Content Security Policy Frame Ancestors builder doesn't allow multiple URIs in single call

[JackGilmore]

When using CspBuilder during calling AddContentSecurityPolicy() for creating a HeaderPolicyCollection, the builder allows you to pass in an IEnumerable<string> with multiple URIs e.g.

var uris = ["https://example.com", "https://example2.com"];

var policyCollection = new HeaderPolicyCollection()
        .AddContentSecurityPolicy(builder =>
        {
           builder.AddFrameSrc().From(uris);
        });

This doesn't seem to be the case as the .From() method for AddFrameAncestors() only appears to support a single string URI e.g.

var uris = ["https://example.com", "https://example2.com"];

var policyCollection = new HeaderPolicyCollection()
        .AddContentSecurityPolicy(builder =>
        {
           builder.AddFrameAncestors().From("https://example.com").From("https://example2.com");
        });

Is this an intentional design or is it possible to make AddFrameAncestors().From() support an IEnumerable<string> also?

[andrewlock]

Hey @JackGilmore, yeah this is just a quirk - the FrameAncestorsDirectiveBuilder derives from CspDirectiveBuilderBase rather than CspDirectiveBuilder because it has slightly different allowed sources. I've created a PR to add the same method directly to the FrameAncestorsDirectiveBuilder - I think it makes sense, thanks!

[JackGilmore]

Awesome! Thanks for turning this around so quickly :) Would it be possible for you to publish a new version of your nuget package so I can pull this down to use with my app?

[andrewlock]

Just pushed out a new version which contains this, v0.24.0!