app/controllers/site_controller.rb
+++ b/app/controllers/site_controller.rb
@ -75,6 +75,10 @@ class SiteController < ApplicationController
        :plugin_types => %w[application/x-shockwave-flash],
        :script_src => %w['unsafe-inline']
      )
+    elsif %w[id].include?(editor)
+      append_content_security_policy_directives(
+        :frame_src => %w[blob:]
+      )
    end

    begin