Add algolia hosts to connect-src and remove some inline styles (#243)

Author: marcospereira

app/assets/css/main.styl

@@ -44,4 +44,21 @@ a[href="#"], a[href="#todo"], [todo]
             background: none
             padding: 0 3px 0 0
             font-size: 13px
-            margin: 0
+            margin: 0
+
+.reactive-ribbon
+    border: 0
+    position: fixed
+    right: 0
+    top: 0
+    z-index: 9000
+
+.vulnerability-warning
+    font-weight: bold
+    color: red
+    a
+        color: red
+
+.not-found-content
+    min-height: inherit
+    z-index: auto

app/controllers/Application.scala

@@ -36,8 +36,8 @@ class Application @Inject() (
   private def news(version: Option[String]): Seq[Html] = {
     val message = version.filter(VulnerableVersions).map { _ =>
 
-      s"""<p style="font-weight: bold; color: red;">You are using a version of Play Framework that has a
-        <a style="color: red;" href="${routes.Security.vulnerability("20130806-SessionInjection")}">known vulnerability</a>.</p>
+      s"""<p class="vulnerability-warning">You are using a version of Play Framework that has a
+        <a href="${routes.Security.vulnerability("20130806-SessionInjection")}">known vulnerability</a>.</p>
           <p>Please upgrade to a later version <a href="${routes.Application.download()}">here</a>.</p>"""
 
     } orElse {

app/views/documentation/v2.scala.html

@@ -56,10 +56,10 @@ <h3>Books</h3>
             <h1>Page not found [ @page ]</h1>
 
             <p>
-              This page does not exist in that version of the documentation.  You can still use the <span style="font-weight: bold">search box above</span> to look for for that particular word or phrase.
+              This page does not exist in that version of the documentation.  You can still use the <strong>search box above</strong> to look for for that particular word or phrase.
 
             <p>
-            If you are looking for <span style="font-weight: bold">latest</span> documentation, the following links are helpful:
+            If you are looking for <strong>latest</strong> documentation, the following links are helpful:
 
             <ul>
                 <li>
@@ -80,7 +80,7 @@ <h1>Page not found [ @page ]</h1>
             </ul>
 
             <p>
-            If you are looking for the <span style="font-weight: bold">latest</span> API documentation:
+            If you are looking for the <strong>latest</strong> API documentation:
 
             <ul>
                 <li>

app/views/main.scala.html

@@ -177,18 +177,18 @@ <h3>Social networks</h3>
             </div>
             <div class="lb-legal">
                 <p>
-                    &copy; Lightbend 2018 | 
-                    <a href="https://www.lightbend.com/legal/licenses" target="_blank">Licenses</a> | 
-                    <a href="https://www.lightbend.com/legal/terms" target="_blank">Terms</a> | 
-                    <a href="https://www.lightbend.com/legal/privacy" target="_blank">Privacy Policy</a> | 
-                    <a href="@routes.Application.cookie()">Cookie Listing</a> | 
+                    &copy; Lightbend 2018 |
+                    <a href="https://www.lightbend.com/legal/licenses" target="_blank">Licenses</a> |
+                    <a href="https://www.lightbend.com/legal/terms" target="_blank">Terms</a> |
+                    <a href="https://www.lightbend.com/legal/privacy" target="_blank">Privacy Policy</a> |
+                    <a href="@routes.Application.cookie()">Cookie Listing</a> |
                     <a class="optanon-toggle-display">Cookie Settings</a>
                 </p>
             </div>
 
         </footer>
 
-        <a href="http://www.reactivemanifesto.org/" id="reactive_ribbon"><img style="border: 0; position: fixed; right: 0; top:0; z-index: 9000" src="//d379ifj7s9wntv.cloudfront.net/reactivemanifesto/images/ribbons/we-are-reactive-black-right.png"></a>
+        <a href="http://www.reactivemanifesto.org/" id="reactive_ribbon"><img class="reactive-ribbon" src="https://d379ifj7s9wntv.cloudfront.net/reactivemanifesto/images/ribbons/we-are-reactive-black-right.png"></a>
 
         <script src="@routes.Assets.versioned("javascripts/munchkin.js")"></script>
     </body>

app/views/notfound.scala.html

@@ -9,7 +9,7 @@ <h1>
             </h1>
         </div>
     </header>
-    <section id="content" style="min-height: inherit; z-index: auto;">
+    <section id="content" class="not-found-content">
         <article>
             <br/>
             <h2>We're sorry, your request could not be completed as dialed.  Please check the URL and try your request again.</h2>

conf/application.conf

@@ -21,7 +21,7 @@ play {
   filters {
     headers {
       frameOptions = "sameorigin"
-      contentSecurityPolicy="default-src 'self'; img-src 'self' *.githubusercontent.com *.google-analytics.com d379ifj7s9wntv.cloudfront.net; font-src 'self' data: fonts.gstatic.com; script-src 'self' 'unsafe-eval' www.google-analytics.com *.googleapis.com cdn.jsdelivr.net munchkin.marketo.net *.mktoresp.com optanon.blob.core.windows.net 'sha256-Mz1BSEhQ2FXaHzVWxucxc0+PCwT6oyt/5UPqDVlUugs=' 'sha256-1IG7kxxg7+f1m8Iu+Dk44NMBBV2ZjAkq7dalJrzDJMM=' 'sha256-n73RBf/LVzJGkBNoNFYhY2JnwJDTOX/xUOK5XYVcFOI=' 'sha256-DScy2dpFEzZofKeEv/orAZJj/q21B49aHew7suEpfFs=' 'sha256-17TcZWrBMS5XH+2P8hJM6WdgJNdvHZC6w6nhVdCKQoA='; style-src 'self' fonts.googleapis.com cdn.jsdelivr.net optanon.blob.core.windows.net 'sha256-HNYzPTRt75YR/Yjz4EVJvRKMVMBbL6CMpl655m4gDcw='; connect-src 'self' *.mktoresp.com"
+      contentSecurityPolicy="default-src 'self'; img-src 'self' *.githubusercontent.com *.google-analytics.com d379ifj7s9wntv.cloudfront.net; font-src 'self' data: fonts.gstatic.com; script-src 'self' 'unsafe-eval' *.algolia.net *.algolianet.com www.google-analytics.com *.googleapis.com cdn.jsdelivr.net munchkin.marketo.net *.mktoresp.com optanon.blob.core.windows.net 'sha256-Mz1BSEhQ2FXaHzVWxucxc0+PCwT6oyt/5UPqDVlUugs=' 'sha256-1IG7kxxg7+f1m8Iu+Dk44NMBBV2ZjAkq7dalJrzDJMM=' 'sha256-n73RBf/LVzJGkBNoNFYhY2JnwJDTOX/xUOK5XYVcFOI=' 'sha256-DScy2dpFEzZofKeEv/orAZJj/q21B49aHew7suEpfFs=' 'sha256-17TcZWrBMS5XH+2P8hJM6WdgJNdvHZC6w6nhVdCKQoA='; style-src 'self' fonts.googleapis.com cdn.jsdelivr.net optanon.blob.core.windows.net 'sha256-HNYzPTRt75YR/Yjz4EVJvRKMVMBbL6CMpl655m4gDcw=' 'sha256-DBEW4pxWYTcPK7CjJPI+BiO8HUcAwfzMzbFusCyqWWQ=' 'sha256-wYq1X7cBoJbqNegyYiUCSuwas5okdICKhCGXkQLi/EM=' 'sha256-9DTrbcAci4RgTNhuuPqjM9Fs+58Ek/5sYa0HpsNACE4='; connect-src 'self' *.mktoresp.com *.algolia.net *.algolianet.com"
     }
     hosts {
       allowed = [".playframework.com", "localhost", "playframework-com-app"] # playframework-com-app is the upstream host configured in nginx