By restricting img-src in our CSP, we weren’t allowing images from
e.g. https://github.com like CI badges to display.
We can eventually look at it again in the future but I think users will try to embed pictures from lots of places in their comments, descriptions, etc.
By restricting img-src in our CSP, we weren’t allowing images from
e.g. https://github.com like CI badges to display.
We can eventually look at it again in the future but I think users will try to embed pictures from lots of places in their comments, descriptions, etc.
I still don’t see the github badges when I build the app for production based on this patch.
Instead of only removing attributes, in this revision I put the https: attribute to the img-src directive which should allow users to display any image from a https scheme.
Also rebased the patch.
@rudolfs, this is ready for a review
Rebase.