From 0a27f3cc8d3b63da7f521732f71037f024d94729 Mon Sep 17 00:00:00 2001
From: Florian Sylvain <sylvainflorian@proton.me>
Date: Tue, 9 Sep 2025 17:23:30 +0200
Subject: [PATCH] feat: update CSP to remove 'unsafe-inline' and restrict
 img-src

---
 server.js | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/server.js b/server.js
index 96dd973..d6453d9 100644
--- a/server.js
+++ b/server.js
@@ -54,9 +54,6 @@ function generateCSP() {
     if (scriptSources.length > 0) {
         scriptSrc += ` ${scriptSources.join(" ")}`;
     }
-    if (scriptSources.length === 0) {
-        scriptSrc += " 'unsafe-inline'";
-    }
 
     let styleSrc = "'self'";
     if (styleSources.length > 0) {
@@ -70,7 +67,7 @@ function generateCSP() {
         "default-src 'self'",
         `script-src ${scriptSrc}`,
         `style-src ${styleSrc}`,
-        "img-src 'self' data: https:",
+        "img-src 'self' https:",
         "font-src 'self'",
         "connect-src 'self'",
         "media-src 'self'",