chore: 🤖 initialize content security policy

ui/core/config/environment.js

@@ -22,6 +22,27 @@ module.exports = function (environment) {
       // Here you can pass flags/options to your application instance
       // when it is created
     },
+
+    contentSecurityPolicyHeader: 'Content-Security-Policy',
+    contentSecurityPolicyMeta: true,
+    contentSecurityPolicy: {
+      'default-src': ["'none'"],
+      'script-src': ["'self'"],
+      'frame-src': ["'self'"],
+      'font-src': ["'self'"],
+      'connect-src': ["'self'"],
+      'img-src': ["'self'"],
+      'style-src': ["'self'"],
+      'media-src': ["'self'"],
+      'manifest-src': ["'self'"]
+    }
+  };
+
+  // Unsafe policy is necessary in development and test environments, but should
+  // not be used in production.
+  const enableUnsafeCSP = () => {
+    ENV.contentSecurityPolicy['script-src'].push("'unsafe-eval'");
+    ENV.contentSecurityPolicy['style-src'].push("'unsafe-inline'");
   };
 
   if (environment === 'development') {
@@ -30,6 +51,18 @@ module.exports = function (environment) {
     // ENV.APP.LOG_TRANSITIONS = true;
     // ENV.APP.LOG_TRANSITIONS_INTERNAL = true;
     // ENV.APP.LOG_VIEW_LOOKUPS = true;
+
+    ENV['ember-a11y-testing'] = {
+      componentOptions: {
+        axeOptions: {
+          checks: {
+            'color-contrast': { options: { noScroll: true } }
+          }
+        }
+      }
+    };
+
+    enableUnsafeCSP();
   }
 
   if (environment === 'test') {
@@ -42,6 +75,9 @@ module.exports = function (environment) {
 
     ENV.APP.rootElement = '#ember-testing';
     ENV.APP.autoboot = false;
+
+    // CSP breaks test coverage, so it is disabled in this environment
+    ENV.contentSecurityPolicyMeta = false;
   }
 
   if (environment === 'production') {

ui/core/package.json

@@ -42,6 +42,7 @@
     "ember-cli-app-version": "^3.2.0",
     "ember-cli-babel": "^7.17.2",
     "ember-cli-code-coverage": "^1.0.0-beta.9",
+    "ember-cli-content-security-policy": "^1.1.1",
     "ember-cli-dependency-checker": "^3.2.0",
     "ember-cli-eslint": "^5.1.0",
     "ember-cli-htmlbars": "^4.2.2",

yarn.lock

@@ -4586,7 +4586,7 @@ bn.js@^4.0.0, bn.js@^4.1.0, bn.js@^4.1.1, bn.js@^4.4.0:
   resolved "https://registry.yarnpkg.com/bn.js/-/bn.js-4.11.8.tgz#2cde09eb5ee341f484746bb0309b3253b1b1442f"
   integrity sha512-ItfYfPLkWHUjckQCk8xC+LwxgK8NYcXywGigJgSwOP8Y2iyWT4f2vsZnoOXTTbo+o5yXmIUJ4gn5538SO5S3gA==
 
-body-parser@1.19.0, body-parser@^1.19.0:
+body-parser@1.19.0, body-parser@^1.17.0, body-parser@^1.19.0:
   version "1.19.0"
   resolved "https://registry.yarnpkg.com/body-parser/-/body-parser-1.19.0.tgz#96b2709e57c9c4e09a6fd66a8fd979844f69f08a"
   integrity sha512-dhEPs72UPbDnAQJ9ZKMNTP6ptJaionhP5cBb541nXPlW60Jepo9RV/a4fX4XWW9CuFNK22krhrj1+rgzifNCsw==
@@ -7381,6 +7381,14 @@ ember-cli-code-coverage@^1.0.0-beta.9:
     rsvp "^4.8.5"
     walk-sync "^2.0.2"
 
+ember-cli-content-security-policy@^1.1.1:
+  version "1.1.1"
+  resolved "https://registry.yarnpkg.com/ember-cli-content-security-policy/-/ember-cli-content-security-policy-1.1.1.tgz#7d91a695319d8f99c317f3a594fba77bbfedf6c7"
+  integrity sha512-QgGAFt1nmsb0qF2YXI5iSM7jJVb09R2hrfX7uR+kkXMb5VyNQXdo2ZlX/DuIbePQVY4q9THpRh8Yf0UHJNbvDQ==
+  dependencies:
+    body-parser "^1.17.0"
+    chalk "^2.0.0"
+
 ember-cli-dependency-checker@^3.2.0:
   version "3.2.0"
   resolved "https://registry.yarnpkg.com/ember-cli-dependency-checker/-/ember-cli-dependency-checker-3.2.0.tgz#9202ad9e14d6fda33cffc22a11c343c2a8885330"