allows external style sheets by allowing https

[Pierce01]

No description provided.

[Pierce01]

alternatively we could use the following if we wanted the CSP for the most part.

require("electron").session.defaultSession.webRequest.onHeadersReceived(function(details, callback) {
	if (!details.responseHeaders["content-security-policy"]) return callback({cancel: false});
	var headers = details.responseHeaders["content-security-policy"][0].split(';');
	
	for(var header in headers) {
		switch(header) {
			case header.startsWith('style-src'): {
				header = "style-src * 'unsafe-inline' *"
			}
			case header.startsWith('img-src'): {
				header = "img-src *"
			}
		}
	}
	
    var newInfo = "";
    for(var key in headers) {
        newInfo+=`${key};`
    }
    details.responseHeaders["content-security-policy"][0] = newInfo;

    callback({cancel:false, responseHeaders: details.responseHeaders})
});

module.exports = require('./core.asar');

[Rapptz]

I don't see the point of this actually considering that CSS injection still works even after the CSP headers unless they've changed that recently?

[shikhir-arora]

They did change it on Canary - they may have reverted it though. It blocks on CSP for unsafe-inline and records the violation to Sentry. I actually noticed this more than a month ago, but it didn't do anything but throw a warning.

They made the change today public and announced it in the testers guild, though I'm not sure if they reverted it as they said they would be for some changes. Either way, the code here does fix it. The loading happens right at the start, so nothing is loaded. It spawns a lot of annoying errors over CSS and ignoring CSP headers handles that.

[Pierce01]

Hasn't reverted it to my knowledge, so imported style-sheets and images would still get blocked by the new policy on canary

[Pierce01]

as the new title says, this allows style sheets, images, fonts, etc to be loaded that are secure

[AlexFlipnote]

Due to this unsafe-inline, I've had to upload the images I want to use in a hidden channel in order to achieve the same URL as discordapp.com, just keeping that as a note.

[leovoel]

thanks!