From 17e6d24de4d293da3336d44cd4c642902f3b21aa Mon Sep 17 00:00:00 2001
From: Wolfgang Ginolas <wolfgang.ginolas@gwif.eu>
Date: Fri, 2 Jun 2023 14:43:44 +0200
Subject: [PATCH] Use hashes instead of unsafe-eval to secure drawio

---
 lib/defaults.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/defaults.js b/lib/defaults.js
index 95221f6bf..dab40e3f7 100644
--- a/lib/defaults.js
+++ b/lib/defaults.js
@@ -48,7 +48,7 @@ Default.padContentSecurity = function (Env) {
 };
 
 Default.drawioContentSecurity = function (Env) {
-    return (Default.commonCSP(Env).join('; ') + "script-src 'self' 'unsafe-inline' resource: " + Env.httpUnsafeOrigin).replace(/\s+/g, ' ');
+    return (Default.commonCSP(Env).join('; ') + "script-src 'self' 'sha256-+hYPMSCUTTRq44AeLdIxRO6I7f2KjNhFS1RlQG3XZgA=' 'sha256-6g514VrT/cZFZltSaKxIVNFF46+MFaTSDTPB8WfYK+c=' resource: " + Env.httpUnsafeOrigin).replace(/\s+/g, ' ');
 };
 
 Default.httpHeaders = function (Env) {