Add `PAPERCLIP_ROOT_URL` to Content-Security-Policy when used (#28561)

main
Claire 2024-01-05 11:45:36 +01:00 committed by GitHub
parent 964a0ecf37
commit 5f4643b895
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
2 changed files with 22 additions and 1 deletions

View File

@ -10,7 +10,7 @@ class ContentSecurityPolicy
end
def media_hosts
[assets_host, cdn_host_value].compact
[assets_host, cdn_host_value, paperclip_root_url].compact
end
private
@ -23,6 +23,15 @@ class ContentSecurityPolicy
s3_alias_host || s3_cloudfront_host || azure_alias_host || s3_hostname_host
end
def paperclip_root_url
root_url = ENV.fetch('PAPERCLIP_ROOT_URL', nil)
return if root_url.blank?
(Addressable::URI.parse(assets_host) + root_url).tap do |uri|
uri.path += '/' unless uri.path.blank? || uri.path.end_with?('/')
end.to_s
end
def url_from_base_host
host_to_url(base_host)
end

View File

@ -125,5 +125,17 @@ describe ContentSecurityPolicy do
expect(subject.media_hosts).to contain_exactly(subject.assets_host, 'https://asset-host.s3.example')
end
end
context 'when PAPERCLIP_ROOT_URL is configured' do
around do |example|
ClimateControl.modify PAPERCLIP_ROOT_URL: 'https://paperclip-host.example' do
example.run
end
end
it 'uses the provided URL in the content security policy' do
expect(subject.media_hosts).to contain_exactly(subject.assets_host, 'https://paperclip-host.example')
end
end
end
end