erdtman / content-security-policy Goto Github PK

Add support to register function for setting the attributes of the policy dynamicaly.

Invalid plugin type in 'plugin-types' Content Security Policy directive: ''none''. Did you mean to set the object-src directive to 'none'

I c&p'ed your example code into a file serve.js and in my package.json I defined in "scripts":

"serve": "node serve.js"

I am using these

  "devDependencies": {
    "content-security-policy": "^0.3.4",
    "express": "^4.17.1"
  }

Hi there!

The JS world has had lots of attacks via libraries that were taken over by someone malicious. A best practice is to check changes before upgrading, and trace those back to the relevant GitHub repository. It's not foolproof, but helps.

taskcluster/taskcluster#3390 is an example of an upgrade request for this package, but notably its changelog link doesn't point to anything useful, and I don't see a 3.0.4 commit, tag, or release here -- so I'm reluctant to adopt the upgrade.

Could you push the 3.0.4 change, and perhaps also add tags and releases in GitHub? It looks like this was just a compatibility bump, but seeing all those pieces in place would help be sure of that.

The value of exported SRC_DATA should be 'data:'. The current value is 'data'.