Update content security (#1173)

* chore: 🤖 upgrade ember content security policy

ui/admin/config/content-security-policy.js

@@ -0,0 +1,34 @@
+'use strict';
+
+const API_HOST = process.env.API_HOST || '';
+
+module.exports = function (environment) {
+  let policy = {
+    // Deny everything by default
+    'default-src': ["'none'"],
+    'script-src': ["'self'"],
+    'frame-src': ["'self'"],
+    'font-src': ["'self'"],
+    'connect-src': ["'self'"],
+    'img-src': ["'self'", 'data:'],
+    'style-src': ["'self'"],
+    'media-src': ["'self'"],
+    'manifest-src': ["'self'"],
+    'style-src-attr': ["'self'"],
+  };
+
+  // Unsafe policy is necessary in development and test environments, but should
+  // not be used in production.
+  if (environment === 'development') {
+    policy['script-src'].push("'unsafe-eval'");
+    policy['style-src'].push("'unsafe-inline'");
+    if (API_HOST) policy['connect-src'].push(API_HOST);
+  }
+
+  return {
+    delivery: ['header'],
+    enabled: environment !== 'test',
+    policy,
+    reportOnly: false,
+  };
+};

ui/admin/config/environment.js

@@ -96,20 +96,6 @@ module.exports = function (environment) {
       },
     },
 
-    contentSecurityPolicyHeader: 'Content-Security-Policy',
-    contentSecurityPolicyMeta: true,
-    contentSecurityPolicy: {
-      'default-src': ["'none'"],
-      'script-src': ["'self'"],
-      'frame-src': ["'self'"],
-      'font-src': ["'self'"],
-      'connect-src': ["'self'"],
-      'img-src': ["'self'", 'data:'],
-      'style-src': ["'self'"],
-      'media-src': ["'self'"],
-      'manifest-src': ["'self'"],
-    },
-
     'ember-cli-mirage': {
       directory: '../../addons/api/mirage',
     },
@@ -117,13 +103,6 @@ module.exports = function (environment) {
     featureFlags: featureEditions[EDITION],
   };
 
-  // Unsafe policy is necessary in development and test environments, but should
-  // not be used in production.
-  const enableUnsafeCSP = () => {
-    ENV.contentSecurityPolicy['script-src'].push("'unsafe-eval'");
-    ENV.contentSecurityPolicy['style-src'].push("'unsafe-inline'");
-  };
-
   if (environment === 'development') {
     // ENV.APP.LOG_RESOLVER = true;
     // ENV.APP.LOG_ACTIVE_GENERATION = true;
@@ -141,13 +120,6 @@ module.exports = function (environment) {
       },
     };
 
-    enableUnsafeCSP();
-    // TODO: should provide an env var to explicitly add a host to CSP
-    // at build time for any environment (not just development),
-    // rather than automatically include API_HOST.  Changes to CSP should
-    // be explicit.
-    if (API_HOST) ENV.contentSecurityPolicy['connect-src'].push(API_HOST);
-
     // Enable features in development
     ENV.featureFlags['ssh-target'] = false;
   }
@@ -163,9 +135,6 @@ module.exports = function (environment) {
     ENV.APP.rootElement = '#ember-testing';
     ENV.APP.autoboot = false;
 
-    // CSP breaks test coverage, so it is disabled in this environment
-    ENV.contentSecurityPolicyMeta = false;
-
     // Notification timeout should be 0 for fast tests
     ENV.notifyTimeout = 0;
     ENV.enableConfirmService = false;

ui/admin/package.json

@@ -56,7 +56,7 @@
     "ember-cli-app-version": "^5.0.0",
     "ember-cli-babel": "^7.26.8",
     "ember-cli-code-coverage": "^1.0.3",
-    "ember-cli-content-security-policy": "^1.1.1",
+    "ember-cli-content-security-policy": "^2.0.3",
     "ember-cli-dependency-checker": "^3.2.0",
     "ember-cli-htmlbars": "^5.7.1",
     "ember-cli-inject-live-reload": "^2.1.0",