Merge pull request #920 from City-of-Helsinki/update-configuration

Automatic update

Author: hyrsky

composer.lock

@@ -54,7 +54,6 @@ module:
   helfi_base_content: 0
   helfi_calculator: 0
   helfi_ckeditor: 0
-  helfi_csp: 0
   helfi_etusivu_entities: 0
   helfi_group: 0
   helfi_image_styles: 0

conf/cmi/core.extension.yml

@@ -1,32 +1,211 @@
 _core:
   default_config_hash: 68A3PDsSIoX2q7iFOa2lMdnYkgKgem4uh1_RBxcRVWU
 report-only:
-  enable: false
-  directives: {  }
-  reporting:
-    plugin: none
-enforce:
   enable: true
   directives:
+    base-uri:
+      base: none
+    frame-ancestors:
+      base: self
     default-src:
       base: self
+    connect-src:
+      base: self
+      sources:
+        - 'https://www.youtube-nocookie.com'
+        - 'https://coh-chat-app-prod.ow6i4n9pdzm.eu-de.codeengine.appdomain.cloud'
+        - 'https://*.hel.fi'
+        - 'https://coh-chat-app-test.mo1wrhhyog0.eu-de.codeengine.appdomain.cloud'
+        - 'https://data.reactandshare.com'
+        - 'https://webanalytics.digiaiiris.com'
+        - 'https://*.askem.com'
+        - 'https://*.siteimprove.com'
+        - 'https://connect.facebook.net'
+        - 'https://hel.humany.net'
+        - 'https://wds.ace.teliacompany.com'
+        - 'https://chat.ace.teliacompany.net'
+        - 'https://api.ace.teliacompany.net'
     img-src:
       base: any
+      sources:
+        - 'data:'
+        - '*.blob.core.windows.net'
+        - 'https://coh-chat-app-prod.ow6i4n9pdzm.eu-de.codeengine.appdomain.cloud'
+        - 'https://*.hel.fi'
+        - 'https://coh-chat-app-test.mo1wrhhyog0.eu-de.codeengine.appdomain.cloud'
+        - 'https://data.reactandshare.com'
     script-src:
       base: self
       flags:
         - report-sample
         - unsafe-inline
         - unsafe-eval
         - wasm-unsafe-eval
+      sources:
+        - 'https://coh-chat-app-prod.ow6i4n9pdzm.eu-de.codeengine.appdomain.cloud'
+        - 'https://*.hel.fi'
+        - 'https://coh-chat-app-test.mo1wrhhyog0.eu-de.codeengine.appdomain.cloud'
+        - 'https://cdn.reactandshare.com'
+        - 'https://data.reactandshare.com'
+        - 'https://*.askem.com'
+        - 'https://webanalytics.digiaiiris.com'
+        - 'https://connect.facebook.net'
+        - 'https://wds.ace.teliacompany.com'
+        - 'https://e.infogram.com'
     style-src:
       base: self
       flags:
         - report-sample
         - unsafe-inline
-    base-uri:
-      base: none
-    frame-ancestors:
+      sources:
+        - 'https://coh-chat-app-prod.ow6i4n9pdzm.eu-de.codeengine.appdomain.cloud'
+        - 'https://*.hel.fi'
+        - 'https://coh-chat-app-test.mo1wrhhyog0.eu-de.codeengine.appdomain.cloud'
+        - 'https://hel.humany.net'
+        - 'https://wds.ace.teliacompany.com'
+    font-src:
+      base: self
+      sources:
+        - 'https://coh-chat-app-prod.ow6i4n9pdzm.eu-de.codeengine.appdomain.cloud'
+        - 'https://*.hel.fi'
+        - 'https://coh-chat-app-test.mo1wrhhyog0.eu-de.codeengine.appdomain.cloud'
+        - 'https://hel.humany.net'
+        - 'https://makasiini.hel.ninja'
+        - 'https://ace-knowledge-cdn.teliacompany.net'
+    frame-src:
+      base: self
+      sources:
+        - palvelukartta.hel.fi
+        - 'https://coh-chat-app-prod.ow6i4n9pdzm.eu-de.codeengine.appdomain.cloud'
+        - 'https://*.hel.fi'
+        - 'https://coh-chat-app-test.mo1wrhhyog0.eu-de.codeengine.appdomain.cloud'
+        - 'https://*.siteimprove.com'
+        - 'https://*.userneeds.com'
+        - 'https://agreeable-island-03e85b803.azurestaticapps.net'
+        - 'https://*.hotjar.com'
+        - 'https://coh-chat-app-ibm.eu-de.mybluemix.net'
+        - 'https://coh-chat-app-prod-ibm.eu-de.mybluemix.net'
+        - 'https://suite.icareus.com'
+        - 'https://*.helsinkikanava.fi'
+        - 'https://*.youtube.com'
+        - 'https://*.youtu.be'
+        - 'https://*.facebook.com'
+        - 'https://*.twitter.com'
+        - 'https://*.linkedin.com'
+        - 'https://*.readspeaker.com'
+        - 'https://*.vimeo.com'
+        - 'https://*.google.com'
+        - 'https://*.siteimproveanalytics.com'
+        - 'https://*.snoobi.com'
+        - 'https://*.dreambroker.com'
+        - 'https://youtu.be'
+        - 'https://dreambroker.com'
+        - 'https://pollev.com'
+        - 'https://e.infogram.com'
+        - 'https://infogram.com'
+        - 'https://tyoterveys-helsinki-pv.mail-eur.net'
+        - 'https://walls.io'
+        - 'https://*.youtube-nocookie.com'
+        - 'https://*.flockler.com'
+        - 'https://*.lightwidget.com'
+        - 'https://hel-thk-botti.kuurahealth.com'
+        - 'https://*.giosg.com'
+        - 'https://*.giosgusercontent.com'
+        - 'https://helfi.fi1.frosmo.com'
+        - 'https://survey.feedbackly.com'
+        - 'https://survey.userneeds.com'
+        - 'https://*.powerbi.com'
+        - 'https://coh-chat-app-test.eu-de.mybluemix.net'
+        - 'https://coh-chat-app-dev.eu-de.mybluemix.net'
+        - 'https://coh-chat-app-prod.eu-de.mybluemix.net'
+        - 'https://hkp.maanmittauslaitos.fi'
+        - 'https://reittiopas.hsl.fi'
+        - 'https://players.icareus.com'
+        - 'https://wds.ace.teliacompany.com'
+        - 'https://events.icareus.com'
+    object-src:
+      base: self
+      sources:
+        - palvelukartta.hel.fi
+        - 'https://*.youtube-nocookie.com'
+        - 'https://*.youtube.com'
+        - 'https://*.youtu.be'
+        - 'https://*.vimeo.com'
+        - 'https://suite.icareus.com'
+        - 'https://players.icareus.com'
+        - 'https://events.icareus.com'
+        - 'https://*.helsinkikanava.fi'
+    media-src:
+      base: self
+      sources:
+        - 'data:'
+  reporting:
+    plugin: none
+enforce:
+  enable: true
+  directives:
+    object-src:
+      base: self
+      sources:
+        - palvelukartta.hel.fi
+        - 'https://*.youtube-nocookie.com'
+        - 'https://*.youtube.com'
+        - 'https://*.youtu.be'
+        - 'https://*.vimeo.com'
+        - 'https://suite.icareus.com'
+        - 'https://players.icareus.com'
+        - 'https://events.icareus.com'
+        - 'https://*.helsinkikanava.fi'
+    frame-src:
       base: self
+      sources:
+        - palvelukartta.hel.fi
+        - 'https://coh-chat-app-prod.ow6i4n9pdzm.eu-de.codeengine.appdomain.cloud'
+        - 'https://*.hel.fi'
+        - 'https://coh-chat-app-test.mo1wrhhyog0.eu-de.codeengine.appdomain.cloud'
+        - 'https://*.siteimprove.com'
+        - 'https://*.userneeds.com'
+        - 'https://agreeable-island-03e85b803.azurestaticapps.net'
+        - 'https://*.hotjar.com'
+        - 'https://coh-chat-app-ibm.eu-de.mybluemix.net'
+        - 'https://coh-chat-app-prod-ibm.eu-de.mybluemix.net'
+        - 'https://suite.icareus.com'
+        - 'https://*.helsinkikanava.fi'
+        - 'https://*.youtube.com'
+        - 'https://*.youtu.be'
+        - 'https://*.facebook.com'
+        - 'https://*.twitter.com'
+        - 'https://*.linkedin.com'
+        - 'https://*.readspeaker.com'
+        - 'https://*.vimeo.com'
+        - 'https://*.google.com'
+        - 'https://*.siteimproveanalytics.com'
+        - 'https://*.snoobi.com'
+        - 'https://*.dreambroker.com'
+        - 'https://youtu.be'
+        - 'https://dreambroker.com'
+        - 'https://pollev.com'
+        - 'https://e.infogram.com'
+        - 'https://infogram.com'
+        - 'https://tyoterveys-helsinki-pv.mail-eur.net'
+        - 'https://walls.io'
+        - 'https://*.youtube-nocookie.com'
+        - 'https://*.flockler.com'
+        - 'https://*.lightwidget.com'
+        - 'https://hel-thk-botti.kuurahealth.com'
+        - 'https://*.giosg.com'
+        - 'https://*.giosgusercontent.com'
+        - 'https://helfi.fi1.frosmo.com'
+        - 'https://survey.feedbackly.com'
+        - 'https://survey.userneeds.com'
+        - 'https://*.powerbi.com'
+        - 'https://coh-chat-app-test.eu-de.mybluemix.net'
+        - 'https://coh-chat-app-dev.eu-de.mybluemix.net'
+        - 'https://coh-chat-app-prod.eu-de.mybluemix.net'
+        - 'https://hkp.maanmittauslaitos.fi'
+        - 'https://reittiopas.hsl.fi'
+        - 'https://players.icareus.com'
+        - 'https://wds.ace.teliacompany.com'
+        - 'https://events.icareus.com'
   reporting:
     plugin: raven