TheGoddessInari / hamsket

Free and Open Source messaging and emailing app that combines common web applications into one.
GNU General Public License v3.0
880 stars 55 forks source link

CSP prevents loading icons from localhost with plain HTTP #357

Open JochenLutz opened 1 year ago

JochenLutz commented 1 year ago

Steps to reproduce

  1. Run a web service locally (e.g. MailDev: docker run -p 1080:1080 -p 1025:1025 maildev/maildev)
  2. Add a Custom Service for that web service: URL: http://localhost:1080, Logo: http://localhost:1080/favicon.ico

Expected behavior

The icon set for the Custom Service is shown

Actual behavior

Only a broken image placeholder is shown. Console shows error “Refused to load the image '' because it violates the following Content Security Policy directive: "img-src 'self' data: https://*".”

ENVIRONMENT

Hamsket: v0.6.2 OS: Ubuntu Linux 22.04 Arch: x64 BuildVersion: fd10375 (grafted, HEAD, tag: 0.6.2, origin/fd1037521df6214a1b6b3751242cfa409c4ac236) Thu, 10 Dec 2020 17:32:22 -0800 Does this happen upstream: Since index.html is unchanged in branch master for 3 years, I expect it to also happen upstream.