SONAR-21973 Update CSP with font-src to accept data: fonts

server/sonar-webserver-auth/src/main/java/org/sonar/server/authentication/SamlValidationCspHeaders.java

@@ -37,6 +37,7 @@ public class SamlValidationCspHeaders {
       "default-src 'self'",
       "base-uri 'none'",
       "connect-src 'self' http: https:",
+      "font-src 'self' data:;" +
       "img-src * data: blob:",
       "object-src 'none'",
       "script-src 'nonce-" + nonce + "'",

server/sonar-webserver/src/main/java/org/sonar/server/platform/web/CspFilter.java

@@ -31,7 +31,7 @@ import javax.servlet.ServletResponse;
 import javax.servlet.http.HttpServletResponse;
 
 public class CspFilter implements Filter {
-  
+
   private final List<String> cspHeaders = new ArrayList<>();
   private String policies = null;
 
@@ -40,11 +40,12 @@ public class CspFilter implements Filter {
     cspHeaders.add("Content-Security-Policy");
     cspHeaders.add("X-Content-Security-Policy");
     cspHeaders.add("X-WebKit-CSP");
-    
+
     List<String> cspPolicies = new ArrayList<>();
     cspPolicies.add("default-src 'self'");
     cspPolicies.add("base-uri 'none'");
     cspPolicies.add("connect-src 'self' http: https:");
+    cspPolicies.add("font-src 'self' data:");
     cspPolicies.add("img-src * data: blob:");
     cspPolicies.add("object-src 'none'");
     cspPolicies.add("script-src 'self'");

server/sonar-webserver/src/test/java/org/sonar/server/platform/web/CspFilterTest.java

@@ -39,6 +39,7 @@ public class CspFilterTest {
   private static final String EXPECTED = "default-src 'self'; " +
     "base-uri 'none'; " +
     "connect-src 'self' http: https:; " +
+    "font-src 'self' data:; " +
     "img-src * data: blob:; " +
     "object-src 'none'; " +
     "script-src 'self'; " +