Commit eec1ed52 authored by Mayra Cabrera's avatar Mayra Cabrera

Merge branch 'sh-add-missing-csp-report-uri' into 'master'

Add missing report-uri to CSP config

See merge request gitlab-org/gitlab-ce!31593
parents 4035e139 d265408c
---
title: Add missing report-uri to CSP config
merge_request: 31593
author:
type: fixed
......@@ -5,7 +5,7 @@ module Gitlab
class ConfigLoader
DIRECTIVES = %w(base_uri child_src connect_src default_src font_src
form_action frame_ancestors frame_src img_src manifest_src
media_src object_src script_src style_src worker_src).freeze
media_src object_src report_uri script_src style_src worker_src).freeze
def self.default_settings_hash
{
......
......@@ -13,7 +13,8 @@ describe Gitlab::ContentSecurityPolicy::ConfigLoader do
child_src: "'self' https://child.example.com",
default_src: "'self' https://other.example.com",
script_src: "'self' https://script.exammple.com ",
worker_src: "data: https://worker.example.com"
worker_src: "data: https://worker.example.com",
report_uri: "http://example.com"
}
}
end
......@@ -46,6 +47,7 @@ describe Gitlab::ContentSecurityPolicy::ConfigLoader do
expect(policy.directives['default-src']).to eq(expected_config(:default_src))
expect(policy.directives['child-src']).to eq(expected_config(:child_src))
expect(policy.directives['worker-src']).to eq(expected_config(:worker_src))
expect(policy.directives['report-uri']).to eq(expected_config(:report_uri))
end
it 'ignores malformed policy statements' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment