UPSTREAM FIX

magento2-38991: Content Security Policy errors for regional Google Analytics hosts

Community fix magento2-38991 merged into magento/magento2 on 2024-11-12, released in 2.4.8; applies cleanly to 27 releases from 2.4.6 to 2.4.7-p10.

Fixes Content Security Policy errors for regional Google Analytics hosts edited

Pull request title: Google Analytics CSP Error https://region1.analytics.google.com
Pull request: magento/magento2#38991
Issues: #37750 human
Author: @apedicdev
Merged: 2024-11-12
Fixed in: 2.4.8
Reported on: 2.4.6-p1
Categories: —
Components: magento/module-google-gtag

Labels

Area: Analytics / Reporting
Component: GoogleAnalytics
Priority: P2
Severity: —
Reported on (labels): 2.4.6-p1

Issue

Title and steps come from the upstream issue and pull request.

Description

[Report Only] Refused to connect to 'https://region1.analytics.google.com/g/collect?v=28**** REMOVED ******' because it violates the following Content Security Policy directive: "connect-src www.google-analytics.com www.googleadservices.com analytics.google.com www.googletagmanager.com vimeo.com www.sandbox.paypal.com www.paypalobjects.com www.paypal.com pilot-payflowlink.paypal.com *.ideal-postcodes.co.uk *.doubleclick.net *.google-analytics.com 'self' 'unsafe-inline'".

Steps to reproduce

Enable Google Analytics
View Website from the EU - Inspect and view CSP console errors.

Expected result

No CSP errors

Actual result

Taken from the upstream issue.

Code match per tag

Each tag was checked with git apply --check against that tag's files. A clean match means the change applies; it is not a test result. Tags that already contain the fix are marked.

Line	Code match per tag	Tests
2.4.6	2.4.6 clean 2.4.6-p1 clean 2.4.6-p2 clean 2.4.6-p3 clean 2.4.6-p4 clean 2.4.6-p5 clean 2.4.6-p6 clean 2.4.6-p7 clean 2.4.6-p8 clean 2.4.6-p9 clean 2.4.6-p10 clean 2.4.6-p11 clean 2.4.6-p12 clean 2.4.6-p13 clean 2.4.6-p14 clean 2.4.6-p15 clean	2.4.6: no test data 2.4.6-p1: no test data 2.4.6-p2: no test data 2.4.6-p3: no test data 2.4.6-p4: no test data 2.4.6-p5: no test data 2.4.6-p6: no test data 2.4.6-p7: no test data 2.4.6-p8: no test data 2.4.6-p9: no test data 2.4.6-p10: no test data 2.4.6-p11: no test data 2.4.6-p12: no test data 2.4.6-p13: no test data 2.4.6-p14: no test data 2.4.6-p15: no test data
2.4.7	2.4.7 clean 2.4.7-p1 clean 2.4.7-p2 clean 2.4.7-p3 clean 2.4.7-p4 clean 2.4.7-p5 clean 2.4.7-p6 clean 2.4.7-p7 clean 2.4.7-p8 clean 2.4.7-p9 clean 2.4.7-p10 clean	2.4.7: no test data 2.4.7-p1: no test data 2.4.7-p2: no test data 2.4.7-p3: no test data 2.4.7-p4: no test data 2.4.7-p5: no test data 2.4.7-p6: no test data 2.4.7-p7: no test data 2.4.7-p8: no test data 2.4.7-p9: no test data 2.4.7-p10: no test data
2.4.8	2.4.8 conflictcontains the fix 2.4.8-p1 conflictcontains the fix 2.4.8-p2 conflictcontains the fix 2.4.8-p3 conflictcontains the fix 2.4.8-p4 conflictcontains the fix 2.4.8-p5 conflictcontains the fix	2.4.8: no test data 2.4.8-p1: no test data 2.4.8-p2: no test data 2.4.8-p3: no test data 2.4.8-p4: no test data 2.4.8-p5: no test data
2.4.9	2.4.9 conflictcontains the fix	2.4.9: no test data

Triage

Model @cf/cloudflare/clef. Probability this is a bug fix: 93.9%. Probability it is security relevant: 28.1%.

Show the model's answers and probabilities

Question	Answer	Probabilities	Confidence
Change kind	bugfix	bugfix 94.0%, feature 2.3%, refactor 1.3%, dependency 1.0%, docs_only 0.7%, tests_only 0.6%	86.1%
Area	frontend	frontend 44.6%, other 33.2%, framework 8.3%	22.5%
Reported version	2.4.6-p1	2.4.6-p1 58.5%, 2.4.6 3.1%, 2.4.6-p11 1.0%	33.8%
Scope	0.59 of 2	0 48.4%, 1 44.5%, 2 7.2%	15.5%
Risk	0.15 of 2	0 86.2%, 1 12.1%, 2 1.7%	63.7%
Worth backporting	1.52 of 2	2 62.5%, 1 27.0%, 0 10.4%	21.3%

Download

For cweagans/composer-patches, choose a version below and download the bundle. Copy its magento2-38991/ folder into patches/composer/, merge composer.patches.json into composer.json, then run composer install. Test files are always removed; paths are relative to each package root, using the default -p1 level.

Bundle README (what the ZIP ships)

# magento2-38991

Community fix merged upstream into magento/magento2, adapted by magento.watch.
This is not a patch published by Adobe.

Pull request: https://github.com/magento/magento2/pull/38991
Issue: https://github.com/magento/magento2/issues/37750
Author: @apedicdev
Source commit: a9ac117cf63157d59054eaf0b6328213e03f6f11
Modifications: test files and documentation removed, paths rewritten relative to each Composer package.
Licence: OSL-3.0 / AFL-3.0, as the original Magento Open Source code.
Maintainer: Łukasz Bajsarowicz (@lbajsarowicz)

Licence: Magento Open Source code under OSL-3.0 and AFL-3.0. The bundle carries the original author, source commit and the list of modifications.