(allura) branch master updated: support per-page csp_frame_domains modifier

[ccruz]

This is an automated email from the ASF dual-hosted git repository.

ccruz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/allura.git


The following commit(s) were added to refs/heads/master by this push:
     new 8da4fc65d support per-page csp_frame_domains modifier
8da4fc65d is described below

commit 8da4fc65db7cc64500fef732c9ff51bcfd4d85dc
Author: Dave Brondsema <dbronds...@slashdotmedia.com>
AuthorDate: Tue Jul 2 16:56:47 2024 +0000

    support per-page csp_frame_domains modifier
---
 Allura/allura/lib/custom_middleware.py | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/Allura/allura/lib/custom_middleware.py 
b/Allura/allura/lib/custom_middleware.py
index e06f950c1..4b2e5e1f5 100644
--- a/Allura/allura/lib/custom_middleware.py
+++ b/Allura/allura/lib/custom_middleware.py
@@ -486,10 +486,13 @@ class ContentSecurityPolicyMiddleware:
             rules.add('upgrade-insecure-requests')
 
         if self.config.get('csp.frame_sources'):
+            frame_srcs = self.config['csp.frame_sources']
+            if environ.get('csp_frame_domains'):
+                frame_srcs += ' ' + ' '.join(environ['csp_frame_domains'])
             if asbool(self.config.get('csp.frame_sources_enforce', False)):
-                rules.add(f"frame-src {self.config['csp.frame_sources']}")
+                rules.add(f"frame-src {frame_srcs}")
             else:
-                report_rules.add(f"frame-src 
{self.config['csp.frame_sources']}")
+                report_rules.add(f"frame-src {frame_srcs}")
 
         if self.config.get('csp.form_action_urls'):
             srcs = self.config['csp.form_action_urls']