fix: fetch google domains dynamically

Author: Skazitron

webapp/handlers.py

@@ -1,5 +1,58 @@
+import logging
+
+import requests
 from canonicalwebteam.flask_base.env import get_flask_env
 
+logger = logging.getLogger(__name__)
+
+# Used if the live fetch from Google fails at startup. Covers the regions
+# we've historically seen in CSP reports.
+_GOOGLE_DOMAINS_FALLBACK = [
+    "www.google.com",
+    # Europe
+    "www.google.at", "www.google.be", "www.google.ch", "www.google.co.uk",
+    "www.google.cz", "www.google.de", "www.google.dk", "www.google.es",
+    "www.google.fi", "www.google.fr", "www.google.gr", "www.google.hu",
+    "www.google.ie", "www.google.it", "www.google.nl", "www.google.no",
+    "www.google.pl", "www.google.pt", "www.google.ro", "www.google.se",
+    # Americas
+    "www.google.ca", "www.google.cl", "www.google.co", "www.google.com.ar",
+    "www.google.com.br", "www.google.com.mx", "www.google.com.pe",
+    # Asia & Pacific
+    "www.google.co.id", "www.google.co.in", "www.google.co.jp",
+    "www.google.co.kr", "www.google.co.nz", "www.google.co.th",
+    "www.google.com.au", "www.google.com.hk", "www.google.com.my",
+    "www.google.com.ph", "www.google.com.sg", "www.google.com.tw",
+    "www.google.com.vn",
+]
+
+
+def _fetch_google_supported_domains():
+    """
+    Fetch Google's published list of regional search domains so GTM can
+    reach the user's local google.<tld>. Falls back to a hardcoded list
+    if the request fails so CSP remains valid.
+    """
+    try:
+        response = requests.get(
+            "https://www.google.com/supported_domains", timeout=5
+        )
+        response.raise_for_status()
+        domains = [
+            "www" + line.strip()
+            for line in response.text.splitlines()
+            if line.strip().startswith(".google.")
+        ]
+        if domains:
+            return domains
+        logger.warning("Google supported_domains response was empty")
+    except requests.RequestException as exc:
+        logger.warning("Failed to fetch Google supported_domains: %s", exc)
+    return _GOOGLE_DOMAINS_FALLBACK
+
+
+GOOGLE_DOMAINS = _fetch_google_supported_domains()
+
 CSP = {
     "default-src": ["'self'"],
     "img-src": [
@@ -58,7 +111,6 @@
     ],
     "connect-src": [
         "'self'",
-        "www.google.com",
         "ubuntu.com",
         "analytics.google.com",
         "www.googletagmanager.com",
@@ -73,63 +125,9 @@
         "ws.zoominfo.com",
         "youtube.com",
         "google.com",
-        # Europe
-        "www.google.at",
-        "www.google.be",
-        "www.google.ch",
-        "www.google.co.uk",
-        "www.google.cz",
-        "www.google.de",
-        "www.google.dk",
-        "www.google.es",
-        "www.google.fi",
-        "www.google.fr",
-        "www.google.gr",
-        "www.google.hu",
-        "www.google.ie",
-        "www.google.it",
-        "www.google.nl",
-        "www.google.no",
-        "www.google.pl",
-        "www.google.pt",
-        "www.google.ro",
-        "www.google.se",
-        # Americas
-        "www.google.ca",
-        "www.google.cl",
-        "www.google.co",
-        "www.google.com.ar",
-        "www.google.com.br",
-        "www.google.com.mx",
-        "www.google.com.pe",
-        # Asia & Pacific
-        "www.google.co.id",
-        "www.google.co.in",
-        "www.google.co.jp",
-        "www.google.co.kr",
-        "www.google.co.nz",
-        "www.google.co.th",
-        "www.google.com.au",
-        "www.google.com.hk",
-        "www.google.com.my",
-        "www.google.com.ph",
-        "www.google.com.sg",
-        "www.google.com.tw",
-        "www.google.com.vn",
-        # Africa & Middle East
-        "www.google.co.id",
-        "www.google.co.in",
-        "www.google.co.jp",
-        "www.google.co.kr",
-        "www.google.co.nz",
-        "www.google.co.th",
-        "www.google.com.au",
-        "www.google.com.hk",
-        "www.google.com.my",
-        "www.google.com.ph",
-        "www.google.com.sg",
-        "www.google.com.tw",
-        "www.google.com.vn",
+        # Regional google.<tld> domains used by GTM, sourced live from
+        # https://www.google.com/supported_domains at app startup.
+        *GOOGLE_DOMAINS,
         "fonts.google.com",
         "maps.googleapis.com",
         "pixel-config.reddit.com",