Use recaptcha.net instead of google.com (#13295)

Author: di

tests/unit/test_recaptcha.py

@@ -241,10 +241,10 @@ def test_csp_policy(self):
         serv = recaptcha.Service(request)
         assert serv.csp_policy == {
             "script-src": [
-                "{request.scheme}://www.google.com/recaptcha/",
+                "{request.scheme}://www.recaptcha.net/recaptcha/",
                 "{request.scheme}://www.gstatic.com/recaptcha/",
             ],
-            "frame-src": ["{request.scheme}://www.google.com/recaptcha/"],
+            "frame-src": ["{request.scheme}://www.recaptcha.net/recaptcha/"],
             "style-src": ["'unsafe-inline'"],
         }
 

warehouse/recaptcha.py

@@ -66,11 +66,11 @@ def csp_policy(self):
         # be dynamic.
         return {
             "script-src": [
-                "{request.scheme}://www.google.com/recaptcha/",
+                "{request.scheme}://www.recaptcha.net/recaptcha/",
                 "{request.scheme}://www.gstatic.com/recaptcha/",
             ],
             "frame-src": [
-                "{request.scheme}://www.google.com/recaptcha/",
+                "{request.scheme}://www.recaptcha.net/recaptcha/",
             ],
             "style-src": [
                 "'unsafe-inline'",

warehouse/templates/includes/input-recaptcha.html

@@ -26,6 +26,6 @@
 
 {% macro recaptcha_src(request) -%}
   {% if request.find_service(name="recaptcha").enabled %}
-    <script src="//www.google.com/recaptcha/api.js" async defer></script>
+    <script src="//www.recaptcha.net/recaptcha/api.js" async defer></script>
   {% endif %}
 {%- endmacro %}