Update content security (#1173)

* chore: 🤖 upgrade ember content security policy

ui/admin/config/content-security-policy.js

@@ -0,0 +1,34 @@
+'use strict';
+
+const API_HOST = process.env.API_HOST || '';
+
+module.exports = function (environment) {
+  let policy = {
+    // Deny everything by default
+    'default-src': ["'none'"],
+    'script-src': ["'self'"],
+    'frame-src': ["'self'"],
+    'font-src': ["'self'"],
+    'connect-src': ["'self'"],
+    'img-src': ["'self'", 'data:'],
+    'style-src': ["'self'"],
+    'media-src': ["'self'"],
+    'manifest-src': ["'self'"],
+    'style-src-attr': ["'self'"],
+  };
+
+  // Unsafe policy is necessary in development and test environments, but should
+  // not be used in production.
+  if (environment === 'development') {
+    policy['script-src'].push("'unsafe-eval'");
+    policy['style-src'].push("'unsafe-inline'");
+    if (API_HOST) policy['connect-src'].push(API_HOST);
+  }
+
+  return {
+    delivery: ['header'],
+    enabled: environment !== 'test',
+    policy,
+    reportOnly: false,
+  };
+};

ui/admin/config/environment.js

@@ -96,20 +96,6 @@ module.exports = function (environment) {
       },
     },
 
-    contentSecurityPolicyHeader: 'Content-Security-Policy',
-    contentSecurityPolicyMeta: true,
-    contentSecurityPolicy: {
-      'default-src': ["'none'"],
-      'script-src': ["'self'"],
-      'frame-src': ["'self'"],
-      'font-src': ["'self'"],
-      'connect-src': ["'self'"],
-      'img-src': ["'self'", 'data:'],
-      'style-src': ["'self'"],
-      'media-src': ["'self'"],
-      'manifest-src': ["'self'"],
-    },
-
     'ember-cli-mirage': {
       directory: '../../addons/api/mirage',
     },
@@ -117,13 +103,6 @@ module.exports = function (environment) {
     featureFlags: featureEditions[EDITION],
   };
 
-  // Unsafe policy is necessary in development and test environments, but should
-  // not be used in production.
-  const enableUnsafeCSP = () => {
-    ENV.contentSecurityPolicy['script-src'].push("'unsafe-eval'");
-    ENV.contentSecurityPolicy['style-src'].push("'unsafe-inline'");
-  };
-
   if (environment === 'development') {
     // ENV.APP.LOG_RESOLVER = true;
     // ENV.APP.LOG_ACTIVE_GENERATION = true;
@@ -141,13 +120,6 @@ module.exports = function (environment) {
       },
     };
 
-    enableUnsafeCSP();
-    // TODO: should provide an env var to explicitly add a host to CSP
-    // at build time for any environment (not just development),
-    // rather than automatically include API_HOST.  Changes to CSP should
-    // be explicit.
-    if (API_HOST) ENV.contentSecurityPolicy['connect-src'].push(API_HOST);
-
     // Enable features in development
     ENV.featureFlags['ssh-target'] = false;
   }
@@ -163,9 +135,6 @@ module.exports = function (environment) {
     ENV.APP.rootElement = '#ember-testing';
     ENV.APP.autoboot = false;
 
-    // CSP breaks test coverage, so it is disabled in this environment
-    ENV.contentSecurityPolicyMeta = false;
-
     // Notification timeout should be 0 for fast tests
     ENV.notifyTimeout = 0;
     ENV.enableConfirmService = false;

ui/admin/package.json

@@ -56,7 +56,7 @@
     "ember-cli-app-version": "^5.0.0",
     "ember-cli-babel": "^7.26.8",
     "ember-cli-code-coverage": "^1.0.3",
-    "ember-cli-content-security-policy": "^1.1.1",
+    "ember-cli-content-security-policy": "^2.0.3",
     "ember-cli-dependency-checker": "^3.2.0",
     "ember-cli-htmlbars": "^5.7.1",
     "ember-cli-inject-live-reload": "^2.1.0",

yarn.lock

@@ -11957,13 +11957,16 @@ ember-cli-code-coverage@^1.0.3:
     node-dir "^0.1.17"
     walk-sync "^2.1.0"
 
-ember-cli-content-security-policy@^1.1.1:
-  version "1.1.1"
-  resolved "https://registry.yarnpkg.com/ember-cli-content-security-policy/-/ember-cli-content-security-policy-1.1.1.tgz#7d91a695319d8f99c317f3a594fba77bbfedf6c7"
-  integrity sha512-QgGAFt1nmsb0qF2YXI5iSM7jJVb09R2hrfX7uR+kkXMb5VyNQXdo2ZlX/DuIbePQVY4q9THpRh8Yf0UHJNbvDQ==
+ember-cli-content-security-policy@^2.0.3:
+  version "2.0.3"
+  resolved "https://registry.yarnpkg.com/ember-cli-content-security-policy/-/ember-cli-content-security-policy-2.0.3.tgz#833eca6be4d625f8b1b85cf5bad62544b535b483"
+  integrity sha512-tSGRbR2XiOjHk7oEH7LVF1y5S643rUEjl3mujI6EYPkrQbHaV0WdLyIWJkLvuP1KGnjBfvnLCyiKDFu6z2PjVg==
   dependencies:
     body-parser "^1.17.0"
-    chalk "^2.0.0"
+    chalk "^4.1.1"
+    debug "^4.3.1"
+    ember-cli-babel "^7.26.3"
+    ember-cli-version-checker "^5.0.2"
 
 ember-cli-dependency-checker@^3.2.0:
   version "3.2.0"
@@ -12266,7 +12269,7 @@ ember-cli-version-checker@^4.1.0:
     semver "^6.3.0"
     silent-error "^1.1.1"
 
-ember-cli-version-checker@^5.0.1, ember-cli-version-checker@^5.1.1, ember-cli-version-checker@^5.1.2:
+ember-cli-version-checker@^5.0.1, ember-cli-version-checker@^5.0.2, ember-cli-version-checker@^5.1.1, ember-cli-version-checker@^5.1.2:
   version "5.1.2"
   resolved "https://registry.yarnpkg.com/ember-cli-version-checker/-/ember-cli-version-checker-5.1.2.tgz#649c7b6404902e3b3d69c396e054cea964911ab0"
   integrity sha512-rk7GY+FmLn/2e22HsZs0Ycrz8HQ1W3Fv+2TFOuEFW9optnDXDgkntPBIl6gact/LHsfBM5RKbM3dHsIIeLgl0Q==