Provide an accept CSP policy for global search pictures

Signed-off-by: Thomas Citharel <tcit@tcit.fr>

config/config.exs

@@ -371,7 +371,10 @@ config :mobilizon, Mobilizon.Service.GlobalSearch,
   service: Mobilizon.Service.GlobalSearch.SearchMobilizon
 
 config :mobilizon, Mobilizon.Service.GlobalSearch.SearchMobilizon,
-  endpoint: "https://search.joinmobilizon.org"
+  endpoint: "https://search.joinmobilizon.org",
+  csp_policy: [
+    img_src: "search.joinmobilizon.org"
+  ]
 
 # Import environment specific config. This must remain at the bottom
 # of this file so it overrides the configuration defined above.

lib/service/global_search/provider.ex

@@ -32,6 +32,10 @@ defmodule Mobilizon.Service.GlobalSearch.Provider do
               Page.t(EventResult.t())
   @callback search_groups(search_options :: keyword) ::
               Page.t(GroupResult.t())
+  @doc """
+  The CSP configuration to add for the service to work
+  """
+  @callback csp() :: keyword()
 
   @spec endpoint(atom()) :: String.t()
   def endpoint(provider) do

lib/service/global_search/search_mobilizon.ex

@@ -113,6 +113,16 @@ defmodule Mobilizon.Service.GlobalSearch.SearchMobilizon do
     end
   end
 
+  @impl Provider
+  @doc """
+  Returns the CSP configuration for this search provider to work
+  """
+  def csp do
+    :mobilizon
+    |> Application.get_env(__MODULE__, [])
+    |> Keyword.get(:csp_policy, [])
+  end
+
   defp build_event(data) do
     picture =
       if data["banner"] do

lib/web/plugs/http_security_plug.ex

@@ -10,6 +10,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
 
   alias Mobilizon.Config
   alias Mobilizon.Service.FrontEndAnalytics
+  alias Mobilizon.Service.GlobalSearch
   import Plug.Conn
 
   require Logger
@@ -139,7 +140,8 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
   defp get_csp_config(type, options) do
     config_policy = Keyword.get(options, type, Config.get([:http_security, :csp_policy, type]))
     front_end_analytics_policy = [Keyword.get(FrontEndAnalytics.csp(), type, [])]
+    global_search_policy = [Keyword.get(GlobalSearch.service().csp(), type, [])]
 
-    Enum.join(config_policy ++ front_end_analytics_policy, " ")
+    Enum.join(config_policy ++ front_end_analytics_policy ++ global_search_policy, " ")
   end
 end