Update Google CSP domains

Author: ahosgood

CHANGELOG.md

@@ -11,6 +11,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+- Updated Google CSP domains
+
 ### Deprecated
 
 ### Removed

tests/test_flask_talisman.py

@@ -97,11 +97,11 @@ def test_talisman_app_google(self):
             rv.headers["Content-Security-Policy"],
         )
         self.assertIn(
-            "img-src 'self' img.youtube.com;",
+            "img-src 'self' img.youtube.com i.ytimg.com www.googletagmanager.com;",
             rv.headers["Content-Security-Policy"],
         )
         self.assertIn(
-            "script-src 'self' ajax.googleapis.com *.googleanalytics.com *.google-analytics.com www.youtube.com;",
+            "script-src 'self' ajax.googleapis.com *.googleanalytics.com *.google-analytics.com www.youtube.com *.gstatic.com www.googletagmanager.com;",
             rv.headers["Content-Security-Policy"],
         )
         self.assertIn(
@@ -154,7 +154,7 @@ def test_talisman_app_custom_csp_with_google(self):
             rv.headers["Content-Security-Policy"],
         )
         self.assertIn(
-            "img-src 'self' img.example.com img.youtube.com;",
+            "img-src 'self' img.example.com img.youtube.com i.ytimg.com www.googletagmanager.com;",
             rv.headers["Content-Security-Policy"],
         )
 

tna_utilities/flask/talisman.py

@@ -5,25 +5,28 @@
 from ..security import CspGenerator, common_security_headers
 
 GOOGLE_CSP_POLICY = {
-    # "default-src": ["*.gstatic.com"],
-    # Fonts from fonts.google.com
-    "font-src": ["*.gstatic.com"],
-    # <iframe> based embedding for Maps and Youtube
-    "frame-src": ["www.google.com", "www.youtube.com"],
-    # YouTube video thumbnails
-    "img-src": ["img.youtube.com"],
-    # Assorted Google-hosted Libraries/APIs
+    "font-src": ["*.gstatic.com"],  # Google Fonts from fonts.google.com
+    "frame-src": [
+        "www.google.com",  # <iframe> based embeds for Google Maps
+        "www.youtube.com",  # <iframe> based embeds for Youtube
+    ],
+    "img-src": [
+        "img.youtube.com",  # YouTube video thumbnails
+        "i.ytimg.com",  # YouTube video thumbnails
+        "www.googletagmanager.com",  # GTM
+    ],
     "script-src": [
-        "ajax.googleapis.com",
-        "*.googleanalytics.com",
-        "*.google-analytics.com",
-        "www.youtube.com",
+        "ajax.googleapis.com",  # Assorted Google-hosted Libraries/APIs
+        "*.googleanalytics.com",  # GA4
+        "*.google-analytics.com",  # GA4
+        "www.youtube.com",  # YouTube embeds
+        "*.gstatic.com",  # Google Translate
+        "www.googletagmanager.com",  # GTM
     ],
-    # Google Fonts stylesheets and YouTube embedded player styles
     "style-src": [
-        "ajax.googleapis.com",
-        "fonts.googleapis.com",
-        "*.gstatic.com",
+        "ajax.googleapis.com",  # YouTube embedded player styles
+        "fonts.googleapis.com",  # Google Fonts stylesheets
+        "*.gstatic.com",  # Assorted Google stylesheets
     ],
 }