DCXY-18423 add child-src rule, with blob: for dev and stage

adobecom · Jul 23, 2023 · 4d8ab67 · 4d8ab67
1 parent 65eda6d
commit 4d8ab67
Show file tree

Hide file tree

Showing 4 changed files with 22 additions and 4 deletions.
diff --git a/acrobat/scripts/contentSecurityPolicy/csp.js b/acrobat/scripts/contentSecurityPolicy/csp.js
@@ -21,7 +21,8 @@ async function getCspEnv() {
 export default async function ContentSecurityPolicy() {
   const { default: ENV } = await getCspEnv();
 
-  const theCSP = `connect-src ${ENV.connectSrc.join(' ')}\
+  const theCSP = `child-src ${ENV.childSrc.join(' ')}\
+  connect-src ${ENV.connectSrc.join(' ')}\
   default-src ${ENV.defaultSrc.join(' ')}\
   font-src ${ENV.fontSrc.join(' ')}\
   form-action ${ENV.formAction.join(' ')}\

diff --git a/acrobat/scripts/contentSecurityPolicy/dev.js b/acrobat/scripts/contentSecurityPolicy/dev.js
@@ -1,3 +1,9 @@
+const childSrc = [
+  '\'self\'',
+  'blob:',
+  ';',
+];
+
 const connectSrc = [
   '\'self\'',
   'blob:',
@@ -225,4 +231,4 @@ const workerSrc = [
 // TRY This
 // use variables for the different domians
 
-export default { connectSrc, defaultSrc, fontSrc, formAction, frameSrc, imgSrc, manifestSrc, scriptSrc, styleSrc, workerSrc};
+export default { childSrc, connectSrc, defaultSrc, fontSrc, formAction, frameSrc, imgSrc, manifestSrc, scriptSrc, styleSrc, workerSrc};
diff --git a/acrobat/scripts/contentSecurityPolicy/prod.js b/acrobat/scripts/contentSecurityPolicy/prod.js
@@ -1,3 +1,8 @@
+const childSrc = [
+  '\'self\'',
+  ';',
+];
+
 const connectSrc = [
   '\'self\'',
   'blob:',
@@ -239,4 +244,4 @@ const workerSrc = [
   ';',
 ];
 
-export default { connectSrc, defaultSrc, fontSrc, formAction, frameSrc, imgSrc, manifestSrc, scriptSrc, styleSrc, workerSrc};
+export default { childSrc, connectSrc, defaultSrc, fontSrc, formAction, frameSrc, imgSrc, manifestSrc, scriptSrc, styleSrc, workerSrc};
diff --git a/acrobat/scripts/contentSecurityPolicy/stage.js b/acrobat/scripts/contentSecurityPolicy/stage.js
@@ -1,3 +1,9 @@
+const childSrc = [
+  '\'self\'',
+  'blob:',
+  ';',
+];
+
 const connectSrc = [
   '\'self\'',
   'blob:',
@@ -258,4 +264,4 @@ const workerSrc = [
   ';',
 ];
 
-export default { connectSrc, defaultSrc, fontSrc, formAction, frameSrc, imgSrc, manifestSrc, scriptSrc, styleSrc, workerSrc};
+export default { childSrc, connectSrc, defaultSrc, fontSrc, formAction, frameSrc, imgSrc, manifestSrc, scriptSrc, styleSrc, workerSrc};