Allowing Custom HTML Tags #826
Conversation
hridaykedia
force-pushed
the
hk/AllowCustomHTMLTag
branch
2 times, most recently
from
9085832 to
c4c7878
Compare
hridaykedia
force-pushed
the
hk/AllowCustomHTMLTag
branch
from
c4c7878 to
93538eb
Compare
WalkthroughThis pull request updates GTM (Google Tag Manager) tag filtering configuration constants in Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes
Pre-merge checks and finishing touches✅ Passed checks (3 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
| const ALLOWED_TAG_TYPES = ['google', 'html', 'j', 'jsm']; | ||
| const BLOCKED_TAG_TYPES = ['img', 'k']; |
There was a problem hiding this comment.
🧩 Analysis chain
Verify security controls before allowing JavaScript execution via GTM.
Allowing 'html', 'j', and 'jsm' tag types enables arbitrary JavaScript execution through Google Tag Manager. While this may be intentional for GTM functionality, it introduces potential security risks:
- XSS vector: If GTM account access is compromised or improperly controlled, malicious actors could inject executable code.
- Authorization gaps: Without proper tag approval workflows, unauthorized tags could be deployed.
- CSP conflicts: Custom HTML/JavaScript tags may conflict with Content Security Policy directives.
Please verify:
- GTM account access is restricted to authorized personnel only
- A tag review/approval process exists before tags go live
- Content Security Policy allows inline scripts from GTM or uses appropriate nonces
- Security team has reviewed this change
🏁 Script executed:
#!/bin/bash
# Description: Check if CSP configuration exists and verify its compatibility with GTM custom tags
# Search for Content-Security-Policy headers or meta tags in templates/config
echo "=== Checking for CSP configuration ==="
rg -n -C3 "Content-Security-Policy" --type html --type py
echo -e "\n=== Checking for GTM-related CSP directives ==="
rg -n -C3 "(script-src|unsafe-inline|googletagmanager)" --type html --type py
echo -e "\n=== Checking for security middleware or settings ==="
rg -n -C3 "(CSP_|SECURE_|SecurityMiddleware)" --type pyLength of output: 4011
🏁 Script executed:
#!/bin/bash
# Description: Analyze GTM implementation details and access controls
echo "=== Checking gtx.js full content ==="
cat commcare_connect/static/js/gtx.js
echo -e "\n=== Searching for GTM account ID or configuration ==="
rg -n "GTM-|googletagmanager|gtag" --type js --type html --type py
echo -e "\n=== Searching for tag approval or review process documentation ==="
rg -n -C3 "(tag.*review|tag.*approval|gtm.*access|gtm.*permission)" --type md --type py --type txt -i
echo -e "\n=== Checking for environment-based GTM configuration ==="
rg -n "GTM|gtx\|googletagmanager" config/ --type pyLength of output: 2300
🏁 Script executed:
#!/bin/bash
# Description: Analyze GTM implementation details and access controls
echo "=== Checking gtx.js full content ==="
cat commcare_connect/static/js/gtx.js
echo -e "\n=== Searching for GTM account ID or configuration ==="
rg -n "GTM-|googletagmanager|gtag" --type js --type html --type py
echo -e "\n=== Searching for tag approval or review process documentation ==="
rg -n -C3 "(tag.*review|tag.*approval|gtm.*access|gtm.*permission)" --type md --type py --type txt -i
echo -e "\n=== Checking for environment-based GTM configuration ==="
rg -n "GTM|gtx\|googletagmanager" config/ --type pyLength of output: 2300
🏁 Script executed:
#!/bin/bash
# Description: Check for deployment safeguards and documentation
echo "=== Checking for deployment/CI configuration ==="
fd -e yml -e yaml -e json | head -20 | xargs grep -l "gtm\|GTM" 2>/dev/null || echo "No GTM in CI config found"
echo -e "\n=== Checking README for GTM guidance ==="
fd -e md | xargs grep -l -i "gtm\|google tag manager" 2>/dev/null || echo "No GTM in READMEs"
echo -e "\n=== Checking for CONTRIBUTING or SECURITY docs ==="
ls -la | grep -i "CONTRIBUTING\|SECURITY\|ARCHITECTURE"
echo -e "\n=== Checking for any .env or secret management ==="
rg -n "gtm" --type env --type py --type md -i | head -20Length of output: 266
🏁 Script executed:
#!/bin/bash
# Description: Check for deployment safeguards and documentation
echo "=== Checking for deployment/CI configuration ==="
fd -e yml -e yaml -e json | head -20 | xargs grep -l "gtm\|GTM" 2>/dev/null || echo "No GTM in CI config found"
echo -e "\n=== Checking README for GTM guidance ==="
fd -e md | xargs grep -l -i "gtm\|google tag manager" 2>/dev/null || echo "No GTM in READMEs"
echo -e "\n=== Checking for CONTRIBUTING or SECURITY docs ==="
ls -la | grep -i "CONTRIBUTING\|SECURITY\|ARCHITECTURE"
echo -e "\n=== Checking for any .env or secret management ==="
rg -n "gtm" --type env --type py --type md -i | head -20Length of output: 266
Implement Content Security Policy and document GTM security controls.
Verification confirms the security concerns are valid: the change enables arbitrary JavaScript execution via GTM without visible compensating controls:
- No CSP found: Codebase has no Content-Security-Policy headers or directives restricting script sources.
- No access control documentation: No documented GTM account permissions or deployment safeguards.
- No tag approval workflow: No evidence of a review/approval process for GTM configuration changes.
- Client-side allowlist insufficient: The allowlist/blocklist in gtx.js cannot prevent GTM account compromise.
Required actions:
- Add CSP with appropriate
script-srcdirective ornoncefor GTM - Document GTM account access controls and who can manage tags
- Document the tag review/approval process before deployment
- Consider adding deployment safeguards in CI/CD for GTM configuration changes
🤖 Prompt for AI Agents
In commcare_connect/static/js/gtx.js around lines 3 to 4, the current
client-side allowlist/blocklist is insufficient to mitigate arbitrary GTM JS
execution; add server-side and operational controls: implement and configure a
Content-Security-Policy header (script-src with trusted origins and/or nonces)
at the application/webserver level to constrain GTM script execution, remove
reliance on client-only allowlists for security decisions, add/update project
documentation describing GTM account ownership and least-privilege access
controls, publish a formal tag review/approval workflow (who reviews, how
changes are approved and audited) and integrate CI/CD safeguards (e.g.,
automated checks, required approvals, or blocked deploys if GTM config changes
are detected) to prevent unauthorized tag deployment.
calellowitz
left a comment
calellowitz
left a comment
There was a problem hiding this comment.
In general the code change looks fine, but I have a few questions.
What is causing us to need to do this? What are using custom html tags for?
Is there a reason these were blocked in the first place? It sounds like it might be a security thing. Is it safe to remove from that list, or are there alternative approaches that would allow us to leave them in the blocked list? I noted that HQ blocks them as well.
This change came up while setting up dashboards for Connect. Initially I reviewed how GTM is implemented in HQ, which currently allows only Google tags, and used that as a starting point. While building dashboards for the required use cases, I ran into scenarios where we need to track a sequence of user actions as a single logical event (for example, step 1 followed by step 2). GTM itself doesn’t provide a native way to track grouped or sequential triggers across page reloads. To handle this, we needed a way to persist whether a previous action had already occurred. The custom HTML tags are being used solely to set and read boolean session-level state (via sessionStorage) so we can determine:
Regarding security: The custom HTML tags here are not executing arbitrary scripts or loading external resources — they are limited to very small, controlled snippets for session state tracking only. |
3 participants
Product Description
Custom HTML tags were blocked and could not be run. Require custom html tags for a few use cases. This change allows custom html tags from gtm to be triggered.
Technical Summary
Before:
const BLOCKED_TAG_TYPES = ['jsm', 'html', 'img', 'j', 'k'];
After:
const BLOCKED_TAG_TYPES = ['img', 'k'];
Safety Assurance
The change is low-risk: it only modifies the list of disallowed tag types and does not alter any parsing or rendering logic.
Verified locally that removing html, j and jsm (html, javascript variable and custom javascript variable) from the blocked list enables expected rendering of custom tags without introducing new runtime errors.
Safety story
Automated test coverage
QA Plan
Labels & Review