Commit 30d919d7 authored by mark burdett's avatar mark burdett
Browse files

Issue #3278847 by mfb: Update CSP rules to allow the dialog

parent f93c72f8

src/Config/SecKitOverrides.php

+13 −0
Original line number Diff line number Diff line
@@ -65,8 +65,21 @@ class SecKitOverrides implements ConfigFactoryOverrideInterface { 
    }

    if ($config->get('javascript_error_handler')) {

      $seckitConfig = $this->configFactory->getEditable('seckit.settings');

      if ($config->get('show_report_dialog')) {

        $src = str_replace(

          ["/{$dsn->getProjectId()}/", '/store/'],

          ['/embed/', '/error-page/'],

          $dsn->getStoreApiEndpointUrl()

        );

        if ($script_src = $seckitConfig->get('seckit_xss.csp.script-src') ?: $seckitConfig->get('seckit_xss.csp.default-src')) {

          $overrides['seckit.settings']['seckit_xss']['csp']['script-src'] = $script_src . ' ' . $src;

        }

      }

      if ($connect_src = $seckitConfig->get('seckit_xss.csp.connect-src') ?: $seckitConfig->get('seckit_xss.csp.default-src')) {

        $overrides['seckit.settings']['seckit_xss']['csp']['connect-src'] = $connect_src . ' ' . $dsn->getStoreApiEndpointUrl() . ' ' . $dsn->getEnvelopeApiEndpointUrl();

        if (isset($src)) {

          $overrides['seckit.settings']['seckit_xss']['csp']['connect-src'] .= ' ' . $src;

        }

      }

    }

    return $overrides;

src/EventSubscriber/CspSubscriber.php

+13 −2
Original line number Diff line number Diff line
@@ -64,10 +64,21 @@ class CspSubscriber implements EventSubscriberInterface { 
      // Raven is incorrectly configured.

      return;

    }

    self::fallbackAwareAppendIfEnabled($alterEvent->getPolicy(), 'connect-src', [

    $connect = [

      $dsn->getStoreApiEndpointUrl(),

      $dsn->getEnvelopeApiEndpointUrl(),

    ]);

    ];

    if ($config->get('show_report_dialog')) {

      $src = str_replace(

        ["/{$dsn->getProjectId()}/", '/store/'],

        ['/embed/', '/error-page/'],

        $dsn->getStoreApiEndpointUrl()

      );

      self::fallbackAwareAppendIfEnabled($alterEvent->getPolicy(), 'script-src', [$src]);

      self::fallbackAwareAppendIfEnabled($alterEvent->getPolicy(), 'script-src-elem', [$src]);

      $connect[] = $src;

    }

    self::fallbackAwareAppendIfEnabled($alterEvent->getPolicy(), 'connect-src', $connect);

  }



  /**