Merge pull request #2542 from canonical/feature/WD-36600-csp-gtm-domains

WD-36600: allow regional google.* domains in connect-src for GTM

Author: Skazitron

webapp/handlers.py

@@ -1,8 +1,61 @@
+import logging
+
+import requests
 import secrets
 
 import flask
 from canonicalwebteam.flask_base.env import get_flask_env
 
+logger = logging.getLogger(__name__)
+
+# Used if the live fetch from Google fails at startup. Covers the regions
+# we've historically seen in CSP reports.
+_GOOGLE_DOMAINS_FALLBACK = [
+    "www.google.com",
+    # Europe
+    "www.google.at", "www.google.be", "www.google.ch", "www.google.co.uk",
+    "www.google.cz", "www.google.de", "www.google.dk", "www.google.es",
+    "www.google.fi", "www.google.fr", "www.google.gr", "www.google.hu",
+    "www.google.ie", "www.google.it", "www.google.nl", "www.google.no",
+    "www.google.pl", "www.google.pt", "www.google.ro", "www.google.se",
+    # Americas
+    "www.google.ca", "www.google.cl", "www.google.co", "www.google.com.ar",
+    "www.google.com.br", "www.google.com.mx", "www.google.com.pe",
+    # Asia & Pacific
+    "www.google.co.id", "www.google.co.in", "www.google.co.jp",
+    "www.google.co.kr", "www.google.co.nz", "www.google.co.th",
+    "www.google.com.au", "www.google.com.hk", "www.google.com.my",
+    "www.google.com.ph", "www.google.com.sg", "www.google.com.tw",
+    "www.google.com.vn",
+]
+
+
+def _fetch_google_supported_domains():
+    """
+    Fetch Google's published list of regional search domains so GTM can
+    reach the user's local google.<tld>. Falls back to a hardcoded list
+    if the request fails so CSP remains valid.
+    """
+    try:
+        response = requests.get(
+            "https://www.google.com/supported_domains", timeout=5
+        )
+        response.raise_for_status()
+        domains = [
+            "www" + line.strip()
+            for line in response.text.splitlines()
+            if line.strip().startswith(".google.")
+        ]
+        if domains:
+            return domains
+        logger.warning("Google supported_domains response was empty")
+    except requests.RequestException as exc:
+        logger.warning("Failed to fetch Google supported_domains: %s", exc)
+    return _GOOGLE_DOMAINS_FALLBACK
+
+
+GOOGLE_DOMAINS = _fetch_google_supported_domains()
+
 CSP = {
     "default-src": ["'self'"],
     "img-src": [
@@ -58,7 +111,6 @@
     ],
     "connect-src": [
         "'self'",
-        "www.google.com",
         "ubuntu.com",
         "analytics.google.com",
         "www.googletagmanager.com",
@@ -73,6 +125,9 @@
         "ws.zoominfo.com",
         "youtube.com",
         "google.com",
+        # Regional google.<tld> domains used by GTM, sourced live from
+        # https://www.google.com/supported_domains at app startup.
+        *GOOGLE_DOMAINS,
         "fonts.google.com",
         "maps.googleapis.com",
         "pixel-config.reddit.com",