From: Thibaut Girka <thib@sitedethib.com>
Date: Fri, 3 May 2019 22:14:49 +0000 (+0200)
Subject: Fix CSP when dealing with S3 hosts
X-Git-Url: https://git.xn--scling-oua.cat.family/?a=commitdiff_plain;h=58720aa2bdc45ec220903e0786984e803c87e8c9;p=mastodon.git

Fix CSP when dealing with S3 hosts
---

diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index 12b764a5a..9da38598b 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -7,9 +7,11 @@ if Rails.env.production?
   data_hosts = [assets_host]
 
   if ENV['S3_ENABLED'] == 'true'
-    attachments_host = ENV['S3_ALIAS_HOST'] || ENV['S3_CLOUDFRONT_HOST'] || ENV['S3_HOSTNAME'] || "s3-#{ENV['S3_REGION'] || 'us-east-1'}.amazonaws.com"
+    attachments_host = "https://#{ENV['S3_ALIAS_HOST'] || ENV['S3_CLOUDFRONT_HOST'] || ENV['S3_HOSTNAME'] || "s3-#{ENV['S3_REGION'] || 'us-east-1'}.amazonaws.com"}"
+    attachments_host = "https://#{Addressable::URI.parse(attachments_host).host}"
   elsif ENV['SWIFT_ENABLED'] == 'true'
     attachments_host = ENV['SWIFT_OBJECT_URL']
+    attachments_host = "https://#{Addressable::URI.parse(attachments_host).host}"
   else
     attachments_host = nil
   end