Discource-C
/
discourse
mirror of https://github.com/discourse/discourse.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
discourse/spec/support
History
David Taylor b1f74ab59e
FEATURE: Add experimental option for strict-dynamic CSP (#25664) 
The strict-dynamic CSP directive is supported in all our target browsers, and makes for a much simpler configuration. Instead of allowlisting paths, we use a per-request nonce to authorize `<script>` tags, and then those scripts are allowed to load additional scripts (or add additional inline scripts) without restriction.

This becomes especially useful when admins want to add external scripts like Google Tag Manager, or advertising scripts, which then go on to load a ton of other scripts.

All script tags introduced via themes will automatically have the nonce attribute applied, so it should be zero-effort for theme developers. Plugins *may* need some changes if they are inserting their own script tags.

This commit introduces a strict-dynamic-based CSP behind an experimental `content_security_policy_strict_dynamic` site setting.
 		2024-02-16 11:16:54 +00:00
..
versioning DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
bookmarkable_helper.rb DEV: Change Bookmarkable registration to DiscoursePluginRegistry (#20556) 2023-03-08 10:39:12 +10:00
common_basic_reviewable_serializer.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
concurrency.rb DEV: Fix various rubocop lints (#24749) 2023-12-06 23:25:00 +01:00
diagnostics_helper.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
discourse_event_helper.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
dom_matcher.rb DEV: Update minitest to 5.19.0 (#22821) 2023-07-27 12:18:40 +02:00
dummy_custom_summarization.rb FEATURE: Prefer topic_embed's cached content when summarizing (#25190) 2024-01-09 14:00:01 -03:00
fake_bookmark_hashtag_data_source.rb DEV: Introduce enabled? API to hashtag data sources (#22632) 2023-07-18 09:39:01 +10:00
fake_logger.rb DEV: Fix Lint/DuplicateMethods (#24746) 2023-12-06 13:18:34 +01:00
fake_s3.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
fast_image_helpers.rb FIX: remove 'crawl_images' site setting (#14646) 2021-10-19 17:12:29 +05:30
final_destination_helper.rb Revert "DEV: Allow webmock to intercept `FinalDestination::HTTP` requests (#20575)" (#20576) 2023-03-08 11:26:32 +08:00
helpers.rb DEV: Remove full group refreshes from tests (#25414) 2024-01-25 14:28:26 +08:00
imap_helper.rb DEV: lint against Layout/EmptyLineBetweenDefs (#24914) 2023-12-15 23:46:04 +08:00
integration_helpers.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
match_html_matcher.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
mock_git_importer.rb SECURITY: Expand and improve SSRF Protections (#18815) 2022-11-01 16:33:17 +00:00
negated_matcher.rb DEV: Don’t use `change { … }.by(0)` in specs 2022-07-26 10:34:15 +02:00
onebox_helpers.rb DEV: Replace custom Onebox symbolize_keys implementation with ActiveSupport (#23828) 2023-10-09 09:32:09 +02:00
rate_limit_matcher.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
sample_plugin_site_settings.yml FIX: Sort plugins by their setting category name (#25128) 2024-01-08 09:57:25 +10:00
shared_examples_for_custom_fields.rb DEV: Set limits on custom fields 2023-06-13 11:47:21 +02:00
shared_examples_for_stats_cacheable.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
sidekiq_helpers.rb FIX: send email to normalized email owner when hiding emails (#23524) 2023-09-12 11:06:35 +10:00
site_settings_helpers.rb DEV: Avoid leaking new site setting states in test environment (#21713) 2023-05-25 07:53:57 +08:00
system_helpers.rb FEATURE: Add experimental option for strict-dynamic CSP (#25664) 2024-02-16 11:16:54 +00:00
test_second_factor_action.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
time_matcher.rb DEV: support nil values in the eq_time matcher (#22116) 2023-06-20 19:06:40 +04:00
topic_guardian_can_see_consistency_check.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
ts_vector_matcher.rb FIX: domain searches not working properly for URLs (#20136) 2023-02-03 09:55:28 +11:00
uploads_helpers.rb DEV: Apply syntax_tree formatting to `spec/*` 2023-01-09 11:49:28 +00:00
user_sidebar_serializer_attributes.rb DEV: Allow fab! without block (#24314) 2023-11-09 16:47:59 -06:00
webauthn_integration_helpers.rb DEV: Refactor webauthn to support passkeys (1/3) (#23586) 2023-10-03 14:59:28 -04:00