discourse/spec/fixtures/plugins/csp_extension/plugin.rb

# frozen_string_literal: true

# name: csp_extension
# about: Fixture plugin that extends default CSP
# version: 1.0
# authors: xrav3nz

extend_content_security_policy(
  script_src: ['https://from-plugin.com'],
  object_src: ['https://test-stripping.com'],
  frame_ancestors: ['https://frame-ancestors-plugin.ext'],
  manifest_src: ['https://manifest-src.com']
)
DEV: use #frozen_string_literal: true on all spec This change both speeds up specs (less strings to allocate) and helps catch cases where methods in Discourse are mutating inputs. Overall we will be migrating everything to use #frozen_string_literal: true it will take a while, but this is the first and safest move in this direction 2019-04-30 08:27:42 +08:00			`# frozen_string_literal: true`

FEATURE: allow plugins and themes to extend the default CSP (#6704) * FEATURE: allow plugins and themes to extend the default CSP For plugins: ``` extend_content_security_policy( script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'], style_src: ['https://domain.com/style.css'] ) ``` For themes and components: ``` extend_content_security_policy: type: list default: "script_src:https://domain.com/\|style_src:https://domain.com" ``` * clear CSP base url before each test we have a test that stubs `Rails.env.development?` to true * Only allow extending directives that core includes, for now 2018-11-30 22:51:45 +08:00			`# name: csp_extension`
			`# about: Fixture plugin that extends default CSP`
			`# version: 1.0`
			`# authors: xrav3nz`

			`extend_content_security_policy(`
FEATURE: allow extending CSP base-uri and object-src Plus, ensure :none is stripped, it cannot be combined with other sources 2019-01-10 04:33:42 +08:00			`script_src: ['https://from-plugin.com'],`
DEV: Allow plugins to extend frame-ancestors (#13316) 2021-06-08 02:59:15 +08:00			`object_src: ['https://test-stripping.com'],`
DEV: Add manifest-src to CSP (#13319) Defaults to `manifest-src: 'self'` and allows plugins/themes to extend it. 2021-06-08 21:32:31 +08:00			`frame_ancestors: ['https://frame-ancestors-plugin.ext'],`
			`manifest_src: ['https://manifest-src.com']`
FEATURE: allow plugins and themes to extend the default CSP (#6704) * FEATURE: allow plugins and themes to extend the default CSP For plugins: ``` extend_content_security_policy( script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'], style_src: ['https://domain.com/style.css'] ) ``` For themes and components: ``` extend_content_security_policy: type: list default: "script_src:https://domain.com/\|style_src:https://domain.com" ``` * clear CSP base url before each test we have a test that stubs `Rails.env.development?` to true * Only allow extending directives that core includes, for now 2018-11-30 22:51:45 +08:00			`)`