search

drodil / backstage-plugin-toolbox

Most commonly used developer tools within Backstage
MIT License
47 stars 25 forks source link

CSP error loading File Diff tool #49

Closed tsoslow closed 10 months ago

tsoslow commented 1 year ago

When accessing the File Diff tool, we are getting a CSP error trying to access monaco-editor js.

Refused to load the script 'https://cdn.jsdelivr.net/npm/monaco-editor@0.36.1/min/vs/loader.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

Maybe monaco-editor could be hosted locally rather than going to cdn?

drodil commented 1 year ago

Yeah it absolutely should be hosted locally or bundled to the plugin. One of the basic principles of the plugin is to provide all necessary things without leaking data to internet.

ppiwow-apay commented 1 year ago

any planned work here?

drodil commented 1 year ago

@aaronnickovich any chance you could have a look at this?

ppiwow-apay commented 10 months ago

any updates?

drodil commented 10 months ago

Did you try with the latest version?

ppiwow-apay commented 10 months ago

oh, sorry, just checked and seems to be working fine. thanks