Skip to content

Commit f7ed4f5

Browse files
openshift-merge-bot[bot]openshift-merge-bot[bot]
authored
Merge pull request #2163 from jhadvig/OCPBUGS-48740
OCPBUGS-48740: Add missing CSP directives
2 parents e6cc8f6 + 28e2884 commit f7ed4f5

File tree

8 files changed

+67
-19
lines changed

8 files changed

+67
-19
lines changed

‎console/v1/types_console_plugin.go

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ type ConsolePluginSpec struct {
6161
// from a cluster service.
6262
// CSP violation reports can be viewed in the browser's console logs during development and
6363
// testing of the plugin in the OpenShift web console.
64-
// Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
64+
// Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
6565
// Each of the available directives may be defined only once in the list.
6666
// The value 'self' is automatically included in all fetch directives by the OpenShift web
6767
// console's backend.
@@ -101,7 +101,7 @@ type ConsolePluginSpec struct {
101101

102102
// DirectiveType is an enumeration of OpenShift web console supported CSP directives.
103103
// LoadType is an enumeration of i18n loading types.
104-
// +kubebuilder:validation:Enum:="DefaultSrc";"ScriptSrc";"StyleSrc";"ImgSrc";"FontSrc"
104+
// +kubebuilder:validation:Enum:="DefaultSrc";"ScriptSrc";"StyleSrc";"ImgSrc";"FontSrc";"ObjectSrc";"ConnectSrc"
105105
// +enum
106106
type DirectiveType string
107107

@@ -123,9 +123,17 @@ const (
123123
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src
124124
ImgSrc DirectiveType = "ImgSrc"
125125
// FontSrc directive specifies valid sources for fonts loaded using @font-face.
126-
// For more information about the FontSrcdirective, see:
126+
// For more information about the FontSrc directive, see:
127127
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
128128
FontSrc DirectiveType = "FontSrc"
129+
// ObjectSrc directive specifies valid sources for the <object> and <embed> elements.
130+
// For more information about the ObjectSrc directive, see:
131+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src
132+
ObjectSrc DirectiveType = "ObjectSrc"
133+
// ConnectSrc directive restricts the URLs which can be loaded using script interfaces.
134+
// For more information about the ConnectSrc directive, see:
135+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
136+
ConnectSrc DirectiveType = "ConnectSrc"
129137
)
130138

131139
// CSPDirectiveValue is single value for a Content-Security-Policy directive.
@@ -143,7 +151,7 @@ type CSPDirectiveValue string
143151
// ConsolePluginCSP holds configuration for a specific CSP directive
144152
type ConsolePluginCSP struct {
145153
// directive specifies which Content-Security-Policy directive to configure.
146-
// Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
154+
// Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
147155
// DefaultSrc directive serves as a fallback for the other CSP fetch directives.
148156
// For more information about the DefaultSrc directive, see:
149157
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
@@ -159,6 +167,12 @@ type ConsolePluginCSP struct {
159167
// FontSrc directive specifies valid sources for fonts loaded using @font-face.
160168
// For more information about the FontSrc directive, see:
161169
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
170+
// ObjectSrc directive specifies valid sources for the <object> and <embed> elements.
171+
// For more information about the ObjectSrc directive, see:
172+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src
173+
// ConnectSrc directive restricts the URLs which can be loaded using script interfaces.
174+
// For more information about the ConnectSrc directive, see:
175+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
162176
// +required
163177
Directive DirectiveType `json:"directive"`
164178
// values defines an array of values to append to the console defaults for this directive.

‎console/v1/zz_generated.crd-manifests/90_consoleplugins-CustomNoUpgrade.crd.yaml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ spec:
116116
from a cluster service.
117117
CSP violation reports can be viewed in the browser's console logs during development and
118118
testing of the plugin in the OpenShift web console.
119-
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
119+
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
120120
Each of the available directives may be defined only once in the list.
121121
The value 'self' is automatically included in all fetch directives by the OpenShift web
122122
console's backend.
@@ -151,7 +151,7 @@ spec:
151151
directive:
152152
description: |-
153153
directive specifies which Content-Security-Policy directive to configure.
154-
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
154+
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
155155
DefaultSrc directive serves as a fallback for the other CSP fetch directives.
156156
For more information about the DefaultSrc directive, see:
157157
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
@@ -167,12 +167,20 @@ spec:
167167
FontSrc directive specifies valid sources for fonts loaded using @font-face.
168168
For more information about the FontSrc directive, see:
169169
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
170+
ObjectSrc directive specifies valid sources for the <object> and <embed> elements.
171+
For more information about the ObjectSrc directive, see:
172+
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src
173+
ConnectSrc directive restricts the URLs which can be loaded using script interfaces.
174+
For more information about the ConnectSrc directive, see:
175+
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
170176
enum:
171177
- DefaultSrc
172178
- ScriptSrc
173179
- StyleSrc
174180
- ImgSrc
175181
- FontSrc
182+
- ObjectSrc
183+
- ConnectSrc
176184
type: string
177185
values:
178186
description: |-

‎console/v1/zz_generated.crd-manifests/90_consoleplugins-DevPreviewNoUpgrade.crd.yaml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ spec:
116116
from a cluster service.
117117
CSP violation reports can be viewed in the browser's console logs during development and
118118
testing of the plugin in the OpenShift web console.
119-
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
119+
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
120120
Each of the available directives may be defined only once in the list.
121121
The value 'self' is automatically included in all fetch directives by the OpenShift web
122122
console's backend.
@@ -151,7 +151,7 @@ spec:
151151
directive:
152152
description: |-
153153
directive specifies which Content-Security-Policy directive to configure.
154-
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
154+
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
155155
DefaultSrc directive serves as a fallback for the other CSP fetch directives.
156156
For more information about the DefaultSrc directive, see:
157157
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
@@ -167,12 +167,20 @@ spec:
167167
FontSrc directive specifies valid sources for fonts loaded using @font-face.
168168
For more information about the FontSrc directive, see:
169169
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
170+
ObjectSrc directive specifies valid sources for the <object> and <embed> elements.
171+
For more information about the ObjectSrc directive, see:
172+
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src
173+
ConnectSrc directive restricts the URLs which can be loaded using script interfaces.
174+
For more information about the ConnectSrc directive, see:
175+
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
170176
enum:
171177
- DefaultSrc
172178
- ScriptSrc
173179
- StyleSrc
174180
- ImgSrc
175181
- FontSrc
182+
- ObjectSrc
183+
- ConnectSrc
176184
type: string
177185
values:
178186
description: |-

‎console/v1/zz_generated.crd-manifests/90_consoleplugins-TechPreviewNoUpgrade.crd.yaml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -116,7 +116,7 @@ spec:
116116
from a cluster service.
117117
CSP violation reports can be viewed in the browser's console logs during development and
118118
testing of the plugin in the OpenShift web console.
119-
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
119+
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
120120
Each of the available directives may be defined only once in the list.
121121
The value 'self' is automatically included in all fetch directives by the OpenShift web
122122
console's backend.
@@ -151,7 +151,7 @@ spec:
151151
directive:
152152
description: |-
153153
directive specifies which Content-Security-Policy directive to configure.
154-
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
154+
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
155155
DefaultSrc directive serves as a fallback for the other CSP fetch directives.
156156
For more information about the DefaultSrc directive, see:
157157
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
@@ -167,12 +167,20 @@ spec:
167167
FontSrc directive specifies valid sources for fonts loaded using @font-face.
168168
For more information about the FontSrc directive, see:
169169
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
170+
ObjectSrc directive specifies valid sources for the <object> and <embed> elements.
171+
For more information about the ObjectSrc directive, see:
172+
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src
173+
ConnectSrc directive restricts the URLs which can be loaded using script interfaces.
174+
For more information about the ConnectSrc directive, see:
175+
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
170176
enum:
171177
- DefaultSrc
172178
- ScriptSrc
173179
- StyleSrc
174180
- ImgSrc
175181
- FontSrc
182+
- ObjectSrc
183+
- ConnectSrc
176184
type: string
177185
values:
178186
description: |-

‎console/v1/zz_generated.featuregated-crd-manifests/consoleplugins.console.openshift.io/ConsolePluginContentSecurityPolicy.yaml

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -114,7 +114,7 @@ spec:
114114
from a cluster service.
115115
CSP violation reports can be viewed in the browser's console logs during development and
116116
testing of the plugin in the OpenShift web console.
117-
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
117+
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
118118
Each of the available directives may be defined only once in the list.
119119
The value 'self' is automatically included in all fetch directives by the OpenShift web
120120
console's backend.
@@ -149,7 +149,7 @@ spec:
149149
directive:
150150
description: |-
151151
directive specifies which Content-Security-Policy directive to configure.
152-
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
152+
Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc, FontSrc, ObjectSrc and ConnectSrc.
153153
DefaultSrc directive serves as a fallback for the other CSP fetch directives.
154154
For more information about the DefaultSrc directive, see:
155155
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
@@ -165,12 +165,20 @@ spec:
165165
FontSrc directive specifies valid sources for fonts loaded using @font-face.
166166
For more information about the FontSrc directive, see:
167167
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
168+
ObjectSrc directive specifies valid sources for the <object> and <embed> elements.
169+
For more information about the ObjectSrc directive, see:
170+
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src
171+
ConnectSrc directive restricts the URLs which can be loaded using script interfaces.
172+
For more information about the ConnectSrc directive, see:
173+
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
168174
enum:
169175
- DefaultSrc
170176
- ScriptSrc
171177
- StyleSrc
172178
- ImgSrc
173179
- FontSrc
180+
- ObjectSrc
181+
- ConnectSrc
174182
type: string
175183
values:
176184
description: |-

0 commit comments

Comments
 (0)