From eacc58247313af31e97e48db5bb28a439db02c0b Mon Sep 17 00:00:00 2001 From: Patrik Oldsberg Date: Mon, 3 Jan 2022 11:06:22 +0100 Subject: [PATCH] backend-common: reintroduce unsafe-eval Signed-off-by: Patrik Oldsberg --- .changeset/plenty-lobsters-grow.md | 5 +++++ .../backend-common/src/service/lib/ServiceBuilderImpl.ts | 4 ++++ 2 files changed, 9 insertions(+) create mode 100644 .changeset/plenty-lobsters-grow.md diff --git a/.changeset/plenty-lobsters-grow.md b/.changeset/plenty-lobsters-grow.md new file mode 100644 index 0000000000..d0ff04c95a --- /dev/null +++ b/.changeset/plenty-lobsters-grow.md @@ -0,0 +1,5 @@ +--- +'@backstage/backend-common': patch +--- + +Reverted the default CSP configuration to include `'unsafe-eval'` again, which was mistakenly removed in the previous version. diff --git a/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts b/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts index 5d33206684..d155287b34 100644 --- a/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts +++ b/packages/backend-common/src/service/lib/ServiceBuilderImpl.ts @@ -228,6 +228,10 @@ export function applyCspDirectives( const result: ContentSecurityPolicyOptions['directives'] = helmet.contentSecurityPolicy.getDefaultDirectives(); + // TODO(Rugvip): We currently use non-precompiled AJV for validation in the frontend, which uses eval. + // It should be replaced by any other solution that doesn't require unsafe-eval. + result['script-src'] = ["'self'", "'unsafe-eval'"]; + if (directives) { for (const [key, value] of Object.entries(directives)) { if (value === false) {