From: Tom Hughes <tom@compton.nu>
Date: Tue, 22 May 2018 08:01:13 +0000 (+0100)
Subject: Put CSP in enforcing mode
X-Git-Url: https://git.openstreetmap.org./chef.git/commitdiff_plain/53849b50b24dcba3075e2d39d1cb9eecf7995fb2?hp=eaf53e497a3a6e85cb4fec4431a8f72ddcf7a2c3

Put CSP in enforcing mode
---

diff --git a/cookbooks/web/recipes/rails.rb b/cookbooks/web/recipes/rails.rb
index d5f34cbf7..ab6c4e7f2 100644
--- a/cookbooks/web/recipes/rails.rb
+++ b/cookbooks/web/recipes/rails.rb
@@ -90,7 +90,7 @@ rails_port "www.openstreetmap.org" do
   mapzen_valhalla_key web_passwords["mapzen_valhalla_key"]
   thunderforest_key web_passwords["thunderforest_key"]
   totp_key web_passwords["totp_key"]
-  csp_report_url "https://openstreetmap.report-uri.io/r/default/csp/reportOnly"
+  csp_enforce true
 end
 
 package "libjson-xs-perl"
diff --git a/cookbooks/web/resources/rails_port.rb b/cookbooks/web/resources/rails_port.rb
index d53cac881..1c95dd8dc 100644
--- a/cookbooks/web/resources/rails_port.rb
+++ b/cookbooks/web/resources/rails_port.rb
@@ -65,6 +65,7 @@ property :mapquest_key, String
 property :mapzen_valhalla_key, String
 property :thunderforest_key, String
 property :totp_key, String
+property :csp_enforce, [TrueClass, FalseClass], :default => false
 property :csp_report_url, String
 property :piwik_configuration, Hash
 
@@ -264,6 +265,10 @@ action :create do
       line.gsub!(/^( *)#totp_key:.*$/, "\\1totp_key: \"#{new_resource.totp_key}\"")
     end
 
+    if new_resource.csp_enforce
+      line.gsub!(/^( *)csp_enforce:.*$/, "\\1csp_enforce: \"#{new_resource.csp_enforce}\"")
+    end
+
     if new_resource.csp_report_url
       line.gsub!(/^( *)#csp_report_url:.*$/, "\\1csp_report_url: \"#{new_resource.csp_report_url}\"")
     end