/planet won't load images due to CSP

[humphd]

We tweaked our Content Security Policy recently, and it's causing the /planet front-end to break for all images.

STR:

1. Open https://telescope.cdot.systems, notice it displays images
2. Open https://telescope.cdot.systems/planet in a second tab, notice you have no images

I get the following errors in the console:

In Chrome:

Content Security Policy: The page’s settings blocked the loading of a resource at https://1.bp.blogspot.com/-UbK3cE5UlpE/X55fbQ45iTI/AAAAAAAAC3s/8DrI5X9Ee2IeT6n0_FXPPctlxs50u1OMACLcBGAsYHQ/w642-h239/telescope12234.PNG (“img-src”).

In Firefox:

Refused to load the image 'https://1.bp.blogspot.com/-UbK3cE5UlpE/X55fbQ45iTI/AAAAAAAAC3s/8DrI5X9Ee2IeT6n0_FXPPctlxs50u1OMACLcBGAsYHQ/w642-h239/telescope12234.PNG' because it violates the following Content Security Policy directive: "img-src 'self' data:".

Let's update our img-src directive to be less restrictive.

[zg3d]

Hey, can I work on this issue?

[humphd]

@zg3d all yours.

[zg3d]

@humphd I think this is not an issue and has been fixed in a previous commit 6433ac0

[humphd]

@zg3d awesome, thank you for confirming.

[zg3d]

@humphd the code in app.js in the current repo is accurate however when i check with a csp Evaluator in the current dev build. The https src in image-src is not shown or used ending up with the above console error.

telescope/src/backend/web/app.js

Line 31 in b3ea971

imgSrc: ["'self'", 'data:', 'https:'],

[humphd]

We should probably fix up our CSP in a few ways. These online evaluators flag a couple of different things. @zg3d do you want to work on this or leave for someone else?

[zg3d]

Ill leave it for someone else as I am unsure of the interaction here.