From 32f686cba69b75667132c131ff2e9afb0f54ba25 Mon Sep 17 00:00:00 2001
From: Kyle Spearrin <kyle.spearrin@gmail.com>
Date: Tue, 6 Nov 2018 22:26:41 -0500
Subject: [PATCH] allow blobs in object-src CSP
---
util/Setup/NginxConfigBuilder.cs | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/util/Setup/NginxConfigBuilder.cs b/util/Setup/NginxConfigBuilder.cs
index 8537119808..22771fa7a4 100644
--- a/util/Setup/NginxConfigBuilder.cs
+++ b/util/Setup/NginxConfigBuilder.cs
@@ -10,7 +10,8 @@ namespace Bit.Setup
"default-src 'self'; style-src 'self' 'unsafe-inline'; " +
"img-src 'self' data: https://haveibeenpwned.com https://www.gravatar.com; " +
"child-src 'self' https://*.duosecurity.com; frame-src 'self' https://*.duosecurity.com; " +
- "connect-src 'self' wss://{0} https://haveibeenpwned.com https://api.pwnedpasswords.com;";
+ "connect-src 'self' wss://{0} https://haveibeenpwned.com https://api.pwnedpasswords.com; " +
+ "object-src 'self' blob:;";
private readonly Context _context;