From 68de64df26b57fc7af64acf882c98499a04e1893 Mon Sep 17 00:00:00 2001
From: wangjiahao <1522128093@qq.com>
Date: Thu, 11 Jun 2026 16:20:02 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E5=8F=98=E6=9B=B4=E8=B5=84=E6=BA=90?=
 =?UTF-8?q?=E8=AE=BF=E9=97=AE=E5=AE=89=E5=85=A8=E7=AD=96=E7=95=A5?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/main/java/io/dataease/filter/HtmlResourceFilter.java    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sdk/common/src/main/java/io/dataease/filter/HtmlResourceFilter.java b/sdk/common/src/main/java/io/dataease/filter/HtmlResourceFilter.java
index aa1c22dbb2..d97858247b 100644
--- a/sdk/common/src/main/java/io/dataease/filter/HtmlResourceFilter.java
+++ b/sdk/common/src/main/java/io/dataease/filter/HtmlResourceFilter.java
@@ -37,7 +37,7 @@ public class HtmlResourceFilter implements Filter, Ordered {
             httpResponse.setHeader(HttpHeaders.PRAGMA, "no-cache");
             httpResponse.setHeader(HttpHeaders.EXPIRES, "0");
         }
-        httpResponse.setHeader("Content-Security-Policy", "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; frame-ancestors 'self'");
+        httpResponse.setHeader("Content-Security-Policy", "default-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline' *; img-src * data: blob:; font-src * data:; connect-src *; frame-ancestors 'self'");
         httpResponse.setHeader("X-Content-Type-Options", "nosniff");
         httpResponse.setHeader("X-Frame-Options", "SAMEORIGIN");
         httpResponse.setHeader("X-XSS-Protection", "1; mode=block");