From f8cb41215af83cfb2d2e7cee0735f431396cbea3 Mon Sep 17 00:00:00 2001 From: Colin Darie Date: Wed, 24 Jul 2024 19:02:44 +0200 Subject: [PATCH] fix(csp): don't list twice same connect whitelist domain --- config/initializers/content_security_policy.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index d07dbf05a..4f66f081a 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -22,7 +22,7 @@ Rails.application.config.content_security_policy do |policy| connect_whitelist = ["wss://*.crisp.chat", "*.crisp.chat", "app.franceconnect.gouv.fr", "openmaptiles.geo.data.gouv.fr", "openmaptiles.github.io", "tiles.geo.api.gouv.fr", "data.geopf.fr"] connect_whitelist << ENV.fetch('APP_HOST') - connect_whitelist << ENV.fetch('APP_HOST_LEGACY') if ENV.key?('APP_HOST_LEGACY') + connect_whitelist << ENV.fetch('APP_HOST_LEGACY') if ENV.key?('APP_HOST_LEGACY') && ENV['APP_HOST_LEGACY'] != ENV['APP_HOST'] connect_whitelist << "*.amazonaws.com" if Rails.configuration.active_storage.service == :amazon connect_whitelist += [URI(ENV["SENTRY_DSN_JS"]).host, URI(ENV["SENTRY_DSN_RAILS"]).host].compact.uniq connect_whitelist << URI(DS_PROXY_URL).host if DS_PROXY_URL.present?