feat: strengthen csp rules (#2733)

packages/components/cypress/support/e2e.ts

@@ -27,3 +27,17 @@ Cypress.on('uncaught:exception', err => {
     return false;
   }
 });
+
+// cypress is inserting scripts into the html file to execute its tests, but the script is blocked by the csp, so we remove the csp for the tests.
+beforeEach(() => {
+  cy.intercept('/*', (req) => {
+  req.continue((res) => {
+    if (res.headers['content-type'] && res.headers['content-type'].includes('text/html')) {
+      res.body = res.body.replace(
+        /<meta http-equiv="Content-Security-Policy" content="[^"]*">/g,
+        '<meta http-equiv="Content-Security-Policy" content="*">'
+      );
+   }
+  })
+  })
+})

packages/documentation/.storybook/preview-head.html

@@ -11,10 +11,24 @@
 <link rel="stylesheet" href="/styles/post-external.css" />
 
 <meta name="design-system-settings" data-post-icon-base="/post-icons" />
-<meta
-  http-equiv="Content-Security-Policy"
-  content="connect-src 'self' *.coveo.com *.post.ch *.gravatar.com *.app.github.dev"
-/>
+
+<meta http-equiv="Content-Security-Policy" content="
+connect-src 'self' *.coveo.com *.post.ch *.gravatar.com *.google.com  *.app.github.dev;
+default-src 'self';
+script-src 'self' *.coveo.com *.post.ch *.gravatar.com *.googletagmanager.com;
+style-src 'self' *.coveo.com *.post.ch *.gravatar.com;
+img-src 'self' data: *.unpkg.com *.githubusercontent.com;
+font-src 'self' *.coveo.com *.post.ch *.gravatar.com;
+frame-src 'none';
+object-src 'none';
+base-uri 'self';
+form-action 'self';
+media-src 'self';
+manifest-src 'self';
+worker-src 'self';
+upgrade-insecure-requests;
+block-all-mixed-content;
+">
 
 <script>
   window.global = window;

packages/documentation/cypress/support/e2e.ts

@@ -26,3 +26,17 @@ Cypress.on('uncaught:exception', err => {
     return false;
   }
 });
+
+// cypress is inserting scripts into the html file to execute its tests, but the script is blocked by the csp, so we remove the csp for the tests.
+beforeEach(() => {
+  cy.intercept('/*', (req) => {
+  req.continue((res) => {
+    if (res.headers['content-type'] && res.headers['content-type'].includes('text/html')) {
+      res.body = res.body.replace(
+        /<meta http-equiv="Content-Security-Policy" content="[^"]*">/g,
+        '<meta http-equiv="Content-Security-Policy" content="*">'
+      );
+   }
+  })
+  })
+})

packages/documentation/public/_headers

@@ -1,5 +1,6 @@
 # Adds custom headers for specific resources
 # This file is used by Netlify to handle headers
 
-/assets/versions.json
-  Access-Control-Allow-Origin: *
+Access-Control-Allow-Origin: *.post.ch
+X-Frame-Options: SAMEORIGIN
+X-Content-Type-Options = nosniff