@@ -131,57 +131,57 @@ async function onExpressJsSetup(server) {
131131 return next ( ) ;
132132 } ;
133133
134- server . use ( function ( req , res , next ) {
134+ server . use ( ( req , res , next ) => {
135135 res . header ( 'Referrer-Policy' , 'strict-origin-when-cross-origin' ) ;
136136 res . header ( 'Permissions-Policy' , 'geolocation=(), microphone=(), camera=()' ) ;
137137
138138 if ( req . url . startsWith ( '/__community__/veterans' ) || req . hostname === 'veterans.topcoder.com' ) {
139139 res . header (
140140 'Content-Security-Policy' ,
141- ` default-src 'self';`
142- + ` script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval'`
143- + ` http://www.google-analytics.com`
144- + ` https://43d132d5dbff47c59d9d53ad448f93c2.js.ubembed.com`
145- + ` https://assets.ubembed.com`
146- + ` https://assets.zendesk.com`
147- + ` https://browser.sentry-cdn.com`
148- + ` https://cdn.segment.com`
149- + ` https://fast.trychameleon.com`
150- + ` https://static.zdassets.com;`
151- + ` style-src 'report-sample' 'self' 'unsafe-inline'`
141+ " default-src 'self';"
142+ + " script-src 'report-sample' 'self' 'unsafe-inline' 'unsafe-eval'"
143+ + ' http://www.google-analytics.com'
144+ + ' https://43d132d5dbff47c59d9d53ad448f93c2.js.ubembed.com'
145+ + ' https://assets.ubembed.com'
146+ + ' https://assets.zendesk.com'
147+ + ' https://browser.sentry-cdn.com'
148+ + ' https://cdn.segment.com'
149+ + ' https://fast.trychameleon.com'
150+ + ' https://static.zdassets.com;'
151+ + " style-src 'report-sample' 'self' 'unsafe-inline'"
152152 + ` ${ config . CDN . PUBLIC } ;`
153- + ` object-src 'none';`
154- + ` base-uri 'self';`
155- + ` connect-src 'self'`
153+ + " object-src 'none';"
154+ + " base-uri 'self';"
155+ + " connect-src 'self'"
156156 + ` ${ config . URL . COMMUNITY_APP } `
157157 + ` ${ config . CDN . PUBLIC } `
158158 + ` ${ config . API . V2 } /`
159159 + ` ${ config . API . V3 } /`
160160 + ` ${ config . API . V4 } /`
161161 + ` ${ config . API . V5 } /`
162- + ` https://api.segment.io`
163- + ` https://cdn.segment.com`
164- + ` https://ekr.zdassets.com`
165- + ` https://topcoder.zendesk.com`
166- + ` https://stats.g.doubleclick.net`
167- + ` https://www.google-analytics.com;`
168- + ` font-src 'self'`
169- + ` data:`
162+ + ' https://api.segment.io'
163+ + ' https://cdn.segment.com'
164+ + ' https://ekr.zdassets.com'
165+ + ' https://topcoder.zendesk.com'
166+ + ' https://stats.g.doubleclick.net'
167+ + ' https://www.google-analytics.com;'
168+ + " font-src 'self'"
169+ + ' data:'
170170 + ` ${ config . CDN . PUBLIC } `
171- + ` https://43d132d5dbff47c59d9d53ad448f93c2.js.ubembed.com;`
172- + ` frame-src 'self'`
171+ + ' https://43d132d5dbff47c59d9d53ad448f93c2.js.ubembed.com;'
172+ + " frame-src 'self'"
173173 + ` ${ config . URL . AUTH } ;`
174- + ` img-src 'self'`
175- + ` https://www.facebook.com`
176- + ` https://images.ctfassets.net`
177- + ` https://d2nl5eqipnb33q.cloudfront.net`
178- + ` https://cdn.segment.com`
179- + ` https://www.google.com`
180- + ` https://topcoder-prod-media.s3.amazonaws.com;`
181- + ` manifest-src 'self';`
182- + ` media-src 'self';`
183- + ` report-uri https://623d4c23f90d055298b24042.endpoint.csper.io/?v=0;`
184- + ` worker-src 'self';`
174+ + " img-src 'self'"
175+ + ' https://www.facebook.com'
176+ + ' https://images.ctfassets.net'
177+ + ' https://d2nl5eqipnb33q.cloudfront.net'
178+ + ' https://cdn.segment.com'
179+ + ' https://www.google.com'
180+ + ' https://topcoder-prod-media.s3.amazonaws.com;'
181+ + " manifest-src 'self';"
182+ + " media-src 'self';"
183+ + ' report-uri https://623d4c23f90d055298b24042.endpoint.csper.io/?v=0;'
184+ + " worker-src 'self';" ,
185185 ) ;
186186 }
187187
0 commit comments