fix: Embed CSP

bprusinowski · bprusinowski · commit bbbef5e9dd3d · 2025-12-02T11:25:26.000+01:00
diff --git a/app/pages/embed/[chartId].tsx b/app/pages/embed/[chartId].tsx
@@ -66,7 +66,17 @@ const EmbedPage = (props: PageProps) => {
       <Head>
         <meta
           httpEquiv="Content-Security-Policy"
-          content="default-src 'self' 'unsafe-inline' data:; script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.mapbox.com https://api.maptiler.com; style-src 'self' 'unsafe-inline';"
+          content={[
+            `default-src 'self' 'unsafe-inline' data: https://*.sentry.io https://vercel.live/ https://vercel.com https://*.googletagmanager.com`,
+            `script-src 'unsafe-inline' 'unsafe-eval' 'self' https://api.mapbox.com https://api.maptiler.com https://*.sentry.io https://vercel.live/ https://vercel.com https://*.googletagmanager.com`,
+            `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://cdn.jsdelivr.net`,
+            `font-src 'self'`,
+            `form-action 'self'`,
+            `connect-src 'self' *`,
+            `img-src 'self' * data: blob:`,
+            `script-src-elem 'self' 'unsafe-inline' https://*.admin.ch https://visualize.admin.ch https://*.visualize.admin.ch https://vercel.live https://vercel.com https://*.vercel.app https://*.google-analytics.com https://*.analytics.google.com https://*.googletagmanager.com https://api.mapbox.com https://cdn.jsdelivr.net`,
+            `worker-src 'self' blob: https://*.admin.ch https://*.vercel.app`,
+          ].join("; ")}
         />
       </Head>
       <ConfiguratorStateProvider
