Magento 2.4 CSP

Question

I've got a whitelist csp_whitelist.xml with the following -

<?xml version="1.0"?> <csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
<policies>
    <policy id="script-src">
        <values>
            <value id="cloudflare" type="host">*.cloudflare.com</value>
            <value id="twitter.com" type="host">*.twitter.com</value>
            <value id="google-analytics" type="host">*.google-analytics.com</value>
            <value id="twimg" type="host">*.twimg.com</value>
            <value id="gstatic" type="host">*.gstatic.com</value>
            <value id="trustedshops" type="host">*.trustedshops.com</value>
            <value id="usercentrics" type="host">*.usercentrics.eu</value>
            <value id="fontawesome" type="host">*.fontawesome.com</value>
            <value id="mailchimp" type="host">*.mailchimp.com</value>
            <value id="chimpstatic" type="host">*.chimpstatic.com</value>
        </values>
    </policy>
    <policy id="style-src">
        <values>
            <value id="cloudflare" type="host">*.cloudflare.com</value>
            <value id="googleapis" type="host">*.googleapis.com</value>
            <value id="twitter.com" type="host">*.twitter.com</value>
            <value id="twimg" type="host">*.twimg.com</value>
            <value id="gstatic" type="host">*.gstatic.com</value>
            <value id="typekit" type="host">*.typekit.net</value>
            <value id="trustedshops" type="host">*.trustedshops.com</value>
            <value id="usercentrics" type="host">*.usercentrics.eu</value>
            <value id="fontawesome" type="host">*.fontawesome.com</value>
        </values>
    </policy>
    <policy id="img-src">
        <values>
            <value id="designacake" type="host">*.design-a-cake.co.uk</value>
            <value id="cloudflare" type="host">*.cloudflare.com</value>
            <value id="klarna-base" type="host">*.klarna.com</value>
            <value id="googleadservices" type="host">*.googleadservices.com</value>
            <value id="google-analytics" type="host">*.google-analytics.com</value>
            <value id="paypal" type="host">*.paypal.com</value>
            <value id="twitter.com" type="host">*.twitter.com</value>
            <value id="twimg" type="host">*.twimg.com</value>
            <value id="vimeocdn" type="host">*.vimeocdn.com</value>
            <value id="youtube-img" type="host">*.ytimg.com</value>
            <value id="data" type="host">'self' data:</value>
            <value id="lightemporium" type="host">*.lightemporium.com</value>                
            <value id="usercentrics" type="host">*.usercentrics.eu</value>
        </values>
    </policy>
    <policy id="connect-src">
        <values>
            <value id="cloudflare" type="host">*.cloudflare.com</value>
            <value id="twitter.com" type="host">*.twitter.com</value>
            <value id="paypal" type="host">*.paypal.com</value>
            <value id="twimg" type="host">*.twimg.com</value>
        </values>
    </policy>
    <policy id="font-src">
        <values>
            <value id="cloudflare" type="host">*.cloudflare.com</value>
            <value id="twitter.com" type="host">*.twitter.com</value>
            <value id="gstatic" type="host">*.gstatic.com</value>
            <value id="typekit" type="host">*.typekit.net</value>
            <value id="twimg" type="host">*.twimg.com</value>
            <value id="trustedshops" type="host">*.trustedshops.com</value>
            <value id="googleapis" type="host">*.googleapis.com</value>
            <value id="fontawesome" type="host">*.fontawesome.com</value>
        </values>
    </policy>

    <policy id="frame-src">
        <values>
            <value id="twitter.com" type="host">*.twitter.com</value>
        </values>
    </policy>

    <policy id="form-action">
        <values>
            <value id="twitter.com" type="host">*.twitter.com</value>
        </values>
    </policy>
</policies></csp_whitelist>

SInce updating to Magento 2.4 the console output is:

[Report Only] Refused to load the script 'https://chimpstatic.com/mcjs-connected/js/users/cf09ee9019b287188eeb127cc/8f22db0f724fa7989f8c1b5cd.js' because it violates the following Content Security Policy directive: "script-src assets.adobedtm.com secure.authorize.net test.authorize.net www.googleadservices.com www.google-analytics.com www.paypalobjects.com js.braintreegateway.com www.paypal.com geostag.cardinalcommerce.com 1eafstag.cardinalcommerce.com geoapi.cardinalcommerce.com 1eafapi.cardinalcommerce.com songbird.cardinalcommerce.com includestest.ccdc02.com www.sandbox.paypal.com t.paypal.com s.ytimg.com video.google.com vimeo.com www.vimeo.com www.youtube.com *.payments-amazon.com *.payments-amazon.co.uk *.payments-amazon.co.jp *.payments-amazon.jp *.payments-amazon.it *.payments-amazon.fr *.payments-amazon.es *.cloudflare.com *.twitter.com *.google-analytics.com *.twimg.com *.gstatic.com *.trustedshops.com *.usercentrics.eu *.fontawesome.com *.mailchimp.com *.chimpstatic.com 'unsafe-eval' data: yotpo.com www.yotpo.com p.yotpo.com staticw2.yotpo.com w2.yotpo.com 'self' 'unsafe-inline' 'unsafe-eval'". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback. Blockquote

Answer 1

Found the answer, for Chimptastic you need to add:

<policy id="script-src">
<values>
<value id="chimpstatic" type="host">https://chimpstatic.com</value>
</values>
</policy>