Skip to content
This repository has been archived by the owner on Jan 17, 2023. It is now read-only.

Remove undefined img-src when contentOrigin isn't set #2426

Closed
g-k opened this issue Mar 20, 2017 · 1 comment
Closed

Remove undefined img-src when contentOrigin isn't set #2426

g-k opened this issue Mar 20, 2017 · 1 comment
Assignees
@ianb
Labels
security Security issue: can be an active issue, or related to security hygene
Milestone
Stretch

Comments

@g-k
Copy link
Contributor

g-k commented Mar 20, 2017

There shouldn't be any security implications and this is only occurs in dev, but it'd be cleaner to default to an empty string.
@jvehent jvehent added the security Security issue: can be an active issue, or related to security hygene label Mar 20, 2017
@ianb ianb removed their assignment Mar 21, 2017
@ianb
Copy link
Contributor

ianb commented Mar 21, 2017

This is a bug leftover from removing contentApp. But we have to restore some of that anyway to implement #2300, at which point this should also get fixed.

@ianb ianb added this to the Stretch milestone Mar 21, 2017
@ianb ianb self-assigned this Jun 9, 2017
ianb added a commit that referenced this issue Jun 9, 2017
@ianb
Fix #2426, make sure contentOrigin isn't undefined in CSP header
d425660
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@ianb ianb

Labels
security Security issue: can be an active issue, or related to security hygene
Projects
None yet
Milestone
Stretch
Development

No branches or pull requests
3 participants
@ianb @g-k @jvehent