unsafe-inline 2

Author: sorah

Gemfile

@@ -2,4 +2,5 @@ source "https://rubygems.org"
 
 gem "rspec"
 gem "rake"
+gem 'openssl'
 

Gemfile.lock

@@ -2,6 +2,7 @@ GEM
   remote: https://rubygems.org/
   specs:
     diff-lcs (1.6.2)
+    openssl (3.3.2)
     rake (13.3.1)
     rspec (3.13.2)
       rspec-core (~> 3.13.0)
@@ -21,6 +22,7 @@ PLATFORMS
   ruby
 
 DEPENDENCIES
+  openssl
   rake
   rspec
 

config/nginx.conf.erb

@@ -503,7 +503,7 @@ http {
     set $csp_policy "";
     set $csp_policy_report "";
     if ($http_x_forwarded_proto = "https") {
-      set $csp_policy "upgrade-insecure-requests; frame-ancestors 'none'; script-src 'unsafe-inline'; script-src 'unsafe-eval'; style-src 'unsafe-inline'; default-src https:";
+      set $csp_policy "frame-ancestors 'none'; script-src 'unsafe-inline'; script-src 'unsafe-eval'; style-src 'unsafe-inline'; default-src https:";
       set $csp_policy_report "default-src https:; script-src 'unsafe-inline'; report-uri https://<%= primary_host %>/_csp";
     }
     add_header X-Content-Type-Options "nosniff";
@@ -517,7 +517,7 @@ http {
         proxy_hide_header Cache-Control;
         proxy_hide_header Expires;
         # 2015 sites and prior had mixed content issues
-        set $csp_policy "upgrade-insecure-requests; frame-ancestors 'none'; default-src https:";
+        set $csp_policy "upgrade-insecure-requests; frame-ancestors 'none'; script-src 'unsafe-inline'; script-src 'unsafe-eval'; style-src 'unsafe-inline'; default-src https:";
         add_header Cache-Control "public, max-age=604800, s-maxage=31536000";
         proxy_pass https://2009-2011.rubykaigi.org;
     }