discourse/spec/fixtures/plugins/csp_extension/plugin.rb

# name: csp_extension
# about: Fixture plugin that extends default CSP
# version: 1.0
# authors: xrav3nz

extend_content_security_policy(
  script_src: ['https://from-plugin.com'],
  object_src: ['https://test-stripping.com']
)
FEATURE: allow plugins and themes to extend the default CSP (#6704) * FEATURE: allow plugins and themes to extend the default CSP For plugins: ``` extend_content_security_policy( script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'], style_src: ['https://domain.com/style.css'] ) ``` For themes and components: ``` extend_content_security_policy: type: list default: "script_src:https://domain.com/\|style_src:https://domain.com" ``` * clear CSP base url before each test we have a test that stubs `Rails.env.development?` to true * Only allow extending directives that core includes, for now 2018-11-30 09:51:45 -05:00			`# name: csp_extension`
			`# about: Fixture plugin that extends default CSP`
			`# version: 1.0`
			`# authors: xrav3nz`

			`extend_content_security_policy(`
FEATURE: allow extending CSP base-uri and object-src Plus, ensure :none is stripped, it cannot be combined with other sources 2019-01-09 15:33:42 -05:00			`script_src: ['https://from-plugin.com'],`
			`object_src: ['https://test-stripping.com']`
FEATURE: allow plugins and themes to extend the default CSP (#6704) * FEATURE: allow plugins and themes to extend the default CSP For plugins: ``` extend_content_security_policy( script_src: ['https://domain.com/script.js', 'https://your-cdn.com/'], style_src: ['https://domain.com/style.css'] ) ``` For themes and components: ``` extend_content_security_policy: type: list default: "script_src:https://domain.com/\|style_src:https://domain.com" ``` * clear CSP base url before each test we have a test that stubs `Rails.env.development?` to true * Only allow extending directives that core includes, for now 2018-11-30 09:51:45 -05:00			`)`