From ee14db20f10228c45696d21cf58732736f7577d4 Mon Sep 17 00:00:00 2001
From: Asher <ash@coder.com>
Date: Mon, 20 Apr 2020 18:10:07 -0500
Subject: [PATCH] Allow data: in CSP for font-src

Closes #1530.
---
 src/browser/pages/app.html    | 2 +-
 src/browser/pages/error.html  | 2 +-
 src/browser/pages/home.html   | 2 +-
 src/browser/pages/login.html  | 2 +-
 src/browser/pages/update.html | 2 +-
 src/browser/pages/vscode.html | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/browser/pages/app.html b/src/browser/pages/app.html
index 3f854453a..551471a16 100644
--- a/src/browser/pages/app.html
+++ b/src/browser/pages/app.html
@@ -8,7 +8,7 @@
     />
     <meta
       http-equiv="Content-Security-Policy"
-      content="style-src 'self' 'unsafe-inline'; manifest-src 'self'; img-src 'self' data:;"
+      content="style-src 'self' 'unsafe-inline'; manifest-src 'self'; img-src 'self' data:; font-src 'self' data:;"
     />
     <title>code-server</title>
     <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
diff --git a/src/browser/pages/error.html b/src/browser/pages/error.html
index 8e201759a..17f7da29a 100644
--- a/src/browser/pages/error.html
+++ b/src/browser/pages/error.html
@@ -6,7 +6,7 @@
       name="viewport"
       content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no"
     />
-    <meta http-equiv="Content-Security-Policy" content="style-src 'self'; manifest-src 'self'; img-src 'self' data:;" />
+    <meta http-equiv="Content-Security-Policy" content="style-src 'self'; manifest-src 'self'; img-src 'self' data:; font-src 'self' data:;" />
     <title>{{ERROR_TITLE}} - code-server</title>
     <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
     <link
diff --git a/src/browser/pages/home.html b/src/browser/pages/home.html
index 542f3b6ef..4fbe8fbd3 100644
--- a/src/browser/pages/home.html
+++ b/src/browser/pages/home.html
@@ -8,7 +8,7 @@
     />
     <meta
       http-equiv="Content-Security-Policy"
-      content="style-src 'self' 'unsafe-inline'; manifest-src 'self'; img-src 'self' data:;"
+      content="style-src 'self' 'unsafe-inline'; manifest-src 'self'; img-src 'self' data:; font-src 'self' data:;"
     />
     <title>code-server</title>
     <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
diff --git a/src/browser/pages/login.html b/src/browser/pages/login.html
index b749168c0..6f8ce250e 100644
--- a/src/browser/pages/login.html
+++ b/src/browser/pages/login.html
@@ -8,7 +8,7 @@
     />
     <meta
       http-equiv="Content-Security-Policy"
-      content="style-src 'self'; script-src 'self' 'unsafe-inline'; manifest-src 'self'; img-src 'self' data:;"
+      content="style-src 'self'; script-src 'self' 'unsafe-inline'; manifest-src 'self'; img-src 'self' data:; font-src 'self' data:;"
     />
     <title>code-server login</title>
     <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
diff --git a/src/browser/pages/update.html b/src/browser/pages/update.html
index 5637a1ee1..125a95d9b 100644
--- a/src/browser/pages/update.html
+++ b/src/browser/pages/update.html
@@ -6,7 +6,7 @@
       name="viewport"
       content="width=device-width, initial-scale=1.0, maximum-scale=1.0, minimum-scale=1.0, user-scalable=no"
     />
-    <meta http-equiv="Content-Security-Policy" content="style-src 'self'; manifest-src 'self'; img-src 'self' data:;" />
+    <meta http-equiv="Content-Security-Policy" content="style-src 'self'; manifest-src 'self'; img-src 'self' data:; font-src 'self' data:;" />
     <title>code-server</title>
     <link rel="icon" href="{{BASE}}/static/{{COMMIT}}/src/browser/media/favicon.ico" type="image/x-icon" />
     <link
diff --git a/src/browser/pages/vscode.html b/src/browser/pages/vscode.html
index 793a49f0a..4e25ed88c 100644
--- a/src/browser/pages/vscode.html
+++ b/src/browser/pages/vscode.html
@@ -6,7 +6,7 @@
 
     <meta
       http-equiv="Content-Security-Policy"
-      content="font-src 'self'; connect-src ws: wss: 'self' https:; default-src ws: wss: 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; manifest-src 'self'; img-src 'self' data: https:;"
+      content="font-src 'self' data:; connect-src ws: wss: 'self' https:; default-src ws: wss: 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; manifest-src 'self'; img-src 'self' data: https:;"
     />
 
     <!-- Disable pinch zooming -->