Skip to content

Commit d792bf3

Browse files
committed
fix jquery csp issues
1 parent 6314c24 commit d792bf3

File tree

2 files changed

+32
-1
lines changed

2 files changed

+32
-1
lines changed

apps/demos/Demos/Stepper/FormIntegration/jQuery/index.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
<meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0" />
88
<script src="../../../../node_modules/jquery/dist/jquery.min.js"></script>
99
<link rel="stylesheet" type="text/css" href="../../../../node_modules/devextreme/dist/css/dx.light.css" />
10-
<script src="../../../../node_modules/devextreme-dist/js/dx.all.debug.js"></script>
10+
<script src="../../../../node_modules/devextreme-dist/js/dx.all.js"></script>
1111
<script src="data.js"></script>
1212
<link rel="stylesheet" type="text/css" href="styles.css" />
1313
<script src="index.js"></script>

apps/demos/utils/server/csp-server.js

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,15 @@ const CSP_DEMO_ALLOWLIST = {
3434
'Button/Icons': {
3535
'font-src': ['https://maxcdn.bootstrapcdn.com'],
3636
},
37+
// Azure Maps SDK: inline styles, blob workers, data: images,
38+
// and font glyphs from atlas.microsoft.com
3739
Map: {
3840
'script-src': ['https://atlas.microsoft.com'],
41+
'style-src': ["'unsafe-inline'"],
3942
'connect-src': ['https://atlas.microsoft.com'],
43+
'worker-src': ['blob:'],
44+
'img-src': ['data:'],
45+
'font-src': ['https://atlas.microsoft.com'],
4046
},
4147
'DataGrid/CollaborativeEditing': {
4248
'connect-src': ['wss://js.devexpress.com'],
@@ -73,9 +79,24 @@ const CSP_DEMO_ALLOWLIST = {
7379
'DataGrid/PDFExportImages': {
7480
'img-src': ['data:'],
7581
},
82+
'DataGrid/RemoteCRUDOperations': {
83+
'img-src': ['data:'],
84+
},
85+
'DataGrid/RemoteGrouping': {
86+
'img-src': ['data:'],
87+
},
88+
'DataGrid/RemoteReordering': {
89+
'img-src': ['data:'],
90+
},
91+
'DataGrid/RemoteVirtualScrolling': {
92+
'img-src': ['data:'],
93+
},
7694
'DataGrid/VirtualScrolling': {
7795
'img-src': ['data:'],
7896
},
97+
'DataGrid/WebAPIService': {
98+
'img-src': ['data:'],
99+
},
79100
Gantt: {
80101
'img-src': ['data:'],
81102
},
@@ -121,17 +142,27 @@ const CSP_DEMO_ALLOWLIST = {
121142
'TreeList/FixedAndStickyColumns': {
122143
'img-src': ['data:'],
123144
},
145+
'TreeList/FocusedRow': {
146+
'img-src': ['data:'],
147+
},
124148
'TreeList/MultipleSorting': {
125149
'img-src': ['data:'],
126150
},
127151
'TreeList/SearchPanel': {
128152
'img-src': ['data:'],
129153
},
154+
'TreeList/WebAPIService': {
155+
'img-src': ['data:'],
156+
},
130157
'TreeList/Overview': {
131158
'img-src': ['data:'],
132159
// TODO: fix inline style in cellTemplate (background-image)
133160
'style-src': ["'unsafe-inline'"],
134161
},
162+
// globalize/message.js uses new Function() internally
163+
'Localization/UsingGlobalize': {
164+
'script-src': ["'unsafe-eval'"],
165+
},
135166
// AI demo: inline <script type="module"> for OpenAI SDK + eval() used by the SDK
136167
'Form/SmartPaste': {
137168
'script-src': ["'unsafe-inline'", "'unsafe-eval'"],

0 commit comments

Comments
 (0)