From 8c2e6f37ca616943bfdecbae182769e0d9c5abb1 Mon Sep 17 00:00:00 2001
From: labkey-adam <5107383+labkey-adam@users.noreply.github.com>
Date: Wed, 14 May 2025 20:17:05 +0000
Subject: [PATCH] update CSP to match commit
 a7f460f65e74266ecd6b3ab2ee47eda2330a146b

---
 application.properties | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/application.properties b/application.properties
index 9eabdce..69ccdc2 100644
--- a/application.properties
+++ b/application.properties
@@ -165,18 +165,19 @@ context.workDirLocation=/work/Tomcat/localhost
 
 ## START OF CSP ENFORCE BLOCK (DO NOT CHANGE THIS TEXT)
 csp.enforce=\
-    default-src 'self' https: ; \
-    connect-src 'self' ${CONNECTION.SOURCES} ; \
-    object-src 'none' ; \
-    style-src 'self' https: 'unsafe-inline' ${STYLE.SOURCES} ; \
-    img-src 'self' https: data: ${IMAGE.SOURCES} ; \
-    font-src 'self' data: ${FONT.SOURCES} ; \
-    script-src 'self' 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ; \
-    base-uri 'self' ; \
+    default-src 'self' ;                                                                    /* Limit the default to only the current server */\
+    connect-src 'self' ${CONNECTION.SOURCES} ;                                              /* Limit allowed connection sources */\
+    object-src 'none' ;                                                                     /* These tags are not currently used by LKS */\
+    style-src 'self' 'unsafe-inline' ${STYLE.SOURCES} ;                                     /* We currently have a few inline <style> tags that we are weeding out */\
+    img-src 'self' data: ${IMAGE.SOURCES} ;                                                 /* Limit image loading locations */\
+    font-src 'self' data: ${FONT.SOURCES} ;                                                 /* Limit font source loading locations */\
+    script-src 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ;             /* Limit scripts to those with nonces or transitive scripts */\
+    base-uri 'self' ;                                                                       /* Limit the base tags to only source from current server */\
     upgrade-insecure-requests ;\
-    frame-ancestors 'self' ; \
-    frame-src 'self' ${FRAME.SOURCES} ; \
-    report-uri https://www.labkey.org/admin-contentSecurityPolicyReport.api?cspVersion=e10&${CSP.REPORT.PARAMS} ;
+    ${UPGRADE.INSECURE.REQUESTS}                                                            /* Conditionally add upgrade-secure-requests directive if HTTPS is required */\
+    frame-ancestors 'self' ;                                                                /* Limit iframe content destinations (who can load this server's content into an iframe) */\
+    frame-src 'self' ${FRAME.SOURCES} ;                                                     /* Limit iframe content sources (from what servers can this server's iframe content be loaded) */\
+    report-uri https://www.labkey.org/admin-contentSecurityPolicyReport.api?cspVersion=e12&${CSP.REPORT.PARAMS} ; /* Report any encountered CSP violations to the local server */
 ## END OF CSP ENFORCE BLOCK (DO NOT CHANGE THIS TEXT)
 
 ## START OF CSP REPORT BLOCK (DO NOT CHANGE THIS TEXT)
@@ -191,7 +192,7 @@ csp.report=\
     base-uri 'self' ;                                                                       /* Limit the base tags to only source from current server */\
     frame-ancestors 'self' ;                                                                /* Limit iframe content destinations (who can load this server's content into an iframe) */\
     frame-src 'self' ${FRAME.SOURCES} ;                                                     /* Limit iframe content sources (from what servers can this server's iframe content be loaded) */\
-    report-uri https://www.labkey.org/admin-contentSecurityPolicyReport.api?cspVersion=r11&${CSP.REPORT.PARAMS} ; /* Report any encountered CSP violations to the supplied URL */
+    report-uri https://www.labkey.org/admin-contentSecurityPolicyReport.api?cspVersion=r12&${CSP.REPORT.PARAMS} ; /* Report any encountered CSP violations to the local server */
 ## END OF CSP REPORT BLOCK (DO NOT CHANGE THIS TEXT)
 
 ## Load optional application.properties if file exists - used for one-off labkey cloud use cases etc.