Allow styles from gstatic in baseapp.go
Bug: skia:10783
Change-Id: I1530714622cb51ad9e46d23763aa31d94a7bbdcd
Reviewed-on: https://skia-review.googlesource.com/c/buildbot/+/328978
Reviewed-by: Joe Gregorio <jcgregorio@google.com>
diff --git a/go/baseapp/baseapp.go b/go/baseapp/baseapp.go
index f38c4f2..2401b11 100644
--- a/go/baseapp/baseapp.go
+++ b/go/baseapp/baseapp.go
@@ -78,7 +78,7 @@
// This non-local CSP string passes the tests at https://csp-evaluator.withgoogle.com/.
//
// See also: https://csp.withgoogle.com/docs/strict-csp.html
- cspString := fmt.Sprintf("base-uri 'none'; img-src 'self' ; object-src 'none' ; style-src 'self' https://fonts.googleapis.com/ 'unsafe-inline' ; script-src 'strict-dynamic' $NONCE 'unsafe-inline' %s https: http: ; report-uri /cspreport ;", addScriptSrc)
+ cspString := fmt.Sprintf("base-uri 'none'; img-src 'self' ; object-src 'none' ; style-src 'self' https://fonts.googleapis.com/ https://www.gstatic.com/ 'unsafe-inline' ; script-src 'strict-dynamic' $NONCE 'unsafe-inline' %s https: http: ; report-uri /cspreport ;", addScriptSrc)
// Apply CSP and other security minded headers.
secureMiddleware := secure.New(secure.Options{
