From 8f1b2b63b4f9ec8d2898fbe2b9cc5a4237bb34f6 Mon Sep 17 00:00:00 2001
From: rdbsolutions <rob@rdbsolutions.co.uk>
Date: Mon, 14 Apr 2025 18:00:30 +0100
Subject: [PATCH] csp fix removed matcher

---
 components/tracking/index.js |  2 +-
 middleware.js                | 50 +++++++++++++++++++-----------------
 2 files changed, 27 insertions(+), 25 deletions(-)

diff --git a/components/tracking/index.js b/components/tracking/index.js
index 1bdbf3b4..5439f388 100644
--- a/components/tracking/index.js
+++ b/components/tracking/index.js
@@ -50,7 +50,7 @@ export const Tracking = ({ googleTagManagerID, nonce, cookieObj }) => {
     );
 };
 
-export const TrackingNoScript = ({ nonce, googleTagManagerID }) => (
+export const TrackingNoScript = ({ googleTagManagerID, nonce }) => (
     <Fragment>
         <noscript>
             <iframe
diff --git a/middleware.js b/middleware.js
index 08fce44b..a07e56ce 100644
--- a/middleware.js
+++ b/middleware.js
@@ -2,21 +2,23 @@ import { NextResponse } from "next/server";
 
 export function middleware(request) {
     const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
-    const cspHeader = `
+    const cspHeader =
+        `
     default-src 'self';
     script-src 'self' 'nonce-${nonce}' 'strict-dynamic' https: http: ${
-        process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
-    };
+            process.env.NODE_ENV === "production" ? "" : `'unsafe-eval'`
+        };
     style-src 'self' 'unsafe-eval' 'unsafe-inline';
-    img-src 'self' blob: data:;
+    img-src 'self' 'unsafe-inline'  https://www.gov.wales https://gov.wales https://fonts.gstatic.com https://www.googletagmanager.com  blob: data:;
     connect-src 'self' http://127.0.0.1 https://uksouth-1.in.applicationinsights.azure.com https://ukwest-0.in.applicationinsights.azure.com https://js.monitor.azure.com https://region1.google-analytics.com;
     font-src 'self'  https://pro.fontawesome.com/ https://fonts.gstatic.com/ ;
     object-src 'none';
     base-uri 'self';
-    form-action 'self' ${process.env.NEXTAUTH_URL}; 
+    form-action 'self' ` +
+        process.env.NEXTAUTH_URL +
+        `; 
     frame-ancestors 'none';
     upgrade-insecure-requests;
-    frame-src https://datamap.gov.wales;
 `;
 
     // csp += `base-uri 'self';`;
@@ -57,21 +59,21 @@ export function middleware(request) {
     return response;
 }
 
-export const config = {
-    matcher: [
-        /*
-         * Match all request paths except for the ones starting with:
-         * - api (API routes)
-         * - _next/static (static files)
-         * - _next/image (image optimization files)
-         * - favicon.ico (favicon file)
-         */
-        {
-            source: "/((?!api|_next/static|_next/image|favicon.ico).*)",
-            missing: [
-                { type: "header", key: "next-router-prefetch" },
-                { type: "header", key: "purpose", value: "prefetch" },
-            ],
-        },
-    ],
-};
+// export const config = {
+//     matcher: [
+//         /*
+//          * Match all request paths except for the ones starting with:
+//          * - api (API routes)
+//          * - _next/static (static files)
+//          * - _next/image (image optimization files)
+//          * - favicon.ico (favicon file)
+//          */
+//         {
+//             source: "/((?!api|_next/static|_next/image|favicon.ico).*)",
+//             missing: [
+//                 { type: "header", key: "next-router-prefetch" },
+//                 { type: "header", key: "purpose", value: "prefetch" },
+//             ],
+//         },
+//     ],
+// };