fix: 🔒️ add gravatar.com to the content security policy

[matthieujacq]

Description

Add gravatar.com to the content security policy, so that it doesn't get blocked in production.

[vercel]

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name	Status	Preview	Comments	Updated (UTC)
docs	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Sep 27, 2023 1:45pm
quivr-strapi	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Sep 27, 2023 1:45pm
quivrapp	✅ Ready (Inspect)	Visit Preview	💬 Add feedback	Sep 27, 2023 1:45pm

[github-actions]

Risk Level 2 - /home/runner/work/quivr/quivr/frontend/next.config.js

The changes in this pull request are mostly about adding a Content Security Policy (CSP) and some changes in the configuration of the application. The risk is relatively low as it doesn't seem to modify any core functionality of the application. However, there are a few points to consider:

1. Hardcoded URLs: The URLs for various sources are hardcoded in the CSP. This could be a problem if the URLs change in the future. It would be better to store these URLs in environment variables or a separate configuration file. For example:

\"default-src\": [
  \"self\",
  process.env.FONT_GOOGLE_URL,
  process.env.NEXT_PUBLIC_SUPABASE_URL,
  process.env.API_JUNE_URL,
  process.env.QUIVR_APP_URL,
],

2. Unsafe inline scripts and styles: The CSP allows for unsafe inline scripts and styles. This could potentially open up the application to cross-site scripting (XSS) attacks. If possible, try to avoid using inline scripts and styles, or at least use nonce or hash to secure them.

3. Environment Variables: The code uses environment variables directly. It would be better to validate these variables before using them. For example, check if they exist and are in the correct format. This can prevent potential errors or security issues.

4. CSP String Generation: The CSP string is generated by joining the entries of the ContentSecurityPolicy object. This assumes that all entries are arrays. If an entry is not an array, this could cause an error. It would be safer to check the type of each entry before joining them.

---

🔒🔗🚫

---

Powered by Code Review GPT

[gozineb]

Super cool !