From 44dca2dd80381efe415a02d41e4a3d0ac4832387 Mon Sep 17 00:00:00 2001
From: Vesa Luusua <vesa.luusua@gmail.com>
Date: Thu, 15 Mar 2018 14:15:26 +0200
Subject: [PATCH] Add more CSP rules

---
 server/csp.js | 16 +++-------------
 1 file changed, 3 insertions(+), 13 deletions(-)

diff --git a/server/csp.js b/server/csp.js
index 6c079b38..278512e3 100644
--- a/server/csp.js
+++ b/server/csp.js
@@ -29,9 +29,8 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
   const googleAnalytics = 'https://www.google-analytics.com/';
   const googleAnalyticsDoubleClick = 'https://stats.g.doubleclick.net/';
   const googleMaps = 'https://maps.googleapis.com/';
-  const googleStaticCsi = 'https://csi.gstatic.com/';
   const googleStaticFonts = 'https://fonts.gstatic.com/';
-  const googleStaticMaps = 'https://maps.gstatic.com/';
+  const googleStatic = '*.gstatic.com';
   const googleFonts = 'https://fonts.googleapis.com/';
   const stripeJs = 'https://js.stripe.com/';
   const stripeQ = 'https://q.stripe.com/';
@@ -42,17 +41,7 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
 
   const styleSrc = [self, inline, googleFonts];
 
-  const imgSrc = [
-    self,
-    data,
-    imgix,
-    loremPixel,
-    placeholder,
-    stripeQ,
-    googleMaps,
-    googleStaticCsi,
-    googleStaticMaps,
-  ];
+  const imgSrc = [self, data, imgix, loremPixel, placeholder, stripeQ, googleMaps, googleStatic];
 
   const connectSrc = [self, sharetribeApi, googleMaps, stripeApi];
 
@@ -67,6 +56,7 @@ module.exports = (reportUri, enforceSsl, reportOnly) => {
     imgSrc.push(googleAnalytics);
     imgSrc.push(googleAnalyticsDoubleClick);
     connectSrc.push(googleAnalytics);
+    connectSrc.push(googleAnalyticsDoubleClick);
   }
   if (sentryClientEnabled) {
     connectSrc.push(sentryApi);