[java-idp-plugin-webauthn] branch main updated: CSP fix

Wed Aug 14 15:18:59 UTC 2024

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-webauthn.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-webauthn.git;a=commit;h=ac771ccf4e64058f88010eeb0d17723aced65f16

The following commit(s) were added to refs/heads/main by this push:
     new ac771cc  CSP fix
ac771cc is described below

commit ac771ccf4e64058f88010eeb0d17723aced65f16
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Wed Aug 14 16:18:57 2024 +0100

    CSP fix
---
 .../shibboleth/idp/plugin/authn/webauthn/views/webauthn-management.vm   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management.vm b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management.vm
index a276380..f6ef14a 100644
--- a/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management.vm
+++ b/webauthn-impl/src/main/resources/net/shibboleth/idp/plugin/authn/webauthn/views/webauthn-management.vm
@@ -20,7 +20,7 @@
 ## Add CSP directives
 #set ($areYouSure =  "return confirm('#springMessageText('idp.webauthn.register.credential.remove.confirm', 'Are you sure')');")
 #set ($nonce = $cspNonce.generateIdentifier())
-$response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 'self'; img-src 'self'; script-src-elem 'nonce-$nonce'; script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($areYouSure)'")
+$response.addHeader("Content-Security-Policy", "default-src 'none'; style-src 'self'; img-src 'self' data:; script-src-elem 'nonce-$nonce'; script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($areYouSure)'")
 
 <!DOCTYPE html>
 <html>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
