Add font-src directive to Content-Security-Policy to fix fonts

Change-Id: I42a97a5a782174995b815b9d822250c594fb26a0

1 files changed, 1 insertions, 0 deletions

diff --git a/src/lib.rs b/src/lib.rs
index a52db4c..b12bdfc 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -380,6 +380,7 @@ where
                 "form-action 'self';", // Only allow sending forms back to us.
                 "media-src 'self';",   // Only allow embedding media from us.
                 "script-src 'self';",  // Only run scripts we serve.
+                "font-src 'self';",    // Only use fonts we serve.
                 "style-src 'self';",   // Only use styles we serve.
                 "base-uri 'none';",    // Do not allow to change the base URI.
                 "object-src 'none';",  // Do not allow to embed objects (Flash/ActiveX).