Skip to content

Commit

Permalink
remove unused variable and rename a variable that rider nags about
Browse files Browse the repository at this point in the history
  • Loading branch information
adelikat committed Oct 14, 2024
1 parent 5742d41 commit bbdef9c
Showing 1 changed file with 2 additions and 3 deletions.
5 changes: 2 additions & 3 deletions TASVideos/Extensions/ApplicationBuilderExtensions.cs
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,7 @@ public static IApplicationBuilder UseStaticFilesWithExtensionMapping(this IAppli

public static IApplicationBuilder UseMvcWithOptions(this IApplicationBuilder app, IHostEnvironment env, AppSettings settings)
{
var userAgentReportURL = $"{settings.BaseUrl}/Diagnostics/UserAgentInterventionReports";
string[] trustedJSHosts = [
string[] trustedJsHosts = [
"https://cdn.jsdelivr.net",
"https://cdnjs.cloudflare.com",
"https://code.jquery.com",
Expand All @@ -65,7 +64,7 @@ public static IApplicationBuilder UseMvcWithOptions(this IApplicationBuilder app
"frame-src 'self' https://www.youtube.com/embed/", // allow these domains in <iframe/>
"img-src *", // allow hotlinking images from any domain in UGC (not great)
"require-trusted-types-for 'script'", // experimental, but Google seems to be pushing it: should block `HTMLScriptElement.innerHTML = "user.pwn();";`, and similarly block adding in-line scripts as attrs
$"script-src 'self' {string.Join(' ', trustedJSHosts)}", // `<script/>`s will be blocked unless they're from one of these domains
$"script-src 'self' {string.Join(' ', trustedJsHosts)}", // `<script/>`s will be blocked unless they're from one of these domains
"style-src 'unsafe-inline' 'self' https://cdnjs.cloudflare.com/ajax/libs/font-awesome/", // allow `<style/>`, and `<link rel="stylesheet"/>` if it's from our domain or trusted CDN
"upgrade-insecure-requests", // browser should automagically replace links to any `http://tasvideos.org/...` URL (in UGC, for example) with HTTPS
];
Expand Down

0 comments on commit bbdef9c

Please sign in to comment.