From 5bc81bd18961fe7fcea86b67709ba91ef76a3ea2 Mon Sep 17 00:00:00 2001
From: Julian LaNeve <lanevejulian@gmail.com>
Date: Wed, 23 Oct 2024 10:52:25 -0400
Subject: [PATCH] add xss content security policy (#329)

---
 ui/src/app.html | 23 ++++++++++++++---------
 1 file changed, 14 insertions(+), 9 deletions(-)
diff --git a/ui/src/app.html b/ui/src/app.html
index a4f1d0df..76f019fc 100644
--- a/ui/src/app.html
+++ b/ui/src/app.html
@@ -1,12 +1,17 @@
 <!DOCTYPE html>
 <html lang="en">
-    <head>
-        <meta charset="utf-8" />
-        <link rel="icon" href="%sveltekit.assets%/favicon.svg" />
-        <meta name="viewport" content="width=device-width" />
-        %sveltekit.head%
-    </head>
-    <body data-sveltekit-preload-data="hover">
-        <div style="display: contents">%sveltekit.body%</div>
-    </body>
+
+<head>
+  <meta charset="utf-8" />
+  <link rel="icon" href="%sveltekit.assets%/favicon.svg" />
+  <meta name="viewport" content="width=device-width" />
+  <meta http-equiv="Content-Security-Policy"
+    content="default-src 'self' astronomer.io; script-src 'self' astronomer.io;" />
+  %sveltekit.head%
+</head>
+
+<body data-sveltekit-preload-data="hover">
+  <div style="display: contents">%sveltekit.body%</div>
+</body>
+
 </html>
