Update CSP to include /static/ path for frontend files (#10239)

config/default.js

@@ -135,24 +135,30 @@ module.exports = {
       baseUri: ["'self'"],
       childSrc: ["'none'"],
       connectSrc: [analyticsHost, apiProdHost],
-      fontSrc: [addonsFrontendCDN],
+      fontSrc: [
+        `${addonsFrontendCDN}/static/`,
+      ],
       formAction: ["'self'"],
       frameSrc: ["'none'"],
       imgSrc: [
         "'self'",
         'data:',
         addonsServerProdCDN,
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
+        // This file isn't bundled with addons-frontend.
+        `${addonsFrontendCDN}/favicon.ico`,
       ],
       manifestSrc: ["'none'"],
       mediaSrc: ["'none'"],
       objectSrc: ["'none'"],
       // Script is limited to the amo specific CDN.
       scriptSrc: [
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
         `${analyticsHost}/analytics.js`,
       ],
-      styleSrc: [addonsFrontendCDN],
+      styleSrc: [
+        `${addonsFrontendCDN}/static/`,
+      ],
       workerSrc: ["'none'"],
       reportUri: '/__cspreport__',
     },

config/dev.js

@@ -21,20 +21,22 @@ module.exports = {
         apiDevHost,
       ],
       fontSrc: [
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
       ],
       imgSrc: [
         "'self'",
         'data:',
         addonsServerDevCDN,
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
+        // This file isn't bundled with addons-frontend.
+        `${addonsFrontendCDN}/favicon.ico`,
       ],
       scriptSrc: [
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
         `${analyticsHost}/analytics.js`,
       ],
       styleSrc: [
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
       ],
     },
   },

config/stage.js

@@ -19,20 +19,22 @@ module.exports = {
         apiStageHost,
       ],
       fontSrc: [
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
       ],
       imgSrc: [
         "'self'",
         'data:',
         addonsServerStageCDN,
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
+        // This file isn't bundled with addons-frontend.
+        `${addonsFrontendCDN}/favicon.ico`,
       ],
       scriptSrc: [
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
         `${analyticsHost}/analytics.js`,
       ],
       styleSrc: [
-        addonsFrontendCDN,
+        `${addonsFrontendCDN}/static/`,
       ],
     },
   },

tests/unit/amo/middleware/test_cspMiddleware.js

@@ -39,11 +39,21 @@ describe(__filename, () => {
         // eslint-disable-next-line global-require
         const config = require('config');
         const cspConfig = config.get('CSP').directives;
-        expect(cspConfig.scriptSrc).toContain(cdnHost);
+        // We use a sub-folder on purpose, see:
+        // https://bugzilla.mozilla.org/show_bug.cgi?id=1501687
+        expect(cspConfig.scriptSrc).not.toContain(cdnHost);
+        expect(cspConfig.scriptSrc).toContain(`${cdnHost}/static/`);
         expect(cspConfig.scriptSrc).not.toContain("'self'");
-        expect(cspConfig.imgSrc).toContain(cdnHost);
+        // We use a sub-folder on purpose, see:
+        // https://bugzilla.mozilla.org/show_bug.cgi?id=1501687
+        expect(cspConfig.imgSrc).not.toContain(cdnHost);
+        expect(cspConfig.imgSrc).toContain(`${cdnHost}/static/`);
+        expect(cspConfig.imgSrc).toContain(`${cdnHost}/favicon.ico`);
         expect(cspConfig.imgSrc).toContain("'self'");
-        expect(cspConfig.styleSrc).toContain(cdnHost);
+        // We use a sub-folder on purpose, see:
+        // https://bugzilla.mozilla.org/show_bug.cgi?id=1501687
+        expect(cspConfig.styleSrc).not.toContain(cdnHost);
+        expect(cspConfig.styleSrc).toContain(`${cdnHost}/static/`);
         expect(cspConfig.styleSrc).not.toContain("'self'");
         expect(cspConfig.connectSrc).toContain(apiHost);
         expect(cspConfig.connectSrc).not.toContain("'self'");
@@ -123,7 +133,7 @@ describe(__filename, () => {
       const cspHeader = res.get('content-security-policy');
       const policy = parse(cspHeader);
       const cdnHost = 'https://addons-amo.cdn.mozilla.net';
-      expect(policy['style-src']).toEqual([cdnHost]);
+      expect(policy['style-src']).toEqual([`${cdnHost}/static/`]);
       sinon.assert.calledOnce(nextSpy);
     });