diff options
-rw-r--r-- | app/controllers/concerns/kas_cookie.rb | 1 | ||||
-rw-r--r-- | spec/controllers/concerns/kas_cookie_spec.rb | 29 |
2 files changed, 29 insertions, 1 deletions
diff --git a/app/controllers/concerns/kas_cookie.rb b/app/controllers/concerns/kas_cookie.rb index c66bf7c9e8c..06a4ee873f8 100644 --- a/app/controllers/concerns/kas_cookie.rb +++ b/app/controllers/concerns/kas_cookie.rb @@ -6,6 +6,7 @@ module KasCookie included do content_security_policy_with_context do |p| next unless ::Gitlab::Kas::UserAccess.enabled? + next unless Settings.gitlab.content_security_policy['enabled'] kas_url = ::Gitlab::Kas.tunnel_url next if URI(kas_url).host == ::Gitlab.config.gitlab.host # already allowed, no need for exception diff --git a/spec/controllers/concerns/kas_cookie_spec.rb b/spec/controllers/concerns/kas_cookie_spec.rb index d80df106cfd..7ab48f12d83 100644 --- a/spec/controllers/concerns/kas_cookie_spec.rb +++ b/spec/controllers/concerns/kas_cookie_spec.rb @@ -56,6 +56,17 @@ RSpec.describe KasCookie, feature_category: :deployment_management do describe '#content_security_policy' do let_it_be(:user) { create(:user) } + let(:gitlab_config) do + Gitlab.config.gitlab.deep_merge( + { + 'host' => 'gitlab.example.com', + 'content_security_policy' => { 'enabled' => content_security_policy_enabled } + } + ) + end + + let(:content_security_policy_enabled) { true } + controller(ApplicationController) do include KasCookie @@ -65,7 +76,7 @@ RSpec.describe KasCookie, feature_category: :deployment_management do end before do - stub_config_setting(host: 'gitlab.example.com') + stub_config_setting(gitlab_config) sign_in(user) allow(::Gitlab::Kas).to receive(:enabled?).and_return(true) allow(::Gitlab::Kas).to receive(:tunnel_url).and_return(kas_tunnel_url) @@ -108,6 +119,14 @@ RSpec.describe KasCookie, feature_category: :deployment_management do it 'adds KAS url to CSP connect-src directive' do expect(kas_csp_connect_src).to include(::Gitlab::Kas.tunnel_url) end + + context 'when content_security_policy is disabled' do + let(:content_security_policy_enabled) { false } + + it 'does not add KAS url to CSP connect-src directive' do + expect(kas_csp_connect_src).not_to include(::Gitlab::Kas.tunnel_url) + end + end end context 'when KAS tunnel url is configured without trailing slash' do @@ -116,6 +135,14 @@ RSpec.describe KasCookie, feature_category: :deployment_management do it 'adds KAS url to CSP connect-src directive with trailing slash' do expect(kas_csp_connect_src).to include("#{::Gitlab::Kas.tunnel_url}/") end + + context 'when content_security_policy is disabled' do + let(:content_security_policy_enabled) { false } + + it 'does not add KAS url to CSP connect-src directive' do + expect(kas_csp_connect_src).not_to include("#{::Gitlab::Kas.tunnel_url}/") + end + end end end end |