discourse/spec/fixtures/plugins/csp_extension/plugin.rb

# frozen_string_literal: true

# name: csp_extension
# about: Fixture plugin that extends default CSP
# version: 1.0
# authors: xrav3nz

extend_content_security_policy(
  script_src: %w[https://from-plugin.com /local/path],
  object_src: ["https://test-stripping.com"],
  frame_ancestors: ["https://frame-ancestors-plugin.ext"],
  manifest_src: ["https://manifest-src.com"],
)
DEV: use #frozen_string_literal: true on all spec This change both speeds up specs (less strings to allocate) and helps catch cases where methods in Discourse are mutating inputs. Overall we will be migrating everything to use #frozen_string_literal: true it will take a while, but this is the first and safest move in this direction 2019-04-30 08:27:42 +08:00			`# frozen_string_literal: true`

FEATURE: allow plugins and themes to extend the default CSP (#6704) * FEATURE: allow plugins and themes to extend the default CSP For plugins: ``` extend_content_security_policy( script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'], style_src: ['https://domain.com/style.css'] ) ``` For themes and components: ``` extend_content_security_policy: type: list default: "script_src:https://domain.com/\|style_src:https://domain.com" ``` * clear CSP base url before each test we have a test that stubs `Rails.env.development?` to true * Only allow extending directives that core includes, for now 2018-11-30 22:51:45 +08:00			`# name: csp_extension`
			`# about: Fixture plugin that extends default CSP`
			`# version: 1.0`
			`# authors: xrav3nz`

			`extend_content_security_policy(`
DEV: Support passing relative URLs CSP builder (#19176) Raw paths like `/test/path` are not supported natively in the CSP. This commit prepends the site's base URL to these paths. This allows plugins to add 'local' assets to the CSP without needing to hardcode the site's hostname. 2022-11-24 19:27:47 +08:00			`script_src: %w[https://from-plugin.com /local/path],`
DEV: Allow plugins to extend frame-ancestors (#13316) 2021-06-08 02:59:15 +08:00			`object_src: ["https://test-stripping.com"],`
DEV: Add manifest-src to CSP (#13319) Defaults to `manifest-src: 'self'` and allows plugins/themes to extend it. 2021-06-08 21:32:31 +08:00			`frame_ancestors: ["https://frame-ancestors-plugin.ext"],`
			`manifest_src: ["https://manifest-src.com"],`
FEATURE: allow plugins and themes to extend the default CSP (#6704) * FEATURE: allow plugins and themes to extend the default CSP For plugins: ``` extend_content_security_policy( script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'], style_src: ['https://domain.com/style.css'] ) ``` For themes and components: ``` extend_content_security_policy: type: list default: "script_src:https://domain.com/\|style_src:https://domain.com" ``` * clear CSP base url before each test we have a test that stubs `Rails.env.development?` to true * Only allow extending directives that core includes, for now 2018-11-30 22:51:45 +08:00			`)`