From f221856ae1d5535a6604a9394cb2c2da999c867d Mon Sep 17 00:00:00 2001
From: Severiano Badajoz <sbadajoz@chanzuckerberg.com>
Date: Tue, 11 Aug 2020 16:50:46 -0700
Subject: [PATCH] add CSP sources for obsolete browser prompt (#1731)

Adds script hash and explicit domain to `img-src` directive
---
 client/configuration/webpack/obsoleteHTMLTemplate.html | 1 +
 server/eb/app.py                                       | 8 ++++++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/client/configuration/webpack/obsoleteHTMLTemplate.html b/client/configuration/webpack/obsoleteHTMLTemplate.html
index e5c96849..35d7be95 100644
--- a/client/configuration/webpack/obsoleteHTMLTemplate.html
+++ b/client/configuration/webpack/obsoleteHTMLTemplate.html
@@ -1,4 +1,5 @@
 <script>
+  /** Reflect ANY changes to this script in the script hash in `server/eb/app.py` **/
   var root = document.getElementById("root");
   root.remove();
   var portals = document.getElementsByClassName("bp3-portal");
diff --git a/server/eb/app.py b/server/eb/app.py
index f1a5c9be..aabf67ed 100644
--- a/server/eb/app.py
+++ b/server/eb/app.py
@@ -96,12 +96,16 @@ class WSGIServer(Server):
     def _before_adding_routes(app, app_config):
         script_hashes = WSGIServer.get_csp_hashes(app, app_config)
         server_config = app_config.server_config
+        # This hash should be in sync with the script within
+        # `client/configuration/webpack/obsoleteHTMLTemplate.html`
+        obsolete_browser_script_hash = ['SHA25-0028D52E332C015C3ED9929926F4000BB4020B8CB85C1F5769D6AA3BA711F58E']
         csp = {
             "default-src": ["'self'"],
             "connect-src": ["'self'"],
-            "script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] + script_hashes,
+            "script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"]
+            + obsolete_browser_script_hash + script_hashes,
             "style-src": ["'self'", "'unsafe-inline'"],
-            "img-src": ["'self'", "data:"],
+            "img-src": ["'self'", "'https://cellxgene.cziscience.com'", "data:"],
             "object-src": ["'none'"],
             "base-uri": ["'none'"],
             "frame-ancestors": ["'none'"],