From f8cc658c54e8291d49153b88d58af9b1ef085a1a Mon Sep 17 00:00:00 2001
From: Wyatt Johnson <wyattjoh@gmail.com>
Date: Thu, 24 May 2018 14:34:13 -0600
Subject: [PATCH] csp fixes

---
 routes/api/v1/csp.js | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/routes/api/v1/csp.js b/routes/api/v1/csp.js
index ad1101987..5d7005b4e 100644
--- a/routes/api/v1/csp.js
+++ b/routes/api/v1/csp.js
@@ -4,13 +4,18 @@ const { logger } = require('../../../services/logging');
 const router = express.Router();
 
 const schema = Joi.object().keys({
-  'csp-report': Joi.object().keys({
-    'document-uri': Joi.string(),
-    referrer: Joi.string(),
-    'blocked-uri': Joi.string(),
-    'violated-directive': Joi.string(),
-    'original-policy': Joi.string(),
-  }),
+  'csp-report': Joi.object()
+    .keys({
+      'document-uri': Joi.string(),
+      referrer: Joi.string().allow(''),
+      'blocked-uri': Joi.string(),
+      'violated-directive': Joi.string(),
+      'original-policy': Joi.string(),
+      'script-sample': Joi.string()
+        .allow('')
+        .optional(),
+    })
+    .optionalKeys('referrer', 'script-sample'),
 });
 
 const json = express.json({ type: 'application/csp-report' });
@@ -18,7 +23,7 @@ const json = express.json({ type: 'application/csp-report' });
 router.post('/', json, async (req, res, next) => {
   const { value, error: err } = Joi.validate(req.body, schema, {
     stripUnknown: true,
-    presence: 'required',
+    presence: 'optional',
   });
   if (err) {
     res.status(400).end();