darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-16 20:49:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix content security policy for the CDN

Browse Source 
The CDN URLs aren’t in included in the content security policy. So
browsers will refuse to load them.

This commit:
- adds each of the CDN URLs to the
- only prepend URLs in CSS files with `/static/` if we’re running
  locally (because the CDN URLs are like `static.example.com` not
  `example.com/static`)
This commit is contained in:
Chris Hill-Scott
2018-11-29 11:29:52 +00:00
parent 74459b2f2a
commit fe6610c221
4 changed files with 31 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
tests/app/main/views/test_headers.py
View File

@@ -8,12 +8,13 @@ def test_owasp_useful_headers_set(client, mocker):
assert response.headers['X-Content-Type-Options'] == 'nosniff'
assert response.headers['X-XSS-Protection'] == '1; mode=block'
assert response.headers['Content-Security-Policy'] == (
"default-src 'self' 'unsafe-inline';"
"script-src 'self' *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com;"
"object-src 'self';"
"font-src 'self' data:;"
"img-src 'self' *.google-analytics.com *.notifications.service.gov.uk static-logos.test.com data:;"
"font-src 'self' static.example.com data:;"
"img-src "
"'self' static.example.com *.google-analytics.com *.notifications.service.gov.uk static-logos.test.com data:;"
"frame-src 'self' www.youtube.com;"
)
@@ -25,11 +26,12 @@ def test_headers_non_ascii_characters_are_replaced(client, mocker):
assert response.status_code == 200
assert response.headers['Content-Security-Policy'] == (
"default-src 'self' 'unsafe-inline';"
"script-src 'self' *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com;"
"object-src 'self';"
"font-src 'self' data:;"
"img-src 'self' *.google-analytics.com *.notifications.service.gov.uk static-logos??.test.com data:;"
"font-src 'self' static.example.com data:;"
"img-src "
"'self' static.example.com *.google-analytics.com *.notifications.service.gov.uk static-logos??.test.com data:;"
"frame-src 'self' www.youtube.com;"
)