govuk_app_config 1.16.3 → 1.17.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d69c3ac1670b7d39ad3b9d08128bc78caa3ba14ad0df21f26341561e17c2d752
-  data.tar.gz: b479c4deebb953d387279fd9a2a2535fc0338bab3d0c99625c281933f9e27f4c
+  metadata.gz: fe5e846bb45a6b28512d6dc2dd01794106ebe653d739855b564491290b8a6e31
+  data.tar.gz: '05335490c4278b67b1ab0404712b91cd9fc4be44f08887cad5453313e0cfb502'
 SHA512:
-  metadata.gz: 837012296a8f38a30b31fe3a176639fee74ca1577150530efad4dfc13dd919b34dc4533f84b385c4600a053f200760bbf2d437f1b6a7a9c880cbd47ffa2f6bef
-  data.tar.gz: 6c5b19c54be06d5af13caf148dea3fd32cb96544c9ee6222b11f4d0c7f50c78353fe4e16e9f1b3fb756ac30f6e13793cd5cfd9a128810c1de429e17bafa40047
+  metadata.gz: aba550d1c915e3f2ede8424ac30f1c5ea35de88c4c68a744075a6cc19c65ffdda3ffdd7ae7bcebc178f9fb5bedba291ec4d585f09a0cff764baf2efe0587bf52
+  data.tar.gz: 54cbb007d3e933986a5d0af504d0c57042267d22375e7784c043a3022b10a7935bb7b550be181ded92a0769680861344077656bef6886857aa50e13293341fa6

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+# 1.17.0
+
+* Tweak our CSP to work with 'dev.gov.uk'
+
 # 1.16.3
 
 * Revert PR #89 - it relies on an unreleased feature of aws-xray-sdk

data/lib/govuk_app_config/govuk_content_security_policy.rb

@@ -11,7 +11,11 @@ module GovukContentSecurityPolicy
   # - https://csp-evaluator.withgoogle.com
   # - https://cspvalidator.org
 
-  GOVUK_DOMAINS = "'self' *.publishing.service.gov.uk localhost".freeze
+  GOVUK_DOMAINS = [
+    "'self'",
+    '*.publishing.service.gov.uk',
+    "*.#{ENV['GOVUK_APP_DOMAIN_EXTERNAL'] || ENV['GOVUK_APP_DOMAIN'] || 'dev.gov.uk'}"
+  ].uniq.join(" ").freeze
 
   GOOGLE_ANALYTICS_DOMAINS = "www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net".freeze
 
@@ -130,9 +134,9 @@ module GovukContentSecurityPolicy
     # AWS Lambda function that filters out junk reports.
     if Rails.env.production?
       reporting = "report-uri https://jhpno0hk6b.execute-api.eu-west-2.amazonaws.com/production"
-      Rails.application.config.action_dispatch.default_headers['Content-Security-Policy-Report-Only'] = GovukContentSecurityPolicy.build + " " + reporting
+      Rails.application.config.action_dispatch.default_headers['Content-Security-Policy-Report-Only'] = self.build + " " + reporting
     else
-      Rails.application.config.action_dispatch.default_headers['Content-Security-Policy'] = GovukContentSecurityPolicy.build
+      Rails.application.config.action_dispatch.default_headers['Content-Security-Policy'] = self.build
     end
   end
 end

data/lib/govuk_app_config/version.rb

@@ -1,3 +1,3 @@
 module GovukAppConfig
-  VERSION = "1.16.3"
+  VERSION = "1.17.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govuk_app_config
 version: !ruby/object:Gem::Version
-  version: 1.16.3
+  version: 1.17.0
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-05-28 00:00:00.000000000 Z
+date: 2019-05-29 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-xray-sdk