From 0cebffd59a45bb7256e1817d9792dbe2793fba72 Mon Sep 17 00:00:00 2001 From: Kamil Gabryjelski Date: Fri, 29 Sep 2023 20:54:32 +0200 Subject: [PATCH] fix: Styles not loading because of faulty CSP setting (#25468) --- superset/config.py | 16 ++++++++++++---- 1 file changed, 12 insertions(+), 4 deletions(-) diff --git a/superset/config.py b/superset/config.py index f14eeaa968..20735a77ec 100644 --- a/superset/config.py +++ b/superset/config.py @@ -1426,10 +1426,14 @@ TALISMAN_CONFIG = { "https://events.mapbox.com", ], "object-src": "'none'", - "style-src": ["'self'", "'unsafe-inline'"], + "style-src": [ + "'self'", + "'unsafe-inline'", + "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css", + ], "script-src": ["'self'", "'strict-dynamic'"], }, - "content_security_policy_nonce_in": ["script-src", "style-src"], + "content_security_policy_nonce_in": ["script-src"], "force_https": False, } # React requires `eval` to work correctly in dev mode @@ -1444,10 +1448,14 @@ TALISMAN_DEV_CONFIG = { "https://events.mapbox.com", ], "object-src": "'none'", - "style-src": ["'self'", "'unsafe-inline'"], + "style-src": [ + "'self'", + "'unsafe-inline'", + "https://cdn.jsdelivr.net/npm/swagger-ui-dist@5/swagger-ui.css", + ], "script-src": ["'self'", "'unsafe-inline'", "'unsafe-eval'"], }, - "content_security_policy_nonce_in": ["script-src", "style-src"], + "content_security_policy_nonce_in": ["script-src"], "force_https": False, }