Merge pull request #4403 from pulibrary/CSP-object-scr

[CSP] Set object-src to none to remove vulnerability warning: "object-src" value is not safe
pulibrary · Sep 30, 2024 · 5d74819 · 5d74819
2 parents 8501449 + 48ae243
commit 5d74819
Showing 1 changed file with 1 addition and 0 deletions.
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
@@ -13,6 +13,7 @@
     policy.font_src    :self, :https, :data
     policy.img_src     :self, :https, :data
     policy.media_src   :self, :data
+    policy.object_src  :none
     policy.script_src  :self, :https, :unsafe_eval, :unsafe_inline
     policy.style_src   :self, :https, :unsafe_inline
     policy.frame_src   :self, 'https://figgy.princeton.edu', 'https://*.doubleclick.net'