From e2431172fb88fd48a173a4f61c9cb40ec193464b Mon Sep 17 00:00:00 2001
From: Henning Dieterichs <henning.dieterichs@live.de>
Date: Sun, 6 Oct 2019 11:34:15 +0200
Subject: [PATCH] Adds Content-Security-Policy

---
 extension/src/WebViews.ts | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/extension/src/WebViews.ts b/extension/src/WebViews.ts
index 2355c9d..89f9592 100644
--- a/extension/src/WebViews.ts
+++ b/extension/src/WebViews.ts
@@ -60,7 +60,9 @@ export function getHtml(server: Server) {
 	const isDev = !!process.env.USE_DEV_UI;
 	return `
         <html>
-            <head>
+			<head>
+			<meta charset="UTF-8">
+			<meta http-equiv="Content-Security-Policy" content="default-src * 'unsafe-inline' 'unsafe-eval'; script-src * 'unsafe-inline' 'unsafe-eval'; connect-src * 'unsafe-inline'; img-src * data: blob: 'unsafe-inline'; frame-src *; style-src * 'unsafe-inline';">
             <style>
                 html { height: 100%; width: 100%; padding: 0; margin: 0; }
                 body { height: 100%; width: 100%; padding: 0; margin: 0; }
@@ -86,10 +88,8 @@ export function getHtml(server: Server) {
 				</script>
 				${
 					isDev
-						? `<iframe src="${server.indexUrl}"></iframe>`
-						: `<script type="text/javascript" src="${
-								server.mainBundleUrl
-						  }"></script>`
+						? `<iframe sandbox="allow-top-navigation allow-scripts allow-same-origin allow-popups allow-pointer-lock allow-forms" src="${server.indexUrl}"></iframe>`
+						: `<script type="text/javascript" src="${server.mainBundleUrl}"></script>`
 				}
             </body>
         </html>