HH-529: allow blob avatar previews in CSP (#115)

Co-authored-by: Rogee <rogee@ipao.vip>

backend/internal/middleware/security_headers.go

@@ -60,7 +60,7 @@ func DefaultSecurityHeadersConfig() SecurityHeadersConfig {
 		HSTSMaxAge:             31536000, // 1 year
 		HSTSIncludeSubDomains:  true,
 		HSTSPreload:            false,
-		CSPDirectives:          "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'",
+		CSPDirectives:          "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'",
 		ReferrerPolicy:         "strict-origin-when-cross-origin",
 		PermissionsPolicy:      "camera=(), microphone=(), geolocation=(), payment=(), usb=(), magnetometer=(), gyroscope=(), accelerometer=()",
 	}
@@ -136,4 +136,4 @@ func itoa(n int) string {
 		n /= 10
 	}
 	return string(buf[i:])
-}
+}

backend/internal/middleware/security_headers_test.go

@@ -21,6 +21,7 @@ func TestSecurityHeaders_Default(t *testing.T) {
 	req := httptest.NewRequest(http.MethodGet, "/test", nil)
 	r.ServeHTTP(w, req)
 	assert.Equal(t, 200, w.Code)
+	assert.Equal(t, "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'", w.Header().Get("Content-Security-Policy"))
 	assert.Contains(t, w.Header().Get("Content-Security-Policy"), "script-src 'self'")
 	assert.NotContains(t, w.Header().Get("Content-Security-Policy"), "script-src 'self' 'unsafe-inline'")
 }