mozilla / bedrock

Making mozilla.org awesome, one pebble at a time
https://www.mozilla.org
Mozilla Public License 2.0
1.18k stars 919 forks source link

Add limited media-src CSP to report-only #15548

Closed janbrasna closed 53 minutes ago

janbrasna commented 6 hours ago

One-line summary

Adds media-src CSP-RO rule to make up for RO-removed default-src wildcards.

Significant changes and points to review

Restricting defaults in #14897 may trigger some yet undefined policies, this specifically adds self+assets.m.o to media rules, to let it run in report-only for some time to see if that's the only host we need to add.

Issue / Bugzilla link

15546

Testing

curl -I http://localhost:8000/de/

http://localhost:8000/de/firefox/built-for-you/?v=2

codecov[bot] commented 5 hours ago

Codecov Report

All modified and coverable lines are covered by tests :white_check_mark:

Project coverage is 78.91%. Comparing base (8a8636c) to head (23a6da6). Report is 3 commits behind head on main.

Additional details and impacted files ```diff @@ Coverage Diff @@ ## main #15548 +/- ## ======================================= Coverage 78.90% 78.91% ======================================= Files 158 158 Lines 8274 8275 +1 ======================================= + Hits 6529 6530 +1 Misses 1745 1745 ```

:umbrella: View full report in Codecov by Sentry.
:loudspeaker: Have feedback on the report? Share it here.


🚨 Try these New Features: