Fixing CSP Issues (#1172)

* Updating CSP to work with payment questions.

Author: Scullyon

.env.sample

@@ -52,6 +52,7 @@ USE_MAPS_FEATURE=false
 FEEDBACK_VIA_EMAIL=defraforms@defra.gov.uk
 
 #PAYMENT_PROVIDER_API_KEY_TEST=
+PAYMENT_PROVIDER_URL=https://card.payments.service.gov.uk
 
 PRIVATE_KEY_FOR_SECRETS=
 # one day in milliseconds

jest.setup.cjs

@@ -46,6 +46,7 @@ process.env.ORDNANCE_SURVEY_API_SECRET = 'dummy-ordnance-survey-api-secret'
 process.env.USE_MAPS_FEATURE = 'false'
 process.env.FEEDBACK_VIA_EMAIL = 'defraforms@defra.gov.uk'
 process.env.PRIVATE_KEY_FOR_SECRETS = 'dummy-private-key'
+process.env.PAYMENT_PROVIDER_URL = 'https://test-card.payments.service.gov.uk'
 process.env.SNS_FORM_TOPIC_ARN_MAP =
   '{"507f1f77bcf86cd799439099":"arn:aws:sns:eu-west-2:123456789012:form-specific-topic"}'
 process.env.SESSION_TIMEOUT = '86400000'

package-lock.json

@@ -46,7 +46,7 @@
   "license": "SEE LICENSE IN LICENSE",
   "dependencies": {
     "@aws-sdk/client-sns": "^3.997.0",
-    "@defra/forms-engine-plugin": "^4.7.1",
+    "@defra/forms-engine-plugin": "^4.7.2",
     "@defra/forms-model": "^3.0.647",
     "@defra/hapi-tracing": "^1.30.0",
     "@elastic/ecs-pino-format": "^1.5.0",

package.json

@@ -235,6 +235,13 @@ export const config = convict({
     env: 'UPLOADER_BUCKET_NAME'
   } as SchemaObj<string>,
 
+  paymentProviderUrl: {
+    doc: 'Base URL of the hosted payment provider (GOV.UK Pay) users are redirected to after submitting the payment form. Used to allow the redirect target in the form-action CSP directive.',
+    format: String,
+    default: null,
+    env: 'PAYMENT_PROVIDER_URL'
+  } as SchemaObj<string>,
+
   /**
    * Logging
    */

src/config/index.ts

@@ -17,7 +17,7 @@ describe('Server Blankie Plugin', () => {
       styleSrc: ['self', 'unsafe-inline'],
       imgSrc: ['self', 'data:'],
       workerSrc: ['blob:'],
-      formAction: ['self'],
+      formAction: ['self', 'https://test-card.payments.service.gov.uk'],
       frameAncestors: ['none'],
       objectSrc: ['none'],
       generateNonces: 'script'
@@ -51,7 +51,7 @@ describe('Server Blankie Plugin', () => {
         'https://www.googletagmanager.com'
       ],
       workerSrc: ['blob:'],
-      formAction: ['self'],
+      formAction: ['self', 'https://test-card.payments.service.gov.uk'],
       frameAncestors: ['none'],
       objectSrc: ['none'],
       generateNonces: 'script'
@@ -77,4 +77,25 @@ describe('Server Blankie Plugin', () => {
 
     expect(options?.connectSrc).toEqual(['self'])
   })
+
+  test('configuration includes paymentProviderUrl in formAction when provided', () => {
+    config.set('googleTagManagerContainerId', '')
+    config.set('paymentProviderUrl', 'https://card.payments.service.gov.uk')
+
+    const { options } = configureBlankiePlugin()
+
+    expect(options?.formAction).toEqual([
+      'self',
+      'https://card.payments.service.gov.uk'
+    ])
+  })
+
+  test('configuration falls back to self-only formAction when paymentProviderUrl not provided', () => {
+    config.set('googleTagManagerContainerId', '')
+    config.set('paymentProviderUrl', '')
+
+    const { options } = configureBlankiePlugin()
+
+    expect(options?.formAction).toEqual(['self'])
+  })
 })

src/server/plugins/blankie.test.ts

@@ -22,6 +22,7 @@ export const configureBlankiePlugin = (): ServerRegisterPluginObject<
 > => {
   const gtmContainerId = config.get('googleTagManagerContainerId')
   const uploaderUrl = config.get('uploaderUrl')
+  const paymentProviderUrl = config.get('paymentProviderUrl')
 
   return {
     plugin: Blankie,
@@ -42,7 +43,10 @@ export const configureBlankiePlugin = (): ServerRegisterPluginObject<
       ].flat(),
       frameSrc: gtmContainerId ? googleAnalyticsOptions.frameSrc : ['none'],
       workerSrc: ['blob:'],
-      formAction: ['self'],
+      formAction: [
+        ['self'],
+        paymentProviderUrl ? [paymentProviderUrl] : []
+      ].flat(),
       frameAncestors: ['none'],
       objectSrc: ['none'],
       generateNonces: 'script'