From cf50f292a8cf24c6236c4d4d6d3e481791f177d6 Mon Sep 17 00:00:00 2001
From: Jarek Danielak <jarek.danielak@camunda.com>
Date: Thu, 19 Dec 2024 14:36:57 +0100
Subject: [PATCH] chore: fix CSP

---
 src/bpmn-editor.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/bpmn-editor.ts b/src/bpmn-editor.ts
index 5915749..18ce734 100644
--- a/src/bpmn-editor.ts
+++ b/src/bpmn-editor.ts
@@ -486,7 +486,7 @@ export class BpmnEditor implements vscode.CustomEditorProvider<BpmnDocument> {
         Use a content security policy to only allow loading images from https or from our extension directory,
         and only allow scripts that have a specific nonce.
         -->
-        <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src 'self' data:; img-src 'self' data:; img-src ${webview.cspSource} blob:; style-src ${webview.cspSource}; script-src 'nonce-${nonce}';">
+        <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src https: 'self' data:; img-src ${webview.cspSource} blob:; style-src 'unsafe-inline' https: ${webview.cspSource}; script-src 'nonce-${nonce}';">
 
         <meta name="viewport" content="width=device-width, initial-scale=1.0">