darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-07-13 09:50:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1005 from GSA/1004-csp-add-ga

Browse Source 
1004 - Adding GA to connect-src
This commit is contained in:
Steven Reilly
2023-12-13 10:25:52 -05:00
committed by GitHub
parent 1903b742d7 6297091022
commit 3cc613314e
2 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
app/__init__.py
View File

@@ -153,7 +153,11 @@ def _csp(config):
"https://www.google-analytics.com",
"https://dap.digitalgov.gov",
],
"connect-src": ["'self'", "https://gov-bam.nr-data.net"],
"connect-src": [
"'self'",
"https://gov-bam.nr-data.net",
"https://www.google-analytics.com",
],
"style-src": ["'self'", asset_domain],
"img-src": ["'self'", asset_domain, logo_domain],
}

6
tests/app/main/views/test_headers.py
View File

@@ -23,6 +23,10 @@ def test_owasp_useful_headers_set(
r"gov 'nonce-.*';",
csp,
)
assert search(r"connect-src 'self' https:\/\/gov-bam.nr-data\.net;", csp)
assert search(
r"connect-src 'self' https:\/\/gov-bam.nr-data\.net https:\/\/www\.google-analytics\."
r"com;",
csp,
)
assert search(r"style-src 'self' static\.example\.com 'nonce-.*';", csp)
assert search(r"img-src 'self' static\.example\.com static-logos\.test\.com", csp)