govuk_app_config 4.11.0 → 4.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9a99ab31af0eeb89e3d7b1fb7538ea6095d52d93e08dbccd8cf17a9431beaa1e
-  data.tar.gz: f3664830daf4a0900bad8f5087daf791969a9310e6a8d39c1b71165519600d2c
+  metadata.gz: 7906015f743285fadae37a3b4c0754fcb3ef5d6c6d59ff5b8f67d0f0b43ce970
+  data.tar.gz: da302c7be0424e4b4b476669468e8cbb1b6a3f5b38a017ddac4999ec14e0b622
 SHA512:
-  metadata.gz: 13ae8c4325ed10df67460a2eabce7fd6bd9da83b0d250ac7cbbefc78ab8d32fad2370f106cb323b38c14f379c27e881300ecc63adb4971caa3acd5aaa75df13d
-  data.tar.gz: 6b439e2ea5f9970c9e9eb7ecd38e6389ab4f4a028b62b566c107fa6b79459f62a5ddb5eae016f16b8fbd74258dee339d93e802335270e6c321c39041e56bde88
+  metadata.gz: fac4b8128b250e74a9e71f165e6ca5eb431bd3f364a2efea18ceb696ce55d9e772fe73a04020811d6cbdd68341bd711fe07bc99e3f37d4ad371ea57b5446360d
+  data.tar.gz: adef9932375e8c63f002a99ef759e1a301fdfbd1f4ad21a7b089fcda8b33acf83dcb4b6c658e5ccf9872171fac6cf58c2e0a0bbfd2a31dd2fbf7323669ea746b

data/.github/dependabot.yml

@@ -4,9 +4,7 @@ updates:
   directory: "/"
   schedule:
     interval: daily
-    time: "03:00"
-  open-pull-requests-limit: 10
-  ignore:
-  - dependency-name: aws-xray-sdk
-    versions:
-    - "> 0.10.0"
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: daily

data/CHANGELOG.md

@@ -1,3 +1,16 @@
+# 4.12.0
+
+* Allow `https://img.youtube.com` as a CSP image source
+* CSP only allows scripts, styles and fonts from self which reflects GOV.UK production behaviour
+* Set the default CSP behaviour to be allow communication only to self
+* Remove webchat scripts from the CSP, these are now handled in [government-frontend](https://github.com/alphagov/government-frontend/pull/2643)
+* Remove `www.signin.service.gov.uk` from the CSP as it is no-longer used in GOV.UK
+* Disallow data fonts in the global Content Security policy
+
+# 4.11.1
+
+- Remove govuk_i18n plural rules file
+
 # 4.11.0
 
 - Update Plek support to allow version 5

data/README.md

@@ -178,4 +178,4 @@ GovukPrometheusExporter.configure
 
 ## License
 
-[MIT License](LICENSE.md)
+[MIT License](LICENCE)

data/govuk_app_config.gemspec

@@ -37,6 +37,6 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rake", "~> 13.0"
   spec.add_development_dependency "rspec", "~> 3.10"
   spec.add_development_dependency "rspec-its", "~> 1.3"
-  spec.add_development_dependency "rubocop-govuk", "4.8.0"
+  spec.add_development_dependency "rubocop-govuk", "4.9.0"
   spec.add_development_dependency "webmock"
 end

data/lib/govuk_app_config/govuk_content_security_policy.rb

@@ -1,12 +1,12 @@
 module GovukContentSecurityPolicy
   # Generate a Content Security Policy (CSP) directive.
   #
-  # See https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP for more CSP info.
+  # Before making any changes please read our documentation: https://docs.publishing.service.gov.uk/manual/content-security-policy.html
   #
-  # The resulting policy should be checked with:
+  # If you are making a change here you should consider 2 basic rules of thumb:
   #
-  # - https://csp-evaluator.withgoogle.com
-  # - https://cspvalidator.org
+  # 1. Are you creating a XSS risk? Adding unsafe-* declarations, allowing data: URLs or being overly permissive (e.g. https) risks these
+  # 2. Is this change needed globally, if it's just one or two apps the change should be applied in them directly.
 
   GOVUK_DOMAINS = [
     "*.publishing.service.gov.uk",
@@ -26,64 +26,56 @@ module GovukContentSecurityPolicy
 
   def self.build_policy(policy)
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
-    policy.default_src :https, :self, *GOVUK_DOMAINS
+    policy.default_src :self
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src
     policy.img_src :self,
-                   :data, # Base64 encoded images
+                   # This allows Base64 encoded images, but is a security
+                   # risk as it can embed third party resources.
+                   # As of December 2022, we intend to remove this prior
+                   # to making the CSP live.
+                   :data,
                    *GOVUK_DOMAINS,
                    *GOOGLE_ANALYTICS_DOMAINS, # Tracking pixels
                    # Speedcurve real user monitoring (RUM) - as per: https://support.speedcurve.com/docs/add-rum-to-your-csp
                    "lux.speedcurve.com",
                    # Some content still links to an old domain we used to use
-                   "assets.digital.cabinet-office.gov.uk"
+                   "assets.digital.cabinet-office.gov.uk",
+                   # Allow YouTube thumbnails
+                   "https://img.youtube.com"
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
     policy.script_src :self,
-                      *GOVUK_DOMAINS,
                       *GOOGLE_ANALYTICS_DOMAINS,
                       *GOOGLE_STATIC_DOMAINS,
-                      # Allow JSONP call to Verify to check whether the user is logged in
-                      "www.signin.service.gov.uk",
                       # Allow YouTube Embeds (Govspeak turns YouTube links into embeds)
                       "*.ytimg.com",
                       "www.youtube.com",
                       "www.youtube-nocookie.com",
-                      # Allow JSONP call to Nuance - HMRC web chat provider
-                      "hmrc-uk.digital.nuance.com",
-                      # Allow all inline scripts until we can conclusively
-                      # document all the inline scripts we use,
-                      # and there's a better way to filter out junk reports
+                      # This allows inline scripts and thus is a XSS risk.
+                      # As of December 2022, we intend to work towards removing
+                      # this from apps that don't use jQuery 1.12 (which needs
+                      # this) once we've set up nonces.
                       :unsafe_inline
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
     policy.style_src :self,
-                     *GOVUK_DOMAINS,
                      *GOOGLE_STATIC_DOMAINS,
-                     # We use the `style=""` attribute on some HTML elements
+                     # This allows style="" attributes and style elements.
+                     # As of December 2022, we intend to remove this prior
+                     # to making the CSP live due to the security risks it has.
                      :unsafe_inline
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
-    policy.font_src :self,
-                    *GOVUK_DOMAINS,
-                    :data # Used by some legacy fonts
+    # Note: we purposely don't include data here because it produces a security risk.
+    policy.font_src :self
 
     # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
     policy.connect_src :self,
                        *GOVUK_DOMAINS,
                        *GOOGLE_ANALYTICS_DOMAINS,
                        # Speedcurve real user monitoring (RUM) - as per: https://support.speedcurve.com/docs/add-rum-to-your-csp
-                       "lux.speedcurve.com",
-                       # Allow connecting to web chat from HMRC contact pages
-                       "www.tax.service.gov.uk",
-                       # Allow JSON call to Nuance - HMRC web chat provider
-                       "hmrc-uk.digital.nuance.com",
-                       # Allow JSON call to klick2contact - HMPO web chat provider
-                       "hmpowebchat.klick2contact.com",
-                       # Allow JSON call to Eckoh - HMPO web chat provider
-                       "omni.eckoh.uk",
-                       # Allow connecting to Verify to check whether the user is logged in
-                       "www.signin.service.gov.uk"
+                       "lux.speedcurve.com"
 
     # Disallow all <object>, <embed>, and <applet> elements
     #
@@ -99,6 +91,14 @@ module GovukContentSecurityPolicy
   def self.configure
     Rails.application.config.content_security_policy_report_only = ENV.include?("GOVUK_CSP_REPORT_ONLY")
 
-    Rails.application.config.content_security_policy(&method(:build_policy))
+    policy = Rails.application.config.content_security_policy(&method(:build_policy))
+
+    # # allow apps to customise the CSP by passing a block e.g:
+    # GovukContentSecuirtyPolicy.configure do |policy|
+    #   policy.image_src(*policy.image_src, "https://i.ytimg.com")
+    # end
+    yield(policy) if block_given?
+
+    policy
   end
 end

data/lib/govuk_app_config/version.rb

@@ -1,3 +1,3 @@
 module GovukAppConfig
-  VERSION = "4.11.0".freeze
+  VERSION = "4.12.0".freeze
 end

data/lib/govuk_app_config.rb

@@ -3,7 +3,6 @@ require "govuk_app_config/govuk_statsd"
 require "govuk_app_config/govuk_error"
 require "govuk_app_config/govuk_proxy/static_proxy"
 require "govuk_app_config/govuk_healthcheck"
-require "govuk_app_config/govuk_i18n"
 # This require is deprecated and should be removed on next major version bump
 # and should be required by applications directly.
 require "govuk_app_config/govuk_unicorn"

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govuk_app_config
 version: !ruby/object:Gem::Version
-  version: 4.11.0
+  version: 4.12.0
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2022-11-21 00:00:00.000000000 Z
+date: 2023-01-03 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: logstasher
@@ -252,14 +252,14 @@ dependencies:
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.8.0
+        version: 4.9.0
   type: :development
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - '='
       - !ruby/object:Gem::Version
-        version: 4.8.0
+        version: 4.9.0
 - !ruby/object:Gem::Dependency
   name: webmock
   requirement: !ruby/object:Gem::Requirement
@@ -289,7 +289,7 @@ files:
 - ".ruby-version"
 - CHANGELOG.md
 - Gemfile
-- LICENSE.md
+- LICENCE
 - README.md
 - Rakefile
 - bin/console
@@ -308,7 +308,6 @@ files:
 - lib/govuk_app_config/govuk_healthcheck/rails_cache.rb
 - lib/govuk_app_config/govuk_healthcheck/redis.rb
 - lib/govuk_app_config/govuk_healthcheck/sidekiq_redis.rb
-- lib/govuk_app_config/govuk_i18n.rb
 - lib/govuk_app_config/govuk_logging.rb
 - lib/govuk_app_config/govuk_prometheus_exporter.rb
 - lib/govuk_app_config/govuk_proxy/static_proxy.rb
@@ -337,7 +336,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.3.26
+rubygems_version: 3.4.2
 signing_key: 
 specification_version: 4
 summary: Base configuration for GOV.UK applications

data/lib/govuk_app_config/govuk_i18n.rb

@@ -1,78 +0,0 @@
-module GovukI18n
-  def self.plurals
-    {
-      # Azerbaijani
-      az: { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Welsh
-      cy: { i18n: { plural: { keys: %i[zero one two few many other],
-                              rule:
-                                lambda do |n|
-                                  case n
-                                  when 0 then :zero
-                                  when 1 then :one
-                                  when 2 then :two
-                                  when 3 then :few
-                                  when 6 then :many
-                                  else :other
-                                  end
-                                end } } },
-      # Dari - this isn't an iso code. Probably should be 'prs' as per ISO 639-3.
-      dr: { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Latin America and Caribbean Spanish
-      "es-419": { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Persian
-      fa: { i18n: { plural: { keys: %i[one other], rule: ->(n) { [0, 1].include?(n) ? :one : :other } } } },
-      # Scottish Gaelic
-      gd: { i18n: { plural: { keys: %i[one two few other],
-                              rule:
-                                lambda do |n|
-                                  if [1, 11].include?(n)
-                                    :one
-                                  elsif [2, 12].include?(n)
-                                    :two
-                                  elsif [3, 4, 5, 6, 7, 8, 9, 10, 13, 14, 15, 16, 17, 18, 19].include?(n)
-                                    :few
-                                  else
-                                    :other
-                                  end
-                                end } } },
-      # Armenian
-      hy: { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Georgian
-      ka: { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Kazakh
-      kk: { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Punjabi Shahmukhi
-      "pa-pk": { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Maltese
-      mt: { i18n: { plural: { keys: %i[one few many other],
-                              rule:
-                                lambda do |n|
-                                  n ||= 0
-                                  mod100 = n % 100
-
-                                  if n == 1
-                                    :one
-                                  elsif n.zero? || (2..10).to_a.include?(mod100)
-                                    :few
-                                  elsif (11..19).to_a.include?(mod100)
-                                    :many
-                                  else
-                                    :other
-                                  end
-                                end } } },
-      # Sinhalese
-      si: { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Turkish
-      tr: { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Uzbek
-      uz: { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Chinese
-      zh: { i18n: { plural: { keys: %i[other], rule: ->(_) { :other } } } },
-      # Chinese Hong Kong
-      "zh-hk" => { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-      # Chinese Taiwan
-      "zh-tw" => { i18n: { plural: { keys: %i[one other], rule: ->(n) { n == 1 ? :one : :other } } } },
-    }
-  end
-end