src-advisory/SRCmail
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(csp): allow external/data fonts so email webfonts render

Browse Source 
The page CSP set font-src 'self', which blocked fonts referenced by
rendered email CSS (brand webfonts loaded over https). Allow https:/data:
for font-src. Email bodies render inside the sandboxed iframe, which keeps
its own stricter blocking-mode font-src for privacy.
This commit is contained in:
Shuki Vaknin
2026-07-05 21:28:15 +02:00
committed by Linus Rath
parent b1b09d54c8
commit 0d73cb5dfb
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
proxy.ts
+1 -1
View File
@@ -112,7 +112,7 @@ export async function proxy(request: NextRequest) {
`script-src ${scriptSrc}`, `script-src ${scriptSrc}`,
`style-src 'self' 'unsafe-inline'`, `style-src 'self' 'unsafe-inline'`,
`img-src 'self' data: blob: https:`, `img-src 'self' data: blob: https:`,
`font-src 'self'`, `font-src 'self' https: data:`,
`connect-src ${connectSrc}`, `connect-src ${connectSrc}`,
frameSrc, frameSrc,
`object-src 'self' blob:`, `object-src 'self' blob:`,