stwaidele/dorfteich
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 22 Wiki Activity

CSP data:-Fonts + Doku: Excalidraw als sechstes Standard-Plugin #143

Merged
fable-5 merged 2 commits from excalidraw-demo-docs into main 2026-07-19 22:41:27 +02:00
Conversation 0 Commits 2 Files Changed 10 +13 -5
3 changed files with 13 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 75ec7f6006 - Show all commits

5
apps/api/src/plugins/plugin-frame.ts
View File

@ -29,7 +29,10 @@ export function buildPluginFrameCsp(assetBase: string): string {
`script-src ${assetBase}`,
`style-src ${assetBase} 'unsafe-inline'`,
`img-src ${assetBase} data: blob:`,
`font-src ${assetBase}`,
// `data:` so a saved sketch SVG with embedded (subsetted) fonts — the
// Excalidraw plugin stores those — renders its handwriting look in the
// snapshot view too. data: fonts make no network request.
`font-src ${assetBase} data:`,
// A plugin may talk to its OWN version-pinned assets (bundled apps like
// drawio lazy-load stencils/resources via XHR) — and to nothing else:
// no api, no external hosts. The zero-external-network guarantee holds.

6
apps/web/nginx.conf
View File

@ -28,7 +28,11 @@ server {
# from this origin only (the GDPR "zero external requests" posture).
# `style-src 'unsafe-inline'` covers the app's inline style attributes
# (CSS custom properties, layout); scripts are all external files.
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; img-src 'self' data: blob:; connect-src 'self'; worker-src 'self'; manifest-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
# font-src includes `data:` for the subsetted fonts Excalidraw embeds
# into saved sketch SVGs (inlined by the plugin fallback renderer on
# public pages). data: fonts trigger no network request, so the
# zero-third-party-request guarantee (security.md) is unaffected.
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; img-src 'self' data: blob:; connect-src 'self'; worker-src 'self'; manifest-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'" always;
add_header X-Content-Type-Options "nosniff" always;
try_files $uri /index.html;
}

7
packages/shared/src/fonts.ts
View File

@ -5,9 +5,10 @@
* page lists their licenses. Adding a font is a change here + an image rebuild
* — there is no runtime font management (deliberately small surface).
*
* Fonts are served only from the instance itself (`font-src 'self'`); a
* visitor's browser makes zero third-party requests (the GDPR guarantee,
* security.md).
* Fonts are served only from the instance itself (`font-src 'self' data:` —
* the `data:` part covers fonts embedded inline in saved plugin SVGs, e.g.
* Excalidraw sketches); a visitor's browser makes zero third-party requests
* (the GDPR guarantee, security.md).
*/
export type FontCategory = 'sans-serif' | 'serif' | 'monospace';
export type FontLicense = 'OFL-1.1' | 'Apache-2.0';