From 7661a7782441ce85ee668cd70a3b5df60690be51 Mon Sep 17 00:00:00 2001
From: mcollao-hc <106274486+mcollao-hc@users.noreply.github.com>
Date: Thu, 6 Oct 2022 14:23:14 -0500
Subject: [PATCH] [ICU-6448] Update CSP to add frame-ancestors: self (#1367)

* update csp

* add csp for ui
---
 ui/admin/config/content-security-policy.js                    | 1 +
 ui/desktop/electron-app/src/config/content-security-policy.js | 1 +
 2 files changed, 2 insertions(+)

diff --git a/ui/admin/config/content-security-policy.js b/ui/admin/config/content-security-policy.js
index 66d9d644a..56cebdf2c 100644
--- a/ui/admin/config/content-security-policy.js
+++ b/ui/admin/config/content-security-policy.js
@@ -15,6 +15,7 @@ module.exports = function (environment) {
     'media-src': ["'self'"],
     'manifest-src': ["'self'"],
     'style-src-attr': ["'self'"],
+    'frame-ancestors': ["'self'"],
   };
 
   // Unsafe policy is necessary in development and test environments, but should
diff --git a/ui/desktop/electron-app/src/config/content-security-policy.js b/ui/desktop/electron-app/src/config/content-security-policy.js
index 496e15b40..5b05e9815 100644
--- a/ui/desktop/electron-app/src/config/content-security-policy.js
+++ b/ui/desktop/electron-app/src/config/content-security-policy.js
@@ -11,6 +11,7 @@ const csp = {
   'style-src': ["'self'"],
   'media-src': ["'self'"],
   'manifest-src': ["'self'"],
+  'frame-ancestors': ["'self'"],
 };
 
 // Dev policy is necessary for Ember live reload.