Update connect-src with all permitted sources.

Lombiq · Jan 8, 2024 · a26713a · a26713a
1 parent 204cc49
commit a26713a
Showing 1 changed file with 11 additions and 0 deletions.
diff --git a/Lombiq.HelpfulLibraries.AspNetCore/Security/CdnContentSecurityPolicyProvider.cs b/Lombiq.HelpfulLibraries.AspNetCore/Security/CdnContentSecurityPolicyProvider.cs
@@ -44,21 +44,32 @@ public class CdnContentSecurityPolicyProvider : IContentSecurityPolicyProvider
 
     public ValueTask UpdateAsync(IDictionary<string, string> securityPolicies, HttpContext context)
     {
+        var any = false;
+
         if (PermittedStyleSources.Any())
         {
+            any = true;
             MergeValues(securityPolicies, StyleSrc, PermittedStyleSources);
         }
 
         if (PermittedScriptSources.Any())
         {
+            any = true;
             MergeValues(securityPolicies, ScriptSrc, PermittedScriptSources);
         }
 
         if (PermittedFontSources.Any())
         {
+            any = true;
             MergeValues(securityPolicies, FontSrc, PermittedFontSources);
         }
 
+        if (any)
+        {
+            var allPermittedSources = PermittedStyleSources.Concat(PermittedScriptSources).Concat(PermittedFontSources);
+            MergeValues(securityPolicies, ConnectSrc, allPermittedSources);
+        }
+
         return ValueTask.CompletedTask;
     }