Fix font-src CSP (#1198)

wwwillchen · web-flow · commit 943985c17c33 · 2025-02-12T14:21:53.000-08:00
diff --git a/mesop/server/static_file_serving.py b/mesop/server/static_file_serving.py
@@ -229,7 +229,7 @@ def add_security_headers(response: Response):
     csp = OrderedDict(
       {
         "default-src": "'self'",
-        "font-src": "fonts.gstatic.com data:",
+        "font-src": "'self' fonts.gstatic.com data:",
         # Mesop app developers should be able to iframe other sites.
         "frame-src": "*",
         # Mesop app developers should be able to load images and media from various origins.
diff --git a/mesop/tests/e2e/snapshots/web_security_test.ts_csp-allowed-iframe-parents.txt b/mesop/tests/e2e/snapshots/web_security_test.ts_csp-allowed-iframe-parents.txt
@@ -1,5 +1,5 @@
 default-src 'self'
-font-src fonts.gstatic.com data:
+font-src 'self' fonts.gstatic.com data:
 frame-src *
 img-src 'self' data: https: http: blob:
 media-src 'self' data: https: blob:
diff --git a/mesop/tests/e2e/snapshots/web_security_test.ts_csp-escaping.txt b/mesop/tests/e2e/snapshots/web_security_test.ts_csp-escaping.txt
@@ -1,5 +1,5 @@
 default-src 'self'
-font-src fonts.gstatic.com data:
+font-src 'self' fonts.gstatic.com data:
 frame-src *
 img-src 'self' data: https: http: blob:
 media-src 'self' data: https: blob:
diff --git a/mesop/tests/e2e/snapshots/web_security_test.ts_csp-trusted-types.txt b/mesop/tests/e2e/snapshots/web_security_test.ts_csp-trusted-types.txt
@@ -1,5 +1,5 @@
 default-src 'self'
-font-src fonts.gstatic.com data:
+font-src 'self' fonts.gstatic.com data:
 frame-src *
 img-src 'self' data: https: http: blob:
 media-src 'self' data: https: blob:
diff --git a/mesop/tests/e2e/snapshots/web_security_test.ts_csp.txt b/mesop/tests/e2e/snapshots/web_security_test.ts_csp.txt
@@ -1,5 +1,5 @@
 default-src 'self'
-font-src fonts.gstatic.com data:
+font-src 'self' fonts.gstatic.com data:
 frame-src *
 img-src 'self' data: https: http: blob:
 media-src 'self' data: https: blob:

Original file line number	Diff line number	Diff line change
`@@ -229,7 +229,7 @@ def add_security_headers(response: Response):`
`229`	`229`	`csp = OrderedDict(`
`230`	`230`	`{`
`231`	`231`	`"default-src": "'self'",`
`232`		`- "font-src": "fonts.gstatic.com data:",`
	`232`	`+ "font-src": "'self' fonts.gstatic.com data:",`
`233`	`233`	`# Mesop app developers should be able to iframe other sites.`
`234`	`234`	`"frame-src": "*",`
`235`	`235`	`# Mesop app developers should be able to load images and media from various origins.`