Merge pull request #15385 from mozilla/make-csp-uri-check-less-strict

task(content): Make csp-report.blocked-uri validation check less strict
mozilla · Jun 6, 2023 · 8b1b99c · 8b1b99c
2 parents 0612880 + 07713b6
commit 8b1b99c
Showing 1 changed file with 1 addition and 8 deletions.
diff --git a/packages/fxa-content-server/server/lib/routes/post-csp.js b/packages/fxa-content-server/server/lib/routes/post-csp.js
@@ -26,14 +26,7 @@ const BODY_SCHEMA = {
     .keys({
       // CSP 2, 3 required
       // `eval` and `inline` are specified in CSP 3 and sent by Chrome
-      'blocked-uri': LONG_URI_TYPE.allow('')
-        .allow('asset')
-        .allow('blob')
-        .allow('data')
-        .allow('eval')
-        .allow('inline')
-        .allow('self')
-        .optional(),
+      'blocked-uri': STRING_TYPE.allow('').optional(),
       // CSP 2, 3 optional
       'column-number': INTEGER_TYPE.min(0).optional(),
       // CSP 3 required, but not always sent