From aee0a117a889461ce8ced6fcf73207fe017f1d99 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Mon, 20 Dec 2021 13:37:47 +0000
Subject: Add latest changes from gitlab-org/gitlab@14-6-stable-ee

---
 .../content_security_policy/config_loader_spec.rb  | 48 ++++++++++++++++++++--
 1 file changed, 44 insertions(+), 4 deletions(-)

(limited to 'spec/lib/gitlab/content_security_policy')

diff --git a/spec/lib/gitlab/content_security_policy/config_loader_spec.rb b/spec/lib/gitlab/content_security_policy/config_loader_spec.rb
index c0476d38380..56e3fc269e6 100644
--- a/spec/lib/gitlab/content_security_policy/config_loader_spec.rb
+++ b/spec/lib/gitlab/content_security_policy/config_loader_spec.rb
@@ -85,7 +85,7 @@ RSpec.describe Gitlab::ContentSecurityPolicy::ConfigLoader do
         expect(directives['style_src']).to eq("'self' 'unsafe-inline' https://cdn.example.com")
         expect(directives['font_src']).to eq("'self' https://cdn.example.com")
         expect(directives['worker_src']).to eq('http://localhost/assets/ blob: data: https://cdn.example.com')
-        expect(directives['frame_src']).to eq(::Gitlab::ContentSecurityPolicy::Directives.frame_src + " https://cdn.example.com http://localhost/admin/sidekiq http://localhost/admin/sidekiq/ http://localhost/-/speedscope/index.html")
+        expect(directives['frame_src']).to eq(::Gitlab::ContentSecurityPolicy::Directives.frame_src + " https://cdn.example.com http://localhost/admin/ http://localhost/assets/ http://localhost/-/speedscope/index.html")
       end
     end
 
@@ -113,7 +113,7 @@ RSpec.describe Gitlab::ContentSecurityPolicy::ConfigLoader do
         end
 
         it 'does not add CUSTOMER_PORTAL_URL to CSP' do
-          expect(directives['frame_src']).to eq(::Gitlab::ContentSecurityPolicy::Directives.frame_src + " http://localhost/admin/sidekiq http://localhost/admin/sidekiq/ http://localhost/-/speedscope/index.html")
+          expect(directives['frame_src']).to eq(::Gitlab::ContentSecurityPolicy::Directives.frame_src + " http://localhost/admin/ http://localhost/assets/ http://localhost/-/speedscope/index.html")
         end
       end
 
@@ -123,12 +123,12 @@ RSpec.describe Gitlab::ContentSecurityPolicy::ConfigLoader do
         end
 
         it 'adds CUSTOMER_PORTAL_URL to CSP' do
-          expect(directives['frame_src']).to eq(::Gitlab::ContentSecurityPolicy::Directives.frame_src + " http://localhost/rails/letter_opener/ https://customers.example.com http://localhost/admin/sidekiq http://localhost/admin/sidekiq/ http://localhost/-/speedscope/index.html")
+          expect(directives['frame_src']).to eq(::Gitlab::ContentSecurityPolicy::Directives.frame_src + " http://localhost/rails/letter_opener/ https://customers.example.com http://localhost/admin/ http://localhost/assets/ http://localhost/-/speedscope/index.html")
         end
       end
     end
 
-    context 'letter_opener applicaiton URL' do
+    context 'letter_opener application URL' do
       let(:gitlab_url) { 'http://gitlab.example.com' }
       let(:letter_opener_url) { "#{gitlab_url}/rails/letter_opener/" }
 
@@ -156,6 +156,46 @@ RSpec.describe Gitlab::ContentSecurityPolicy::ConfigLoader do
         end
       end
     end
+
+    context 'Snowplow Micro event collector' do
+      let(:snowplow_micro_hostname) { 'localhost:9090' }
+      let(:snowplow_micro_url) { "http://#{snowplow_micro_hostname}/" }
+
+      before do
+        stub_env('SNOWPLOW_MICRO_ENABLE', 1)
+        allow(Gitlab::Tracking).to receive(:collector_hostname).and_return(snowplow_micro_hostname)
+      end
+
+      context 'when in production' do
+        before do
+          stub_rails_env('production')
+        end
+
+        it 'does not add Snowplow Micro URL to connect-src' do
+          expect(directives['connect_src']).not_to include(snowplow_micro_url)
+        end
+      end
+
+      context 'when in development' do
+        before do
+          stub_rails_env('development')
+        end
+
+        it 'adds Snowplow Micro URL with trailing slash to connect-src' do
+          expect(directives['connect_src']).to match(Regexp.new(snowplow_micro_url))
+        end
+
+        context 'when not enabled using ENV[SNOWPLOW_MICRO_ENABLE]' do
+          before do
+            stub_env('SNOWPLOW_MICRO_ENABLE', nil)
+          end
+
+          it 'does not add Snowplow Micro URL to connect-src' do
+            expect(directives['connect_src']).not_to include(snowplow_micro_url)
+          end
+        end
+      end
+    end
   end
 
   describe '#load' do
-- 
cgit v1.2.3