support csp exceptions

Signed-off-by: shmck <shawn.j.mckay@gmail.com>

Author: ShMcK

docs/docs/env-vars.md

@@ -16,6 +16,8 @@ CodeRoad has a number of configurations:
 
 - `CODEROAD_ADMIN_MODE` - a mode for tutorial developers. Under the "Review" page, you can jump around between levels & steps to test development. Defaults `false`.
 
+- `CODEROAD_CONTENT_SECURITY_POLICY_EXEMPTIONS` - a list of CSP exemption hashes. For multiples, separate the list with a space.
+
 ## How to Use Variables
 
 ### Local

src/environment.ts

@@ -38,3 +38,8 @@ if (!supportedOS.includes(OS_PLATFORM)) {
 export const TUTORIAL_URL: string | null = process.env.CODEROAD_TUTORIAL_URL || null
 
 export const DISABLE_RUN_ON_SAVE = (process.env.CODEROAD_DISABLE_RUN_ON_SAVE || '').toLowerCase() === 'true'
+
+// bypass "Refused to execute inline script because it violates the following Content Security Policy directive" issue
+// for multiple exemptions, separate each with a space "a1 b1"
+export const CONTENT_SECURITY_POLICY_EXEMPTIONS: string | null =
+  process.env.CODEROAD_CONTENT_SECURITY_POLICY_EXEMPTIONS || null

src/services/webview/render.ts

@@ -2,6 +2,7 @@ import { JSDOM } from 'jsdom'
 import * as path from 'path'
 import * as vscode from 'vscode'
 import { onError } from '../telemetry'
+import { CONTENT_SECURITY_POLICY_EXEMPTIONS } from '../../environment'
 
 const getNonce = (): string => {
   let text = ''
@@ -46,6 +47,13 @@ async function render(panel: vscode.WebviewPanel, rootPath: string): Promise<voi
       }
     }
 
+    // support additional CSP exemptions when CodeRoad is embedded
+    if (CONTENT_SECURITY_POLICY_EXEMPTIONS && CONTENT_SECURITY_POLICY_EXEMPTIONS.length) {
+      for (const exemption of CONTENT_SECURITY_POLICY_EXEMPTIONS.split(' ')) {
+        nonces.push(exemption)
+      }
+    }
+
     // add run-time script from webpack
     const runTimeScript = document.createElement('script')
     runTimeScript.nonce = getNonce()