add csp and only pass hostname to duo init (#3972)

* add csp and only pass hostname to duo init

* expand style-src

* Update apps/web/src/connectors/duo.html

Co-authored-by: Oscar Hinton <Hinton@users.noreply.github.com>

Co-authored-by: Oscar Hinton <Hinton@users.noreply.github.com>

apps/web/src/connectors/duo.html

@@ -6,6 +6,10 @@
       name="viewport"
       content="initial-scale=1, maximum-scale=1, user-scalable=no, width=device-width"
     />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'self'; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com;"
+    />
     <title>Bitwarden Duo Connector</title>
   </head>
 

apps/web/src/connectors/duo.ts

@@ -23,7 +23,7 @@ document.addEventListener("DOMContentLoaded", () => {
 
   DuoWebSDK.init({
     iframe: "duo_iframe",
-    host: hostParam,
+    host: hostUrl.hostname,
     sig_request: requestParam,
     submit_callback: (form: any) => {
       invokeCSCode(form.elements.sig_response.value);