Merge pull request guardian#4258 from bbc/t1615-img-src-headers

add in config options for image sources in content security policy.
bbc · Apr 8, 2024 · dd79340 · dd79340
2 parents e37e3ac + cb8fc7f
commit dd79340
Show file tree

Hide file tree

Showing 3 changed files with 3 additions and 1 deletion.
diff --git a/dev/script/generate-config/service-config.js b/dev/script/generate-config/service-config.js
@@ -107,6 +107,7 @@ function getKahunaConfig(config){
         |links.supportEmail="${config.links.supportEmail}"
         |security.cors.allowedOrigins="${getCorsAllowedOriginString(config)}"
         |security.frameAncestors="https://*.${config.DOMAIN}"
+        |security.imageSources=["https://*.newslabs.co/"]
         |metrics.request.enabled=false
         |${pinboardConfig}
         |`;

diff --git a/kahuna/app/KahunaComponents.scala b/kahuna/app/KahunaComponents.scala
@@ -51,7 +51,7 @@ object KahunaSecurityConfig {
       URI.ensureSecure("app.getsentry.com").toString,
       "https://*.googleusercontent.com",
       "'self'"
-    ).mkString(" ")}"
+    ).mkString(" ")} ${config.imageSources.mkString(" ")}"
 
     val fontSources = s"font-src data: 'self' ${config.fontSources.mkString(" ")}"
 

diff --git a/kahuna/app/lib/KahunaConfig.scala b/kahuna/app/lib/KahunaConfig.scala
@@ -47,6 +47,7 @@ class KahunaConfig(resources: GridConfigResources) extends CommonConfig(resource
     else s"https://$ingestBucket.s3.$awsRegion.amazonaws.com"
   }
   val fontSources: Set[String] = getStringSet("security.fontSources")
+  val imageSources: Set[String] = getStringSet("security.imageSources")
 
   val scriptsToLoad: List[ScriptToLoad] = getConfigList("scriptsToLoad").map(entry => ScriptToLoad(
     host = entry.getString("host"),