@@ -38,6 +38,7 @@ export const buildTimeCSPDirectives: CSPDirectives = {
3838 "'unsafe-eval'" ,
3939 'https://*.google.com' ,
4040 'https://apis.google.com' ,
41+ 'https://assets.onedollarstats.com' ,
4142 ] ,
4243
4344 'style-src' : [ "'self'" , "'unsafe-inline'" , 'https://fonts.googleapis.com' ] ,
@@ -92,6 +93,7 @@ export const buildTimeCSPDirectives: CSPDirectives = {
9293 'https://*.supabase.co' ,
9394 'https://api.github.com' ,
9495 'https://github.com/*' ,
96+ 'https://collector.onedollarstats.com' ,
9597 ...getHostnameFromUrl ( env . NEXT_PUBLIC_BRAND_LOGO_URL ) ,
9698 ...getHostnameFromUrl ( env . NEXT_PUBLIC_PRIVACY_URL ) ,
9799 ...getHostnameFromUrl ( env . NEXT_PUBLIC_TERMS_URL ) ,
@@ -149,12 +151,12 @@ export function generateRuntimeCSP(): string {
149151
150152 return `
151153 default-src 'self';
152- script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.google.com https://apis.google.com;
154+ script-src 'self' 'unsafe-inline' 'unsafe-eval' https://*.google.com https://apis.google.com https://assets.onedollarstats.com ;
153155 style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;
154156 img-src 'self' data: blob: https://*.googleusercontent.com https://*.google.com https://*.atlassian.com https://cdn.discordapp.com https://*.githubusercontent.com ${ brandLogoDomain } ${ brandFaviconDomain } ;
155157 media-src 'self' blob:;
156158 font-src 'self' https://fonts.gstatic.com;
157- connect-src 'self' ${ appUrl } ${ ollamaUrl } ${ socketUrl } ${ socketWsUrl } https://api.browser-use.com https://api.exa.ai https://api.firecrawl.dev https://*.googleapis.com https://*.amazonaws.com https://*.s3.amazonaws.com https://*.blob.core.windows.net https://api.github.com https://github.com/* https://*.atlassian.com https://*.supabase.co ${ dynamicDomainsStr } ;
159+ connect-src 'self' ${ appUrl } ${ ollamaUrl } ${ socketUrl } ${ socketWsUrl } https://api.browser-use.com https://api.exa.ai https://api.firecrawl.dev https://*.googleapis.com https://*.amazonaws.com https://*.s3.amazonaws.com https://*.blob.core.windows.net https://api.github.com https://github.com/* https://*.atlassian.com https://*.supabase.co https://collector.onedollarstats.com ${ dynamicDomainsStr } ;
158160 frame-src https://drive.google.com https://docs.google.com https://*.google.com;
159161 frame-ancestors 'self';
160162 form-action 'self';
0 commit comments