force https for blob url in _frame.js. Updates helmet to allow more i…

…nspectlet domains.
zzbynzz · Jun 16, 2015 · 810bf9a · 810bf9a
1 parent 1607fe0
commit 810bf9a
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/public/js/lib/jailed/_frame.js b/public/js/lib/jailed/_frame.js
@@ -36,7 +36,7 @@ try {
   blobUrl = blobUrl.getBlob();
 }
 
-var worker = new Worker(URL.createObjectURL(blobUrl));
+var worker = new Worker(URL.createObjectURL('https:' + blobUrl));
 
 // telling worker to load _pluginWeb.js (see blob code above)
 worker.postMessage({

diff --git a/server/server.js b/server/server.js
@@ -132,7 +132,8 @@ var trusted = [
   'wss://inspectletws.herokuapp.com/',
   'http://hn.inspectlet.com/',
   '*.googleapis.com',
-  '*.gstatic.com'
+  '*.gstatic.com',
+  'https://hn.inspectlet.com/'
 ];
 
 app.use(helmet.csp({