security: Add swagger src to csp

Fixes #760
TracecatHQ · Jan 16, 2025 · 7ba6ba1 · 7ba6ba1
1 parent bab6941
commit 7ba6ba1
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/tracecat/middleware/security.py b/tracecat/middleware/security.py
@@ -15,8 +15,8 @@ async def dispatch(self, request: Request, call_next):
                 "frame-ancestors 'none'",
                 "img-src 'self' data:",
                 "object-src 'none'",
-                "script-src 'self' 'unsafe-inline' https://*.posthog.com",
-                "style-src 'self' 'unsafe-inline'",
+                "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/[email protected]/swagger-ui-bundle.js",
+                "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/[email protected]/swagger-ui.css",
             ]
         else:
             csp_directives = [
@@ -26,8 +26,8 @@ async def dispatch(self, request: Request, call_next):
                 "frame-ancestors 'none'",
                 "img-src 'self' data:",
                 "object-src 'none'",
-                "script-src 'self' 'unsafe-inline'",
-                "style-src 'self' 'unsafe-inline'",
+                "script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/[email protected]/swagger-ui-bundle.js",
+                "style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net/npm/[email protected]/swagger-ui.css",
             ]
         headers = {
             "Strict-Transport-Security": "max-age=7776000; includeSubDomains",