Commit 2ef4cf29 authored by Markus Koller's avatar Markus Koller

Merge branch '337033-jira-connect-csp-domains' into 'master'

Include *.jira.com in Jira Connect CSP frame ancestors

See merge request gitlab-org/gitlab!84967
parents 8600059f 6df38246
...@@ -11,7 +11,9 @@ class JiraConnect::SubscriptionsController < JiraConnect::ApplicationController ...@@ -11,7 +11,9 @@ class JiraConnect::SubscriptionsController < JiraConnect::ApplicationController
style_src_values = Array.wrap(p.directives['style-src']) | %w('self' 'unsafe-inline') style_src_values = Array.wrap(p.directives['style-src']) | %w('self' 'unsafe-inline')
# rubocop: enable Lint/PercentStringArray # rubocop: enable Lint/PercentStringArray
p.frame_ancestors :self, 'https://*.atlassian.net' # *.jira.com is needed for some legacy Jira Cloud instances, new ones will use *.atlassian.net
# https://support.atlassian.com/organization-administration/docs/ip-addresses-and-domains-for-atlassian-cloud-products/
p.frame_ancestors :self, 'https://*.atlassian.net', 'https://*.jira.com'
p.script_src(*script_src_values) p.script_src(*script_src_values)
p.style_src(*style_src_values) p.style_src(*style_src_values)
end end
......
...@@ -36,7 +36,7 @@ RSpec.describe 'Subscriptions Content Security Policy' do ...@@ -36,7 +36,7 @@ RSpec.describe 'Subscriptions Content Security Policy' do
it 'appends to CSP directives' do it 'appends to CSP directives' do
visit jira_connect_subscriptions_path(jwt: jwt) visit jira_connect_subscriptions_path(jwt: jwt)
is_expected.to include("frame-ancestors 'self' https://*.atlassian.net") is_expected.to include("frame-ancestors 'self' https://*.atlassian.net https://*.jira.com")
is_expected.to include("script-src 'self' https://some-cdn.test https://connect-cdn.atl-paas.net") is_expected.to include("script-src 'self' https://some-cdn.test https://connect-cdn.atl-paas.net")
is_expected.to include("style-src 'self' https://some-cdn.test 'unsafe-inline'") is_expected.to include("style-src 'self' https://some-cdn.test 'unsafe-inline'")
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment