chore: improve CSP add base uri restriction (apache#26251)

(cherry picked from commit 578a899)
Ortege-xyz · Jan 22, 2024 · 0bb1ef0 · 0bb1ef0
1 parent c46ac34
commit 0bb1ef0
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/superset/config.py b/superset/config.py
@@ -1425,6 +1425,7 @@ def EMAIL_HEADER_MUTATOR(  # pylint: disable=invalid-name,unused-argument
 # If you want Talisman, how do you want it configured??
 TALISMAN_CONFIG = {
     "content_security_policy": {
+        "base-uri": ["'self'"],
         "default-src": [
             "'self'", 
             "https://*.clarity.ms", 
@@ -1466,6 +1467,7 @@ def EMAIL_HEADER_MUTATOR(  # pylint: disable=invalid-name,unused-argument
 # React requires `eval` to work correctly in dev mode
 TALISMAN_DEV_CONFIG = {
     "content_security_policy": {
+        "base-uri": ["'self'"],
         "default-src": [
             "'self'", 
             "https://*.clarity.ms",