add xss content security policy (#329)

astronomer · Oct 23, 2024 · 5bc81bd · 5bc81bd
1 parent 47c2b27
commit 5bc81bd
Showing 1 changed file with 14 additions and 9 deletions.
diff --git a/ui/src/app.html b/ui/src/app.html
@@ -1,12 +1,17 @@
 <!DOCTYPE html>
 <html lang="en">
-    <head>
-        <meta charset="utf-8" />
-        <link rel="icon" href="%sveltekit.assets%/favicon.svg" />
-        <meta name="viewport" content="width=device-width" />
-        %sveltekit.head%
-    </head>
-    <body data-sveltekit-preload-data="hover">
-        <div style="display: contents">%sveltekit.body%</div>
-    </body>
+
+<head>
+  <meta charset="utf-8" />
+  <link rel="icon" href="%sveltekit.assets%/favicon.svg" />
+  <meta name="viewport" content="width=device-width" />
+  <meta http-equiv="Content-Security-Policy"
+    content="default-src 'self' astronomer.io; script-src 'self' astronomer.io;" />
+  %sveltekit.head%
+</head>
+
+<body data-sveltekit-preload-data="hover">
+  <div style="display: contents">%sveltekit.body%</div>
+</body>
+
 </html>