From 5dd75959a08b1b55eb9dcd82924efeb969517c5b Mon Sep 17 00:00:00 2001 From: Sebastian Martinez Date: Thu, 30 Jan 2025 09:57:43 +0100 Subject: [PATCH] Cleanup `img-src` attributes in the CSP directive By restricting `img-src` in our CSP, we weren't allowing images from e.g. https://github.com like CI badges to display. With this change we allow users to add images from any `https`, `data` or `blob` source, which is more user friendly. --- crates/radicle-tauri/tauri.conf.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/crates/radicle-tauri/tauri.conf.json b/crates/radicle-tauri/tauri.conf.json index f7175bf52..154a8be18 100644 --- a/crates/radicle-tauri/tauri.conf.json +++ b/crates/radicle-tauri/tauri.conf.json @@ -21,7 +21,7 @@ "csp": { "default-src": "'self'", "connect-src": "ipc: http://ipc.localhost", - "img-src": "'self' asset: http://asset.localhost blob: data:", + "img-src": "'self' blob: data: https:", "style-src": "'unsafe-inline' 'self'" }, "pattern": {