fix(diagram.zip): allow isolated renderer origins

Dami committed Aug 202a07eb7

commit: 2a07eb762d8fd007258ac38511755dbbb361baf7
parent: 4c1c98c1a4c1140d5cef7c0fd297b2f8fa43eb3d
author: Dami <dami.etoile@gmail.com>

2 files changed, +7 -2wrap lines

M	server/src/main/java/io/kroki/server/service/DiagramZipHandler.java	3	++-
M	server/src/test/java/io/kroki/server/service/DiagramZipHandlerTest.java	6	+++++-

M server/src/main/java/io/kroki/server/service/DiagramZipHandler.java +2 -1

@@ -13,7 +13,8 @@ public class DiagramZipHandler {
1313     "script-src 'self'",1414     "style-src 'self' 'unsafe-inline'",1515     "img-src 'self' blob: data:",16-    "connect-src 'self'",16+    "connect-src 'self' https://*.render.diagram.zip",17+    "frame-src https://*.render.diagram.zip",1718     "font-src 'self'",1819     "base-uri 'none'",1920     "form-action 'none'",

M server/src/test/java/io/kroki/server/service/DiagramZipHandlerTest.java +5 -1

@@ -33,7 +33,11 @@ class DiagramZipHandlerTest {
3333     Mockito.verify(response).putHeader(HttpHeaders.CACHE_CONTROL, "no-cache");3434     Mockito.verify(response).putHeader(3535       eq("Content-Security-Policy"),36-      contains("connect-src 'self'")36+      contains("connect-src 'self' https://*.render.diagram.zip")37+    );38+    Mockito.verify(response).putHeader(39+      eq("Content-Security-Policy"),40+      contains("frame-src https://*.render.diagram.zip")3741     );3842     Mockito.verify(response).putHeader(3943       eq("Content-Security-Policy"),