Bump version to 3.3.2

CSP: remove a bunch of unused mozilla-only domains and FXA domains

See merge request timvisee/send!7

.eslintignore

@@ -5,3 +5,4 @@ coverage
 android/app/build
 app/locale.js
 app/capabilities.js
+app/qrcode.js

.vscode/settings.json

@@ -1,2 +0,0 @@
-{
-}

CONTRIBUTORS

@@ -1,8 +1,14 @@
+Abd ar-Rahman Hamidi
 Abdalrahman Hwoij
+Abdulrash6211
+Abdulrasheed Idris
+Abelardo Ayala Rodríguez
 Abhinav Adduri
+Adaobi
 Adnan Kičin
 Adolfo Jayme Barrientos
 Alberto Castro
+Alexander Parada
 Alexander Slovesnik
 Alfredos-Panagiotis Damkalis
 Aman Alam
@@ -14,9 +20,12 @@ Anika Dorn
 Anish Sheela
 Arash Mousavi
 Artem Polivanchuk
+Ashesh Vidyut
 Ashikur Rahman
 Ashok kumar
+Ayobamiadebayo375
 Balasankar C
+Bald3mar
 Balázs Meskó
 Belayet Hossain
 Benjamin Forehand Jr
@@ -27,12 +36,14 @@ Boopesh Mahendran
 Brahim Essaidi
 Brainlulz
 Breana Gonzales
+CLASSIFIED
 Christian Elbrianno
 Christoph Kührer
 Christopher Ramírez
 Chuck Harmston
 Cloney 173741
 Cláudio Esperança
+Connor Ford
 Cristian Silaghi
 Cynthia Pereira
 Daniel Thorn
@@ -44,6 +55,7 @@ Dhyey Thakore
 Donovan Preston
 Edi Santoso
 Edmund Huggett
+Eduard Bopp
 Elisa X
 Emily
 Emily Hou
@@ -59,12 +71,17 @@ Francesco Lodolo [:flod]
 Frederick Villaluna
 G12r
 Gabriela
+Garysqo
 Gautam krishna.R
 George Raptis
 Georgianizator
+Gery Escalier
+Gisela Solis
 Gonçalo Matos
 Gwenn
 Hampus
+Hmxhmx
+Hrant
 Hugo
 Hugo Abreu
 Hyeonseok Shin
@@ -75,26 +92,35 @@ Jae Hyeon Park
 Jakob Kappel
 Jakub Rychlý
 Jamie
+Jan Schloß
 Jarmo
 Jim Spentzos
 Jiri Grönroos
+Jirka Soukeník
 Jobava
 Joe Becher
 Joe ST
 Joergen
 Johann-S
 John Gruen
+John Zonunmawi Vankal
 Jon Buckley
 Jon Vadillo
 Jonathan Claudius
 Jordi Cuevas
 Jordi Serratosa
+Joseph.maza
+José Manuel
 Juan Esteban Ajsivinac Sián
+Juan Pablo
 Juan Sián
+Julio Gomez
 Juraj Cigáň
+Jwtiyar
 Kerim Kalamujić
 Khaled Hosny
 Kim Ludvigsen
+Kim YoungCheon
 Kim Younggeon
 Kohei Yoshino
 Lan Glad
@@ -103,10 +129,12 @@ Laurent Jouanneau
 Lobodzets
 LuFlo
 Luis A. Sánchez
+Luis Flores Martínez
 Luiz Carlos de Morais
 Luiz Felipe F M Costa
 Luna Jernberg
 Mahay Alam Khan
+Manuela Silva
 Marcelo Ghelman
 Marcelo Poli
 Marco Aurélio
@@ -116,16 +144,21 @@ Mark Liang (You-Wen)
 Marko Andrejić
 Martijn Dekker
 Marwan Mohamad
+Mathieu Lecarme
 Matjaž Horvat
 Maykon Chagas
 Melo46
 Merike Sell
 Michael Köhler
+Michael Peter
 Michael Wolf
 Michal Stanke
 Michal Vašíček
+Miguel
 Mikeyy
+Milo
 Miro Rauhala
+Misael Hernández
 Mozilla Pontoon
 Mozilla-GitHub-Standards
 Mozinet
@@ -133,6 +166,7 @@ Moḥend Belqasem
 Muhend Belkacem
 Muḥend Belqasem
 Myungjae Won
+Netza López
 Nicholas Skinsacos
 Nihad
 Nihad Suljić
@@ -144,12 +178,14 @@ Peter deHaan
 Pierre Neter
 Pin-guang Chen
 Piotr Drąg
+Pontoon
 Quentí
 Quế Tùng
 Rachel Tublitz
 Radu Popescu
 Rhoslyn Prys
 RickieES
+Ricky Rosario
 Rimas Kudelis
 Rizky Ariestiyansyah
 Rob Powell
@@ -170,6 +206,7 @@ Sav22999
 Schieck :)
 Selim Şumlu
 Selyan Sliman Amiri
+Selyan Slimane Amiri
 Sidak Singh Aulakh
 Slimane Amiri
 Slimane Selyan AMIRI
@@ -187,8 +224,11 @@ Ton
 Top
 Tymur Faradzhev
 Uccen Marzuq
+Umegbewe
 Varghese Thomas
 Victor Bychek
+Victor Davila
+Victor Ibragimov
 Vimal Raghubir
 Vitaliy Krutko
 Weihang Lo
@@ -198,29 +238,42 @@ YFdyh000
 Yassine Aït-El-Mouden
 Yongmin H
 You-Wen Liang (Mark)
+Zhenya Tikhonov
+ZiriSut
 aaaaalbert
+abtin
+ada_okeke60
 aefgh39622
 alamanda
 albertdcastro
 alex_mayorga
+ali.malek.71
 ariestiyansyah
 avelper
+biobell2000
+bulut
 chilledfrogs
 clouserw-mozilla-owner
+dependabot[bot]
 dgadelha
 dskmori
 ehuggett
+elenatambriz
 eljuno
 emily-hou1
 erdem cobanoglu
+fcortess
 gautamkrishnar
 gmontagu
 goofy
 hello
 hi
 ivan.pompa
+jackyzy823
 jesferman1993
 jlG
+jnunezf96
+johngruen
 josotrix
 jspam
 julen
@@ -230,12 +283,15 @@ kumincir
 leo.toneff
 m4hdi.pdroid
 mail
+manuel padilla sanchez
 manxmensch
 marigalicer
 marsf
 merianosnikos
+minvs1
 mirzet.omerovic.1992
 mujeebcpy
+okyanusoz
 p.sanroman.bengoetxea
 passionforlife
 paul.trevor
@@ -249,10 +305,12 @@ robbp
 ruikunai
 savemore99.sm
 sergio
+shamanchic2011
 shikhar-scs
 siparon
 skystar-p
 stripTM
+sugabelly
 tatalmondmush
 tiagomoraismorgado
 timvisee
@@ -261,6 +319,7 @@ xcffl
 ybouhamam
 yoshimitsu002
 yusup.ramdani
+zankomhamad
 Μιχάλης
 Марко Костић (Marko Kostić)
 Ратко Вујановић

README.md

@@ -1,7 +1,57 @@
 # [![Send](./assets/icon.svg)](https://gitlab.com/timvisee/send/) Send
 
-Based on Mozilla's [Firefox Send](https://github.com/mozilla/send),
-with branding removed.
+[![Build status on GitLab CI][gitlab-ci-master-badge]][gitlab-ci-link]
+[![Latest release][release-badge]][release-link]
+[![Docker image][docker-image-badge]][docker-image-link]
+[![Project license][repo-license-badge]](LICENSE)
+
+[docker-image-badge]: https://img.shields.io/badge/docker-latest-blue.svg
+[docker-image-link]: https://gitlab.com/timvisee/send/container_registry/eyJuYW1lIjoidGltdmlzZWUvc2VuZCIsInRhZ3NfcGF0aCI6Ii90aW12aXNlZS9zZW5kL3JlZ2lzdHJ5L3JlcG9zaXRvcnkvMTQxODUwNC90YWdzP2Zvcm1hdD1qc29uIiwiaWQiOjE0MTg1MDQsImNsZWFudXBfcG9saWN5X3N0YXJ0ZWRfYXQiOm51bGx9
+[gitlab-ci-link]: https://gitlab.com/timvisee/send/pipelines
+[gitlab-ci-master-badge]: https://gitlab.com/timvisee/send/badges/master/pipeline.svg
+[release-badge]: https://img.shields.io/github/v/tag/timvisee/send
+[release-link]: https://gitlab.com/timvisee/send/-/tags
+[repo-license-badge]: https://img.shields.io/github/license/timvisee/send.svg
+
+A fork of Mozilla's [Firefox Send][mozilla-send].
+Mozilla discontinued Send, this fork is a community effort to keep the project
+up-to-date and alive.
+
+- Forked [at][fork-commit] Mozilla's last publicly hosted version
+- _Mozilla_ & _Firefox_ branding [is][remove-branding-pr] removed so you can legally self-host
+- Kept compatible with [`ffsend`][ffsend] (CLI for Send)
+- Dependencies have been updated
+- Mozilla's [changes][mozilla-patches] since the fork have been selectively [merged][mozilla-patches-pr]
+- Mozilla's experimental report feature, download tokens, trust warnings and FxA changes are not included
+
+Find an up-to-date Docker image here: [docs/docker.md](docs/docker.md)
+
+The original project by Mozilla can be found [here][mozilla-send].
+The [`mozilla-master`][branch-mozilla-master] branch holds the `master` branch
+as left by Mozilla.
+The [`send-v3`][branch-send-v3] branch holds the commit tree of Mozilla's last
+publicly hosted version, which this fork is based on.
+The [`send-v4`][branch-send-v4] branch holds the commit tree of Mozilla's last
+experimental version which was still a work in progress (featuring file
+reporting, download tokens, trust warnings and FxA changes), this has
+selectively been merged into this fork.
+Please consider to [donate][donate] to allow me to keep working on this.
+
+Thanks [Mozilla][mozilla] for building this amazing tool!
+
+[branch-mozilla-master]: https://gitlab.com/timvisee/send/-/tree/mozilla-master
+[branch-send-v3]: https://gitlab.com/timvisee/send/-/tree/send-v3
+[branch-send-v4]: https://gitlab.com/timvisee/send/-/tree/send-v4
+[donate]: https://timvisee.com/donate
+[ffsend]: https://github.com/timvisee/ffsend
+[fork-commit]: https://gitlab.com/timvisee/send/-/commit/3e9be676413a6e1baaf6a354c180e91899d10bec
+[mozilla-patches-pr]: https://gitlab.com/timvisee/send/-/merge_requests/3
+[mozilla-patches]: https://gitlab.com/timvisee/send/-/compare/3e9be676413a6e1baaf6a354c180e91899d10bec...mozilla-master
+[mozilla-send]: https://github.com/mozilla/send
+[mozilla]: https://mozilla.org/
+[remove-branding-pr]: https://gitlab.com/timvisee/send/-/merge_requests/2
+
+---
 
 **Docs:** [FAQ](docs/faq.md), [Encryption](docs/encryption.md), [Build](docs/build.md), [Docker](docs/docker.md), [Metrics](docs/metrics.md), [More](docs/)
 
@@ -109,4 +159,6 @@ The android implementation is contained in the `android` directory, and can be v
 
 [Mozilla Public License Version 2.0](LICENSE)
 
+[qrcode.js](https://github.com/kazuhikoarase/qrcode-generator) licensed under MIT
+
 ---

app/controller.js

@@ -1,13 +1,14 @@
-import FileSender from './fileSender';
-import FileReceiver from './fileReceiver';
-import { copyToClipboard, delay, openLinksInNewTab, percent } from './utils';
 import * as metrics from './metrics';
-import { bytes, locale } from './utils';
-import okDialog from './ui/okDialog';
+import FileReceiver from './fileReceiver';
+import FileSender from './fileSender';
 import copyDialog from './ui/copyDialog';
+import faviconProgressbar from './ui/faviconProgressbar';
+import okDialog from './ui/okDialog';
 import shareDialog from './ui/shareDialog';
 import signupDialog from './ui/signupDialog';
 import surveyDialog from './ui/surveyDialog';
+import { bytes, locale } from './utils';
+import { copyToClipboard, delay, openLinksInNewTab, percent } from './utils';
 
 export default function(state, emitter) {
   let lastRender = 0;
@@ -29,6 +30,7 @@ export default function(state, emitter) {
     if (updateTitle) {
       emitter.emit('DOMTitleChange', percent(state.transfer.progressRatio));
     }
+    faviconProgressbar.updateFavicon(state.transfer.progressRatio);
     render();
   }
 
@@ -37,6 +39,7 @@ export default function(state, emitter) {
     document.addEventListener('focus', () => {
       updateTitle = false;
       emitter.emit('DOMTitleChange', 'Send');
+      faviconProgressbar.updateFavicon(0);
     });
     checkFiles();
   });
@@ -83,6 +86,7 @@ export default function(state, emitter) {
 
   emitter.on('cancel', () => {
     state.transfer.cancel();
+    faviconProgressbar.updateFavicon(0);
   });
 
   emitter.on('addFiles', async ({ files }) => {
@@ -161,6 +165,7 @@ export default function(state, emitter) {
       state.storage.totalUploads += 1;
       const duration = Date.now() - start;
       metrics.completedUpload(archive, duration);
+      faviconProgressbar.updateFavicon(0);
 
       state.storage.addFile(ownedFile);
       // TODO integrate password into /upload request
@@ -264,6 +269,7 @@ export default function(state, emitter) {
         duration,
         password_protected: file.requiresPassword
       });
+      faviconProgressbar.updateFavicon(0);
     } catch (err) {
       if (err.message === '0') {
         // download cancelled

app/ui/archiveTile.js

@@ -48,6 +48,7 @@ function password(state) {
           ${state.translate('addPassword')}
         </label>
       </div>
+      <div class="relative inline-block my-1">
         <input
           id="password-input"
           class="${state.archive.password
@@ -61,6 +62,22 @@ function password(state) {
           placeholder="${state.translate('unlockInputPlaceholder')}"
           value="${state.archive.password || ''}"
         />
+        <button
+          id="password-preview-button"
+          type="button"
+          class="${state.archive.password
+            ? ''
+            : 'invisible'} absolute top-0 right-0 w-8 h-8"
+          onclick="${onPasswordPreviewButtonclicked}"
+        >
+          <img
+            src="${assets.get('eye.svg')}"
+            width="22"
+            height="22"
+            class="m-auto mt-2"
+          />
+        </button>
+      </div>
       <label
         id="password-msg"
         for="password-input"
@@ -69,15 +86,36 @@ function password(state) {
     </div>
   `;
 
+  function onPasswordPreviewButtonclicked(event) {
+    event.preventDefault();
+    const input = document.getElementById('password-input');
+    const eyeIcon = event.currentTarget.querySelector('img');
+
+    if (input.type === 'password') {
+      input.type = 'text';
+      eyeIcon.src = assets.get('eye-off.svg');
+    } else {
+      input.type = 'password';
+      eyeIcon.src = assets.get('eye.svg');
+    }
+
+    input.focus();
+  }
+
   function togglePasswordInput(event) {
     event.stopPropagation();
     const checked = event.target.checked;
     const input = document.getElementById('password-input');
+    const passwordPreviewButton = document.getElementById(
+      'password-preview-button'
+    );
     if (checked) {
       input.classList.remove('invisible');
+      passwordPreviewButton.classList.remove('invisible');
       input.focus();
     } else {
       input.classList.add('invisible');
+      passwordPreviewButton.classList.add('invisible');
       input.value = '';
       document.getElementById('password-msg').textContent = '';
       state.archive.password = null;

app/ui/copyDialog.js

@@ -1,5 +1,6 @@
 const html = require('choo/html');
 const { copyToClipboard } = require('../utils');
+const qr = require('./qr');
 
 module.exports = function(name, url) {
   const dialog = function(state, emit, close) {
@@ -16,13 +17,23 @@ module.exports = function(name, url) {
           ${state.translate('copyLinkDescription')} <br />
           ${name}
         </p>
+        <div class="flex flex-row items-center justify-center w-full">
           <input
             type="text"
             id="share-url"
-          class="w-full my-4 border rounded-lg leading-loose h-12 px-2 py-1 dark:bg-grey-80"
+            class="block w-full my-4 border rounded-lg leading-loose h-12 px-2 py-1 dark:bg-grey-80"
             value="${url}"
             readonly="true"
           />
+          <button
+            id="qr-btn"
+            class="w-16 m-1 p-1"
+            onclick="${toggleQR}"
+            title="QR code"
+          >
+            ${qr(url)}
+          </button>
+        </div>
         <button
           class="btn rounded-lg w-full flex-shrink-0 focus:outline"
           onclick="${copy}"
@@ -40,6 +51,19 @@ module.exports = function(name, url) {
       </send-copy-dialog>
     `;
 
+    function toggleQR(event) {
+      event.stopPropagation();
+      const shareUrl = document.getElementById('share-url');
+      const qrBtn = document.getElementById('qr-btn');
+      if (shareUrl.classList.contains('hidden')) {
+        shareUrl.classList.replace('hidden', 'block');
+        qrBtn.classList.replace('w-48', 'w-16');
+      } else {
+        shareUrl.classList.replace('block', 'hidden');
+        qrBtn.classList.replace('w-16', 'w-48');
+      }
+    }
+
     function copy(event) {
       event.stopPropagation();
       copyToClipboard(url);

app/ui/faviconProgressbar.js

@@ -0,0 +1,41 @@
+const { platform } = require('../utils');
+const assets = require('../../common/assets');
+
+const size = 32;
+const loaderWidth = 5;
+const loaderColor = '#0090ed';
+
+function drawCircle(canvas, context, color, lineWidth, outerWidth, percent) {
+  canvas.width = canvas.height = outerWidth;
+  context.translate(outerWidth * 0.5, outerWidth * 0.5);
+  context.rotate(-Math.PI * 0.5);
+  const radius = (outerWidth - lineWidth) * 0.5;
+  context.beginPath();
+  context.arc(0, 0, radius, 0, Math.PI * 2 * percent, false);
+  context.strokeStyle = color;
+  context.lineCap = 'square';
+  context.lineWidth = lineWidth;
+  context.stroke();
+}
+
+function drawNewFavicon(progressRatio) {
+  const canvas = document.createElement('canvas');
+  const context = canvas.getContext('2d');
+  drawCircle(canvas, context, '#efefef', loaderWidth, size, 1);
+  drawCircle(canvas, context, loaderColor, loaderWidth, size, progressRatio);
+  return canvas.toDataURL();
+}
+
+module.exports.updateFavicon = function(progressRatio) {
+  if (platform() === 'web') {
+    const link = document.querySelector("link[rel='icon'][sizes='32x32']");
+    const progress = progressRatio * 100;
+    if (progress === 0 || progress === 100) {
+      link.type = 'image/png';
+      link.href = assets.get('favicon-32x32.png');
+      return;
+    }
+
+    link.href = drawNewFavicon(progressRatio);
+  }
+};

app/ui/qr.js

@@ -0,0 +1,10 @@
+const raw = require('choo/html/raw');
+const qrcode = require('../qrcode');
+
+module.exports = function(url) {
+  const gen = qrcode(5, 'L');
+  gen.addData(url);
+  gen.make();
+  const qr = gen.createSvgTag({ scalable: true });
+  return raw(qr);
+};

assets/eye-off.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path fill="#8795a1" d="M256.1 144.8c56.2 0 101.9 45.3 101.9 101.1 0 13.1-2.6 25.5-7.3 37l59.5 59c30.8-25.5 55-58.4 69.9-96-35.3-88.7-122.3-151.6-224.2-151.6-28.5 0-55.8 5.1-81.1 14.1l44 43.7c11.6-4.6 24.1-7.3 37.3-7.3zM52.4 89.7l46.5 46.1 9.4 9.3c-33.9 26-60.4 60.8-76.3 100.8 35.2 88.7 122.2 151.6 224.1 151.6 31.6 0 61.7-6.1 89.2-17l8.6 8.5 59.7 59 25.9-25.7L78.2 64 52.4 89.7zM165 201.4l31.6 31.3c-1 4.2-1.6 8.7-1.6 13.1 0 33.5 27.3 60.6 61.1 60.6 4.5 0 9-.6 13.2-1.6l31.6 31.3c-13.6 6.7-28.7 10.7-44.8 10.7-56.2 0-101.9-45.3-101.9-101.1 0-15.8 4.1-30.7 10.8-44.3zm87.8-15.7l64.2 63.7.4-3.2c0-33.5-27.3-60.6-61.1-60.6l-3.5.1z"/></svg>

assets/eye.svg

@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 512 512"><path fill="#8795a1" d="M256 105c-101.8 0-188.4 62.4-224 151 35.6 88.6 122.2 151 224 151s188.4-62.4 224-151c-35.6-88.6-122.2-151-224-151zm0 251.7c-56 0-101.8-45.3-101.8-100.7S200 155.3 256 155.3 357.8 200.6 357.8 256 312 356.7 256 356.7zm0-161.1c-33.6 0-61.1 27.2-61.1 60.4s27.5 60.4 61.1 60.4 61.1-27.2 61.1-60.4-27.5-60.4-61.1-60.4z"/></svg>

docs/CODEOWNERS

@@ -1,2 +1,2 @@
-# flod as main contact for string changes
-public/locales/en-US/*.ftl @flodolo
+# timvisee as main contact for string changes
+public/locales/en-US/*.ftl @timvisee

docs/encryption.md

@@ -1,6 +1,6 @@
 # File Encryption
 
-Send use 128-bit AES-GCM encryption via the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API) to encrypt files in the browser before uploading them to the server. The code is in [app/keychain.js](../app/keychain.js).
+Send uses 128-bit AES-GCM encryption via the [Web Crypto API](https://developer.mozilla.org/en-US/docs/Web/API/Web_Crypto_API) to encrypt files in the browser before uploading them to the server. The code is in [app/keychain.js](../app/keychain.js).
 
 ## Steps
 

package.json

@@ -1,7 +1,7 @@
 {
   "name": "send",
   "description": "File Sharing Experiment",
-  "version": "3.2.0",
+  "version": "3.3.2",
   "author": "Mozilla (https://mozilla.org)",
   "contributors": [
     "Tim Visee <3a4fb3964f@sinenomine.email> (https://timvisee.com)"
@@ -64,28 +64,28 @@
     "node": "^12.16.3"
   },
   "devDependencies": {
-    "@babel/core": "^7.12.1",
+    "@babel/core": "^7.12.3",
     "@babel/plugin-proposal-class-properties": "^7.12.1",
     "@babel/plugin-syntax-dynamic-import": "^7.2.0",
     "@babel/preset-env": "^7.12.1",
     "@dannycoates/webcrypto-liner": "^0.1.37",
     "@fullhuman/postcss-purgecss": "^1.3.0",
     "@mattiasbuelens/web-streams-polyfill": "0.2.1",
-    "@sentry/browser": "^5.26.0",
+    "@sentry/browser": "^5.27.4",
     "asmcrypto.js": "^0.22.0",
-    "babel-loader": "^8.0.6",
+    "babel-loader": "^8.2.1",
     "babel-plugin-istanbul": "^5.2.0",
-    "base64-js": "^1.3.1",
+    "base64-js": "^1.5.1",
     "content-disposition": "^0.5.3",
     "copy-webpack-plugin": "^5.1.2",
-    "core-js": "^3.4.0",
+    "core-js": "^3.7.0",
     "crc": "^3.8.0",
     "cross-env": "^6.0.3",
     "css-loader": "^3.6.0",
     "css-mqpacker": "^7.0.0",
     "cssnano": "^4.1.10",
     "eslint": "^6.6.0",
-    "eslint-config-prettier": "^6.12.0",
+    "eslint-config-prettier": "^6.15.0",
     "eslint-plugin-mocha": "^6.2.1",
     "eslint-plugin-node": "^10.0.0",
     "eslint-plugin-security": "^1.4.0",
@@ -118,12 +118,12 @@
     "script-loader": "^0.7.2",
     "sinon": "^7.5.0",
     "string-hash": "^1.1.3",
-    "stylelint": "^11.1.1",
+    "stylelint": "^13.7.2",
     "stylelint-config-standard": "^19.0.0",
-    "stylelint-no-unsupported-browser-features": "^3.0.2",
+    "stylelint-no-unsupported-browser-features": "^4.1.4",
     "svgo": "^1.3.2",
     "svgo-loader": "^2.2.1",
-    "tailwindcss": "^1.9.2",
+    "tailwindcss": "^1.9.6",
     "val-loader": "^1.1.1",
     "webpack": "4.38.0",
     "webpack-cli": "^3.3.12",
@@ -136,9 +136,9 @@
     "@dannycoates/express-ws": "^5.0.3",
     "@fluent/bundle": "^0.13.0",
     "@fluent/langneg": "^0.3.0",
-    "@google-cloud/storage": "^5.1.2",
-    "@sentry/node": "^5.26.0",
-    "aws-sdk": "^2.772.0",
+    "@google-cloud/storage": "^5.5.0",
+    "@sentry/node": "^5.27.4",
+    "aws-sdk": "^2.792.0",
     "body-parser": "^1.19.0",
     "choo": "^7.0.0",
     "cldr-core": "^35.1.0",

server/routes/index.js

@@ -36,19 +36,10 @@ module.exports = function(app) {
         defaultSrc: ["'self'"],
         connectSrc: [
           "'self'",
-          'wss://*.dev.lcip.org',
-          'wss://*.send.nonprod.cloudops.mozgcp.net',
           config.base_url.replace(/^https:\/\//, 'wss://'),
-          'https://*.dev.lcip.org',
-          'https://accounts.firefox.com',
-          'https://*.accounts.firefox.com',
-          'https://sentry.prod.mozaws.net'
         ],
         imgSrc: [
           "'self'",
-          'https://*.dev.lcip.org',
-          'https://firefoxusercontent.com',
-          'https://secure.gravatar.com'
         ],
         scriptSrc: [
           "'self'",
@@ -66,18 +57,6 @@ module.exports = function(app) {
     csp.directives.connectSrc.push(
       config.base_url.replace(/^https:\/\//, 'wss://')
     );
-    if (config.fxa_csp_oauth_url != '') {
-      csp.directives.connectSrc.push(config.fxa_csp_oauth_url);
-    }
-    if (config.fxa_csp_content_url != '') {
-      csp.directives.connectSrc.push(config.fxa_csp_content_url);
-    }
-    if (config.fxa_csp_profile_url != '') {
-      csp.directives.connectSrc.push(config.fxa_csp_profile_url);
-    }
-    if (config.fxa_csp_profileimage_url != '') {
-      csp.directives.imgSrc.push(config.fxa_csp_profileimage_url);
-    }
 
     app.use(helmet.contentSecurityPolicy(csp));
   }