mirror of
https://github.com/microsoft/vscode.git
synced 2025-12-24 04:09:28 +00:00
@@ -424,7 +424,7 @@ export class MarkdownPreview extends Disposable {
|
||||
const self = this;
|
||||
const resourceProvider: WebviewResourceProvider = {
|
||||
toWebviewResource: (resource) => this.editor.webview.toWebviewResource(resource),
|
||||
get cspRule() { return self.editor.webview.cspRule; }
|
||||
get cspSource() { return self.editor.webview.cspSource; }
|
||||
};
|
||||
const content = await this._contentProvider.provideTextDocumentContent(document, resourceProvider, this._previewConfigurations, this.line, this.state);
|
||||
// Another call to `doUpdate` may have happened.
|
||||
|
||||
@@ -200,7 +200,7 @@ export class MarkdownContentProvider {
|
||||
resource: vscode.Uri,
|
||||
nonce: string
|
||||
): string {
|
||||
const rule = provider.cspRule;
|
||||
const rule = provider.cspSource;
|
||||
switch (this.cspArbiter.getSecurityLevelForResource(resource)) {
|
||||
case MarkdownPreviewSecurityLevel.AllowInsecureContent:
|
||||
return `<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' ${rule} http: https: data:; media-src 'self' ${rule} http: https: data:; script-src 'nonce-${nonce}'; style-src 'self' ${rule} 'unsafe-inline' http: https: data:; font-src 'self' ${rule} http: https: data:;">`;
|
||||
|
||||
@@ -8,5 +8,5 @@ import * as vscode from 'vscode';
|
||||
export interface WebviewResourceProvider {
|
||||
toWebviewResource(resource: vscode.Uri): vscode.Uri;
|
||||
|
||||
readonly cspRule: string;
|
||||
readonly cspSource: string;
|
||||
}
|
||||
Reference in New Issue
Block a user