Using url names with variables in a Content-Security-Policy statement

[phdphd]

Hi All,

I would like to implement a content security policy in my htaccess file. My website uses maps, and one of the URLs I want to allow has variables. 

https://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}{r}.png

I use this URL in a js file ("var tiles = L.tileLayer('https://{s}.basemaps.cartocdn.com/light_all/{z}/{x}/{y}{r}.png', ....")

What syntax should I use to express this URL in a Content-Security-Policy statement ? Can I use it as is or do I need some wildcards for the variables?

I know there exists the "*" wildcard, but I think that if I used it to match the beginning "{s}", any malicious URL starting with a sequence of characters followed by ".basemaps.cartocdn.com" might match. Would such a risk exists?

Thanks!

 

 

 

 

[requinix]

7 hours ago, phdphd said:

any malicious URL starting with a sequence of characters followed by ".basemaps.cartocdn.com" might match. Would such a risk exists?

You're asking if someone could create their own website under *.basemaps.cartocdn.com.

[phdphd]

Shame on me, I should have paid attention to the dots' meaning.