From 00fef8b61d8def4bce5d6e63abb11dfaf675a0c1 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Tue, 28 Apr 2026 19:06:06 +0100 Subject: [PATCH] Block object-src in security policy This is ancient history from when we had a flash based editor though I'm not sure this rule was really needed even then. Reported-by: Jorge Gonzalez Milla --- config/initializers/content_security_policy.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index a18ed95ac..f9d8a5eb8 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -29,7 +29,7 @@ Rails.application.configure do policy.img_src(*img_src) policy.manifest_src(:self) policy.media_src(:none) - policy.object_src(:self) + policy.object_src(:none) policy.plugin_types policy.script_src(*script_src) policy.style_src(:self) -- 2.47.3