From 3fd9a5e36ff5cda39b70da71894088e1c00d1878 Mon Sep 17 00:00:00 2001 From: Andrew Duthie Date: Wed, 17 Jul 2024 08:20:17 -0400 Subject: [PATCH 1/3] Limit analytics CSP revisions to necessary entries changelog: Internal, Analytics, Limit analytics CSP revisions to necessary entries See: https://github.com/digital-analytics-program/gov-wide-code#content-security-policy --- app/controllers/users/sessions_controller.rb | 12 +++------ spec/requests/csp_spec.rb | 28 +++++++------------- 2 files changed, 13 insertions(+), 27 deletions(-) diff --git a/app/controllers/users/sessions_controller.rb b/app/controllers/users/sessions_controller.rb index 1d9d4cb905b..5f1c7535610 100644 --- a/app/controllers/users/sessions_controller.rb +++ b/app/controllers/users/sessions_controller.rb @@ -241,23 +241,17 @@ def pending_account_reset_request def override_csp_for_google_analytics return unless IdentityConfig.store.participate_in_dap + # See: https://github.com/digital-analytics-program/gov-wide-code#content-security-policy policy = current_content_security_policy policy.script_src( *policy.script_src, 'dap.digitalgov.gov', 'www.google-analytics.com', - '*.googletagmanager.com', + 'www.googletagmanager.com', ) policy.connect_src( *policy.connect_src, - '*.google-analytics.com', - '*.analytics.google.com', - '*.googletagmanager.com', - ) - policy.img_src( - *policy.img_src, - '*.google-analytics.com', - '*.googletagmanager.com', + 'www.google-analytics.com', ) request.content_security_policy = policy end diff --git a/spec/requests/csp_spec.rb b/spec/requests/csp_spec.rb index 04c91b91b79..5386b32159a 100644 --- a/spec/requests/csp_spec.rb +++ b/spec/requests/csp_spec.rb @@ -228,16 +228,11 @@ content_security_policy = parse_content_security_policy - # see GA4 docs for directives - # https://developers.google.com/tag-platform/security/guides/csp#google_analytics_4_google_analytics - expect(content_security_policy['script-src']).to include('*.googletagmanager.com') - - expect(content_security_policy['img-src']).to include('*.google-analytics.com') - expect(content_security_policy['img-src']).to include('*.googletagmanager.com') - - expect(content_security_policy['connect-src']).to include('*.google-analytics.com') - expect(content_security_policy['connect-src']).to include('*.analytics.google.com') - expect(content_security_policy['connect-src']).to include('*.googletagmanager.com') + # See: https://github.com/digital-analytics-program/gov-wide-code#content-security-policy + expect(content_security_policy['script-src']).to include('dap.digitalgov.gov') + expect(content_security_policy['script-src']).to include('www.google-analytics.com') + expect(content_security_policy['script-src']).to include('www.googletagmanager.com') + expect(content_security_policy['connect-src']).to include('www.google-analytics.com') end end @@ -247,14 +242,11 @@ content_security_policy = parse_content_security_policy - expect(content_security_policy['script-src']).to_not include('*.googletagmanager.com') - - expect(content_security_policy['img-src']).to_not include('*.google-analytics.com') - expect(content_security_policy['img-src']).to_not include('*.googletagmanager.com') - - expect(content_security_policy['connect-src']).to_not include('*.google-analytics.com') - expect(content_security_policy['connect-src']).to_not include('*.analytics.google.com') - expect(content_security_policy['connect-src']).to_not include('*.googletagmanager.com') + # See: https://github.com/digital-analytics-program/gov-wide-code#content-security-policy + expect(content_security_policy['script-src']).not_to include('dap.digitalgov.gov') + expect(content_security_policy['script-src']).not_to include('www.google-analytics.com') + expect(content_security_policy['script-src']).not_to include('www.googletagmanager.com') + expect(content_security_policy['connect-src']).not_to include('www.google-analytics.com') end end end From 5e2c65ae497599dc21f6d8a7485ea2beab1fc1c3 Mon Sep 17 00:00:00 2001 From: Andrew Duthie Date: Wed, 17 Jul 2024 08:22:40 -0400 Subject: [PATCH 2/3] Temporary: Enable DAP in review applications --- config/application.yml.default.docker | 1 + 1 file changed, 1 insertion(+) diff --git a/config/application.yml.default.docker b/config/application.yml.default.docker index 4aa054a39ba..18fe50b01fe 100644 --- a/config/application.yml.default.docker +++ b/config/application.yml.default.docker @@ -19,6 +19,7 @@ production: recaptcha_mock_validator: true redis_throttle_url: ['env', 'REDIS_THROTTLE_URL'] redis_url: ['env', 'REDIS_URL'] + participate_in_dap: true password_pepper: f22d4b2cafac9066fe2f4416f5b7a32c session_encryption_key: 27bad3c25711099429c1afdfd1890910f3b59f5a4faec1c85e945cb8b02b02f261ba501d99cfbb4fab394e0102de6fecf8ffe260f322f610db3e96b2a775c120 phone_recaptcha_score_threshold: 0.5 From 44f40f0ee1f31ee2723ef7e7f547a55d19072a07 Mon Sep 17 00:00:00 2001 From: Andrew Duthie Date: Mon, 5 Aug 2024 07:43:12 -0400 Subject: [PATCH 3/3] Revert "Temporary: Enable DAP in review applications" This reverts commit 5e2c65ae497599dc21f6d8a7485ea2beab1fc1c3. --- config/application.yml.default.docker | 1 - 1 file changed, 1 deletion(-) diff --git a/config/application.yml.default.docker b/config/application.yml.default.docker index 18fe50b01fe..4aa054a39ba 100644 --- a/config/application.yml.default.docker +++ b/config/application.yml.default.docker @@ -19,7 +19,6 @@ production: recaptcha_mock_validator: true redis_throttle_url: ['env', 'REDIS_THROTTLE_URL'] redis_url: ['env', 'REDIS_URL'] - participate_in_dap: true password_pepper: f22d4b2cafac9066fe2f4416f5b7a32c session_encryption_key: 27bad3c25711099429c1afdfd1890910f3b59f5a4faec1c85e945cb8b02b02f261ba501d99cfbb4fab394e0102de6fecf8ffe260f322f610db3e96b2a775c120 phone_recaptcha_score_threshold: 0.5