From 5c764a95f4f5ba6b268172271da46b160697a34e Mon Sep 17 00:00:00 2001
From: Oscar Hinton <oscar@oscarhinton.com>
Date: Thu, 3 Feb 2022 10:17:33 +0100
Subject: [PATCH] Add CSP for development (#1431)

---
 src/scss/styles.scss |  2 +-
 webpack.config.js    | 11 +++++++++++
 2 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/scss/styles.scss b/src/scss/styles.scss
index f914b51412..d2678ac885 100644
--- a/src/scss/styles.scss
+++ b/src/scss/styles.scss
@@ -43,7 +43,7 @@
 @import "~bootstrap/scss/_print";
 
 @import "~ngx-toastr/toastr";
-@import "~sweetalert2/src/sweetalert2.scss";
+@import "~#sweetalert2";
 
 @import "./base";
 @import "./buttons";
diff --git a/webpack.config.js b/webpack.config.js
index db7133624f..ab7382b792 100644
--- a/webpack.config.js
+++ b/webpack.config.js
@@ -192,6 +192,13 @@ const devServer =
             changeOrigin: true,
           },
         },
+        headers: [
+          {
+            key: "Content-Security-Policy",
+            value:
+              "default-src 'self'; script-src 'self' 'sha256-ryoU+5+IUZTuUyTElqkrQGBJXr1brEv6r2CA62WUw8w=' https://js.stripe.com https://js.braintreegateway.com https://www.paypalobjects.com; style-src 'self' https://assets.braintreegateway.com https://*.paypal.com 'sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=' 'sha256-JVRXyYPueLWdwGwY9m/7u4QlZ1xeQdqUj2t8OVIzZE4='; img-src 'self' data: https://icons.bitwarden.net https://*.paypal.com https://www.paypalobjects.com https://q.stripe.com https://haveibeenpwned.com https://www.gravatar.com; child-src 'self' https://js.stripe.com https://assets.braintreegateway.com https://*.paypal.com https://*.duosecurity.com; frame-src 'self' https://js.stripe.com https://assets.braintreegateway.com https://*.paypal.com https://*.duosecurity.com; connect-src 'self' wss://notifications.bitwarden.com https://notifications.bitwarden.com https://cdn.bitwarden.net https://api.pwnedpasswords.com https://2fa.directory/api/v2/totp.json https://2fa.directory/api/v3/totp.json https://api.stripe.com https://www.paypal.com https://api.braintreegateway.com https://client-analytics.braintreegateway.com https://*.braintree-api.com https://bitwardenxx5keu3w.blob.core.windows.net; object-src 'self' blob:;",
+          },
+        ],
         hot: false,
         allowedHosts: envConfig.dev?.allowedHosts ?? "auto",
         client: {
@@ -240,6 +247,10 @@ const webpackConfig = {
     extensions: [".ts", ".js"],
     symlinks: false,
     modules: [path.resolve("node_modules")],
+    alias: {
+      sweetalert2: require.resolve("sweetalert2/dist/sweetalert2.js"),
+      "#sweetalert2": require.resolve("sweetalert2/src/sweetalert2.scss"),
+    },
     fallback: {
       buffer: false,
       util: require.resolve("util/"),