4 files changed, 23 insertions, 11 deletions
diff --git a/perllib/FixMyStreet/App.pm b/perllib/FixMyStreet/App.pm
index 42556d1df..f62deae3a 100644
--- a/perllib/FixMyStreet/App.pm
+++ b/perllib/FixMyStreet/App.pm
@@ -199,7 +199,7 @@ sub setup_request {
     my $cobrand = $c->cobrand;
     FixMyStreet::DB->schema->cobrand($cobrand);
 
-    $cobrand->call_hook('add_response_headers');
+    $cobrand->add_response_headers;
 
     # append the cobrand templates to the include path
     $c->stash->{additional_template_paths} = $cobrand->path_to_web_templates;
diff --git a/perllib/FixMyStreet/Cobrand/Default.pm b/perllib/FixMyStreet/Cobrand/Default.pm
index 620183078..1f2e48994 100644
--- a/perllib/FixMyStreet/Cobrand/Default.pm
+++ b/perllib/FixMyStreet/Cobrand/Default.pm
@@ -14,6 +14,7 @@ use Digest::MD5 qw(md5_hex);
 
 use Carp;
 use mySociety::PostcodeUtil;
+use mySociety::Random;
 
 =head1 The default cobrand
 
@@ -74,6 +75,22 @@ sub feature {
     return $features->{$feature}->{$self->moniker};
 }
 
+sub csp_config {
+    FixMyStreet->config('CONTENT_SECURITY_POLICY');
+}
+
+sub add_response_headers {
+    my $self = shift;
+    # uncoverable branch true
+    return if $self->{c}->debug;
+    if (my $csp_domains = $self->csp_config) {
+        $csp_domains = '' if $csp_domains eq '1';
+        $csp_domains = join(' ', @$csp_domains) if ref $csp_domains;
+        my $csp_nonce = $self->{c}->stash->{csp_nonce} = unpack('h*', mySociety::Random::random_bytes(16, 1));
+        $self->{c}->res->header('Content-Security-Policy', "script-src 'self' 'unsafe-inline' 'nonce-$csp_nonce' $csp_domains; object-src 'none'; base-uri 'none'")
+    }
+}
+
 =item password_minimum_length
 
 Returns the minimum length a password can be set to.
diff --git a/perllib/FixMyStreet/Cobrand/FixMyStreet.pm b/perllib/FixMyStreet/Cobrand/FixMyStreet.pm
index 8ef51f328..0d2bf3663 100644
--- a/perllib/FixMyStreet/Cobrand/FixMyStreet.pm
+++ b/perllib/FixMyStreet/Cobrand/FixMyStreet.pm
@@ -4,8 +4,6 @@ use base 'FixMyStreet::Cobrand::UK';
 use strict;
 use warnings;
 
-use mySociety::Random;
-
 use constant COUNCIL_ID_BROMLEY => 2482;
 use constant COUNCIL_ID_ISLEOFWIGHT => 2636;
 
@@ -25,14 +23,6 @@ sub path_to_email_templates {
     ];
 }
 
-sub add_response_headers {
-    my $self = shift;
-    # uncoverable branch true
-    return if $self->{c}->debug;
-    my $csp_nonce = $self->{c}->stash->{csp_nonce} = unpack('h*', mySociety::Random::random_bytes(16, 1));
-    $self->{c}->res->header('Content-Security-Policy', "script-src 'self' www.google-analytics.com www.googleadservices.com 'unsafe-inline' 'nonce-$csp_nonce'")
-}
-
 # FixMyStreet should return all cobrands
 sub restriction {
     return {};
diff --git a/perllib/FixMyStreet/Cobrand/UK.pm b/perllib/FixMyStreet/Cobrand/UK.pm
index 18bf01476..83df590db 100644
--- a/perllib/FixMyStreet/Cobrand/UK.pm
+++ b/perllib/FixMyStreet/Cobrand/UK.pm
@@ -11,6 +11,11 @@ sub country             { return 'GB'; }
 sub area_types          { [ 'DIS', 'LBO', 'MTD', 'UTA', 'CTY', 'COI', 'LGD' ] }
 sub area_types_children { $mySociety::VotingArea::council_child_types }
 
+sub csp_config {
+    my $self = shift;
+    return $self->feature('content_security_policy');
+}
+
 sub enter_postcode_text {
     my ( $self ) = @_;
     return _("Enter a nearby UK postcode, or street name and area");