Skip to content

Commit d5b5a34

Browse files
fascinosumfascinosum
committed
MC-38782: Modify Magento Admin CSP for Gainsight enablement
1 parent 26acabe commit d5b5a34

File tree

7 files changed

+106
-10
lines changed

7 files changed

+106
-10
lines changed

‎app/code/Magento/AdminAnalytics/etc/adminhtml/csp_whitelist.xml

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/**
4+
* Copyright © Magento, Inc. All rights reserved.
5+
* See COPYING.txt for license details.
6+
*/
7+
-->
8+
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
9+
xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp:etc/csp_whitelist.xsd">
10+
<policies>
11+
<policy id="script-src">
12+
<values>
13+
<value id="aptrinsic" type="host">*.aptrinsic.com</value>
14+
</values>
15+
</policy>
16+
<policy id="style-src">
17+
<values>
18+
<value id="aptrinsic" type="host">*.aptrinsic.com</value>
19+
<value id="fonts_googleapis" type="host">fonts.googleapis.com</value>
20+
</values>
21+
</policy>
22+
<policy id="img-src">
23+
<values>
24+
<value id="aptrinsic" type="host">*.aptrinsic.com</value>
25+
<value id="storage_googleapis" type="host">storage.googleapis.com</value>
26+
</values>
27+
</policy>
28+
<policy id="connect-src">
29+
<values>
30+
<value id="aptrinsic" type="host">*.aptrinsic.com</value>
31+
</values>
32+
</policy>
33+
<policy id="font-src">
34+
<values>
35+
<value id="fonts_gstatic" type="host">fonts.gstatic.com</value>
36+
</values>
37+
</policy>
38+
</policies>
39+
</csp_whitelist>

‎app/code/Magento/Csp/Model/Collector/CspWhitelistXml/Converter.php

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,13 +36,12 @@ public function convert($source)
3636
/** @var \DOMElement $value */
3737
foreach ($policy->getElementsByTagName('value') as $value) {
3838
if ($value->attributes->getNamedItem('type')->nodeValue === 'host') {
39-
$policyConfig[$id]['hosts'][] = $value->nodeValue;
39+
$policyConfig[$id]['hosts'][$value->attributes->getNamedItem('id')->nodeValue] = $value->nodeValue;
4040
} else {
4141
$policyConfig[$id]['hashes'][$value->nodeValue]
4242
= $value->attributes->getNamedItem('algorithm')->nodeValue;
4343
}
4444
}
45-
$policyConfig[$id]['hosts'] = array_unique($policyConfig[$id]['hosts']);
4645
}
4746

4847
return $policyConfig;

‎app/code/Magento/Csp/Model/Collector/FetchPolicyMerger.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,12 @@ public function merge(PolicyInterface $policy1, PolicyInterface $policy2): Polic
2525
return new FetchPolicy(
2626
$policy1->getId(),
2727
$policy1->isNoneAllowed() || $policy2->isNoneAllowed(),
28-
array_unique(array_merge($policy1->getHostSources(), $policy2->getHostSources())),
29-
array_unique(array_merge($policy1->getSchemeSources(), $policy2->getSchemeSources())),
28+
array_merge($policy1->getHostSources(), $policy2->getHostSources()),
29+
array_merge($policy1->getSchemeSources(), $policy2->getSchemeSources()),
3030
$policy1->isSelfAllowed() || $policy2->isSelfAllowed(),
3131
$policy1->isInlineAllowed() || $policy2->isInlineAllowed(),
3232
$policy1->isEvalAllowed() || $policy2->isEvalAllowed(),
33-
array_unique(array_merge($policy1->getNonceValues(), $policy2->getNonceValues())),
33+
array_merge($policy1->getNonceValues(), $policy2->getNonceValues()),
3434
array_merge($policy1->getHashes(), $policy2->getHashes()),
3535
$policy1->isDynamicAllowed() || $policy2->isDynamicAllowed(),
3636
$policy1->areEventHandlersAllowed() || $policy2->areEventHandlersAllowed()

‎app/code/Magento/Csp/Model/Collector/PluginTypesPolicyMerger.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ public function merge(PolicyInterface $policy1, PolicyInterface $policy2): Polic
2222
{
2323
/** @var PluginTypesPolicy $policy1 */
2424
/** @var PluginTypesPolicy $policy2 */
25-
return new PluginTypesPolicy(array_unique(array_merge($policy1->getTypes(), $policy2->getTypes())));
25+
return new PluginTypesPolicy(array_merge($policy1->getTypes(), $policy2->getTypes()));
2626
}
2727

2828
/**

‎app/code/Magento/Csp/Model/Policy/FetchPolicy.php

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -116,12 +116,12 @@ public function __construct(
116116
) {
117117
$this->id = $id;
118118
$this->noneAllowed = $noneAllowed;
119-
$this->hostSources = array_unique($hostSources);
120-
$this->schemeSources = array_unique($schemeSources);
119+
$this->hostSources = array_values(array_unique($hostSources));
120+
$this->schemeSources = array_values(array_unique($schemeSources));
121121
$this->selfAllowed = $selfAllowed;
122122
$this->inlineAllowed = $inlineAllowed;
123123
$this->evalAllowed = $evalAllowed;
124-
$this->nonceValues = array_unique($nonceValues);
124+
$this->nonceValues = array_values(array_unique($nonceValues));
125125
$this->hashes = $hashValues;
126126
$this->dynamicAllowed = $dynamicAllowed;
127127
$this->eventHandlersAllowed = $eventHandlersAllowed;

‎app/code/Magento/Csp/Model/Policy/PluginTypesPolicy.php

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@ public function __construct(array $types)
2525
if (!$types) {
2626
throw new \RuntimeException('PluginTypePolicy must be given at least 1 type.');
2727
}
28-
$this->types = array_unique($types);
28+
$this->types = array_values(array_unique($types));
2929
}
3030

3131
/**

‎dev/tests/integration/testsuite/Magento/Csp/Model/Collector/CspWhitelistXmlCollectorTest.php

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,4 +71,62 @@ public function testCollecting(): void
7171
$this->assertTrue($objectSrcChecked);
7272
$this->assertTrue($mediaSrcChecked);
7373
}
74+
75+
/**
76+
* Test collecting configurations from multiple XML files for adminhtml area.
77+
*
78+
* @magentoAppArea adminhtml
79+
* @return void
80+
*/
81+
public function testCollectingForAdminhtmlArea(): void
82+
{
83+
$policies = $this->collector->collect([]);
84+
85+
$mediaSrcChecked = false;
86+
$objectSrcChecked = false;
87+
$this->assertNotEmpty($policies);
88+
/** @var FetchPolicy $policy */
89+
foreach ($policies as $policy) {
90+
$this->assertFalse($policy->isNoneAllowed());
91+
$this->assertFalse($policy->isSelfAllowed());
92+
$this->assertFalse($policy->isInlineAllowed());
93+
$this->assertFalse($policy->isEvalAllowed());
94+
$this->assertFalse($policy->isDynamicAllowed());
95+
$this->assertEmpty($policy->getSchemeSources());
96+
$this->assertEmpty($policy->getNonceValues());
97+
if ($policy->getId() === 'object-src') {
98+
$this->assertInstanceOf(FetchPolicy::class, $policy);
99+
$this->assertEquals(
100+
[
101+
'https://admin.magento.com',
102+
'https://devdocs.magento.com',
103+
'example.magento.com'
104+
],
105+
$policy->getHostSources()
106+
);
107+
$this->assertEquals(
108+
[
109+
'B2yPHKaXnvFWtRChIbabYmUBFZdVfKKXHbWtWidDVF8=' => 'sha256',
110+
'B2yPHKaXnvFWtRChIbabYmUBFZdVfKKXHbWtWidDVF9=' => 'sha256'
111+
],
112+
$policy->getHashes()
113+
);
114+
$objectSrcChecked = true;
115+
} elseif ($policy->getId() === 'media-src') {
116+
$this->assertInstanceOf(FetchPolicy::class, $policy);
117+
$this->assertEquals(
118+
[
119+
'https://admin.magento.com',
120+
'https://devdocs.magento.com',
121+
'example.magento.com'
122+
],
123+
$policy->getHostSources()
124+
);
125+
$this->assertEmpty($policy->getHashes());
126+
$mediaSrcChecked = true;
127+
}
128+
}
129+
$this->assertTrue($objectSrcChecked);
130+
$this->assertTrue($mediaSrcChecked);
131+
}
74132
}

0 commit comments

Comments
 (0)