From f0e28a082507c873e41f37b0e2e3201516570f66 Mon Sep 17 00:00:00 2001
From: Kevin Svetlitski <ksvetlitski@janestreet.com>
Date: Tue, 4 Aug 2026 10:25:03 -0400
Subject: [PATCH] Ensure `object-src: 'none'` CSP directive is applied as
 intended

[According to MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/object-src#none)
the single-quotes surrounding `'none'` are mandatory. Unlike the other CSP directives that take care to preserve these
single-quotes when required (e.g. `'self'` in `connect-src`), the `object-src` was passing a plain `none` without quotes,
which is treated as the bare hostname `none`.
---
 ui/src/bigtrace/index.ts | 2 +-
 ui/src/frontend/index.ts | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/src/bigtrace/index.ts b/ui/src/bigtrace/index.ts
index 710fff9f9b2..49f42764c61 100644
--- a/ui/src/bigtrace/index.ts
+++ b/ui/src/bigtrace/index.ts
@@ -60,7 +60,7 @@ function setupContentSecurityPolicy() {
     // wasm-unsafe-eval: the SQL formatter runs as WebAssembly; this allows
     // Wasm compilation without enabling JS eval().
     'script-src': [`'self'`, `'wasm-unsafe-eval'`],
-    'object-src': ['none'],
+    'object-src': [`'none'`],
     'connect-src': [
       `'self'`,
       'https://autopush-brush-googleapis.corp.google.com',
diff --git a/ui/src/frontend/index.ts b/ui/src/frontend/index.ts
index a183798f492..e6fb11051de 100644
--- a/ui/src/frontend/index.ts
+++ b/ui/src/frontend/index.ts
@@ -163,7 +163,7 @@ function setupContentSecurityPolicy() {
       'https://www.googletagmanager.com',
       'https://*.google-analytics.com',
     ],
-    'object-src': ['none'],
+    'object-src': [`'none'`],
     'connect-src': [
       `'self'`,
       'ws://127.0.0.1:8037', // For the adb websocket server.