Relax style-src-elem to allow inline

2026-01-24 23:41:53 +01:00
parent 84e253b61c
commit c4ac38e41a
2 changed files with 7 additions and 3 deletions
--- a/app/Http/Middleware/ContentSecurityPolicy.php
+++ b/app/Http/Middleware/ContentSecurityPolicy.php
@@ -118,7 +118,11 @@ class ContentSecurityPolicy
        $styleSources[] = 'data:';
        $connectSources[] = 'https:';
        $fontSources[] = 'https:';
-        $styleElemSources = array_unique(array_merge($styleSources, ["'unsafe-inline'"]));
+        $styleElemSources = array_values(array_filter(
+            $styleSources,
+            static fn (string $source): bool => ! str_starts_with($source, "'nonce-")
+        ));
+        $styleElemSources = array_unique(array_merge($styleElemSources, ["'unsafe-inline'"]));

        $directives = [
            'default-src' => ["'self'"],