discourse/spec/fixtures/plugins/csp_extension/plugin.rb

# name: csp_extension
# about: Fixture plugin that extends default CSP
# version: 1.0
# authors: xrav3nz

extend_content_security_policy(
  script_src: ['https://from-plugin.com']
)
FEATURE: allow plugins and themes to extend the default CSP (#6704) * FEATURE: allow plugins and themes to extend the default CSP For plugins: ``` extend_content_security_policy( script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'], style_src: ['https://domain.com/style.css'] ) ``` For themes and components: ``` extend_content_security_policy: type: list default: "script_src:https://domain.com/\|style_src:https://domain.com" ``` * clear CSP base url before each test we have a test that stubs `Rails.env.development?` to true * Only allow extending directives that core includes, for now 2018-11-30 22:51:45 +08:00			`# name: csp_extension`
			`# about: Fixture plugin that extends default CSP`
			`# version: 1.0`
			`# authors: xrav3nz`

			`extend_content_security_policy(`
			`script_src: ['https://from-plugin.com']`
			`)`