chg: update CSP to work with GTM, needs additional permissions for GT…

…M preview and to enable full implementation

django_app/redbox_app/settings.py

@@ -201,19 +201,27 @@
     "https://tagmanager.google.com/",
     "https://www.googletagmanager.com/",
     "ajax.googleapis.com/",
-    "sha256-T/1K73p+yppfXXw/AfMZXDh5VRDNaoEh3enEGFmZp8M="
+    "sha256-T/1K73p+yppfXXw/AfMZXDh5VRDNaoEh3enEGFmZp8M=",
 )
 CSP_OBJECT_SRC = ("'none'",)
 CSP_TRUSTED_TYPES = ("dompurify", "default", "goog#html")
 CSP_REPORT_TO = "csp-endpoint"
-CSP_FONT_SRC = (
-    "'self'",
-    "s3.amazonaws.com",
-)
+CSP_FONT_SRC = ("'self'", "s3.amazonaws.com", "https://fonts.gstatic.com", "data:")
 CSP_INCLUDE_NONCE_IN = ("script-src",)
 CSP_STYLE_SRC = (
     "'self'",
+    "https://googletagmanager.com",
     "https://tagmanager.google.com/",
+    "https://fonts.googleapis.com",
+)
+
+CSP_IMG_SRC = (
+    "'self'",
+    "https://googletagmanager.com",
+    "https://ssl.gstatic.com",
+    "https://www.gstatic.com",
+    "https://*.google-analytics.com",
+    "https://*.googletagmanager.com",
 )
 CSP_FRAME_ANCESTORS = ("'none'",)
 
@@ -442,4 +450,4 @@ def filter_transactions(event):
 
 REDBOX_API_KEY = env.str("REDBOX_API_KEY")
 
-ENABLE_METADATA_EXTRACTION = env.str("ENABLE_METADATA_EXTRACTION")
+ENABLE_METADATA_EXTRACTION = env.str("ENABLE_METADATA_EXTRACTION")