preserving worker-src directive

Author: thomasneirynck

src/legacy/server/csp/index.test.ts

@@ -40,6 +40,7 @@ test('default CSP rules', () => {
   expect(DEFAULT_CSP_RULES).toMatchInlineSnapshot(`
     Array [
       "script-src 'unsafe-eval' 'self'",
+      "worker-src blob: 'self'",
       "style-src 'unsafe-inline' 'self'",
     ]
   `);

src/legacy/server/csp/index.ts

@@ -19,6 +19,7 @@
 
 export const DEFAULT_CSP_RULES = Object.freeze([
   `script-src 'unsafe-eval' 'self'`,
+  `worker-src blob: 'self'`,
   `style-src 'unsafe-inline' 'self'`,
 ]);
 

test/api_integration/apis/general/csp.js

@@ -37,6 +37,7 @@ export default function ({ getService }) {
       const entries = Array.from(parsed.entries());
       expect(entries).to.eql([
         [ 'script-src', [ '\'unsafe-eval\'', '\'self\'' ] ],
+        [ 'worker-src', [ 'blob:', '\'self\'' ] ],
         [ 'style-src', [ '\'unsafe-inline\'', '\'self\'' ] ]
       ]);
     });

x-pack/test/oidc_api_integration/apis/implicit_flow/oidc_auth.ts

@@ -61,7 +61,7 @@ export default function({ getService }: FtrProviderContext) {
         expect(response.headers['content-type']).to.be('text/html; charset=utf-8');
         expect(response.headers['cache-control']).to.be('private, no-cache, no-store');
         expect(response.headers['content-security-policy']).to.be(
-          `script-src 'unsafe-eval' 'self'; style-src 'unsafe-inline' 'self'`
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
         );
 
         // Check that script that forwards URL fragment worked correctly.

x-pack/test/saml_api_integration/apis/security/saml_login.ts

@@ -142,7 +142,7 @@ export default function({ getService }: FtrProviderContext) {
         expect(response.headers['content-type']).to.be('text/html; charset=utf-8');
         expect(response.headers['cache-control']).to.be('private, no-cache, no-store');
         expect(response.headers['content-security-policy']).to.be(
-          `script-src 'unsafe-eval' 'self'; style-src 'unsafe-inline' 'self'`
+          `script-src 'unsafe-eval' 'self'; worker-src blob: 'self'; style-src 'unsafe-inline' 'self'`
         );
 
         // Check that script that forwards URL fragment worked correctly.