feat(security): add GTM and GA domains to CSP for hosted environments#4024
feat(security): add GTM and GA domains to CSP for hosted environments#4024waleedlatif1 merged 2 commits intostagingfrom
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub. |
PR SummaryMedium Risk Overview Reviewed by Cursor Bugbot for commit 1ce2a2f. Configure here. |
waleedlatif1
force-pushed
the
waleedlatif1/add-gtm-ga-hosted
branch
from
24c4cbe to
de69cc2
Compare
Greptile SummaryThis PR follows up on #3993 by adding the missing CSP allowlist entries for Google Tag Manager (GTM) and Google Analytics (GA) in hosted environments. Without these entries, browsers would block GTM/GA resources despite the scripts being loaded, producing CSP violation reports and broken analytics.
Confidence Score: 5/5Safe to merge — the CSP additions are correct, consistent across both policy paths, and properly gated behind isHosted All GTM/GA domains are identical between buildTimeCSPDirectives and generateRuntimeCSP(), the isHosted gate is applied correctly everywhere, and there are no logic or security regressions. The only remaining finding is P2: missing test coverage for the isHosted: true path, which does not block merge. csp.test.ts — a separate hosted-mode test file would improve confidence in the new GTM domain additions Important Files Changed
Flowchart%%{init: {'theme': 'neutral'}}%%
flowchart TD
A[CSP header generation] --> B{isHosted?}
B -->|true| C[Add GTM/GA domains]
B -->|false| D[Standard CSP only]
C --> E[script-src\ngoogletagmanager.com\ngoogle-analytics.com]
C --> F[img-src\ngoogletagmanager.com\ngoogle-analytics.com]
C --> G[connect-src\ngoogletagmanager.com\n*.google-analytics.com\n*.analytics.google.com]
C --> H[frame-src\ngoogletagmanager.com]
E & F & G & H --> I[Final CSP Header]
D --> I
Reviews (2): Last reviewed commit: "lint" | Re-trigger Greptile |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
waleedlatif1
force-pushed
the
waleedlatif1/add-gtm-ga-hosted
branch
from
de69cc2 to
1ce2a2f
Compare
|
@greptile |
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 1ce2a2f. Configure here.
| 'https://s3.amazonaws.com', | ||
| 'https://github.com/*', | ||
| 'https://collector.onedollarstats.com', | ||
| ...(isHosted ? ['https://www.googletagmanager.com', 'https://www.google-analytics.com'] : []), |
There was a problem hiding this comment.
CSP img-src uses exact domains instead of wildcards
Medium Severity
The img-src directive uses exact www. domains (https://www.google-analytics.com, https://www.googletagmanager.com) while the connect-src directive in the same PR correctly uses wildcards (https://*.google-analytics.com). Google's official CSP documentation for GA4 explicitly recommends wildcards for img-src too: https://*.google-analytics.com https://*.googletagmanager.com. GA tracking pixels can be served from non-www subdomains (e.g., regional endpoints), which would be blocked by the exact-domain img-src entries. This inconsistency exists in both buildTimeCSPDirectives and gtmImg in generateRuntimeCSP().
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 1ce2a2f. Configure here.
1 participant
Summary
script-src,img-src,connect-src, andframe-srcdirectivesbuildTimeCSPDirectivesandgenerateRuntimeCSP()isHostedFollows up on #3993 which added the GTM/GA scripts but missed the CSP allowlisting.
Type of Change
Testing
Tested manually
Checklist