diff --git a/src/api/v2/schemas.js b/src/api/v2/schemas.js index 52a4d78..4395c15 100644 --- a/src/api/v2/schemas.js +++ b/src/api/v2/schemas.js @@ -222,8 +222,8 @@ export class PolicyResponse { /** @typedef {PolicyItem} */ insecureBaseUri = { pass: false, - description: `
Restricts use of the <base>
tag by using base-uri 'none'
, base-uri 'self'
, or specific origins.
The base
tag can be used to trick your site intoloading scripts from untrusted origins.
Restricts use of the <base>
tag by using base-uri 'none'
, base-uri 'self'
, or specific origins.
The <base>
tag can be used to trick your site into loading scripts from untrusted origins.
Blocks loading of active content over HTTP or FTP
`, - info: `Loading JavaScript or plugins can allow a man-in-the-middle to execute arbitrary code or your website. Restricting your policy and changing links to HTTPS can help prevent this.
`, + info: `Loading JavaScript or plugins can allow a man-in-the-middle to execute arbitrary code or your website. Restricting your policy and changing links to HTTPS can help prevent this.
`, }; /** @typedef {PolicyItem} */ insecureSchemePassive = { @@ -252,7 +252,7 @@ export class PolicyResponse { /** @typedef {PolicyItem} */ unsafeEval = { pass: false, - description: `Blocks execution of JavaScript's eval()
function by not allowing 'unsafe-eval'
inside script-src
Blocks execution of JavaScript's eval()
function by not allowing 'unsafe-eval'
inside script-src
Blocking the use of JavaScript's eval()
function can help prevent the execution of untrusted code.
Blocks execution of plug-ins, using object-src
restrictions
Blocking the execution of plug-ins via object-src 'none'
or as inherited from default-src
can prevent attackers from loading Flash or Java in the context of your page.
Blocks execution of plug-ins, using object-src
restrictions
Blocking the execution of plug-ins via object-src 'none'
or as inherited from default-src
can prevent attackers from loading Flash or Java in the context of your page.