From a5dc0195ba54bd8b28b3acb94a7731f7bf051728 Mon Sep 17 00:00:00 2001
From: Jelle van der Waa <jelle@archlinux.org>
Date: Sun, 11 Oct 2026 21:08:47 +0200
Subject: [PATCH] Switch to Django's builtin CSP

django-csp is still updated to newer django versions however having it
built in means we no longer have to depend an external dependency.
---
 pyproject.toml                          |  1 -
 settings.py                             | 22 ++++++++++------------
 templates/devel/clock.html              |  2 +-
 templates/devel/index.html              |  2 +-
 templates/devel/packages.html           |  2 +-
 templates/devel/tier0_mirror.html       |  2 +-
 templates/mirrors/mirror_details.html   |  2 +-
 templates/mirrors/mirrors.html          |  2 +-
 templates/mirrors/status.html           |  2 +-
 templates/mirrors/url_details.html      |  2 +-
 templates/news/add.html                 |  2 +-
 templates/packages/details.html         |  2 +-
 templates/packages/differences.html     |  2 +-
 templates/packages/groups.html          |  2 +-
 templates/packages/packages_list.html   |  2 +-
 templates/packages/signoffs.html        |  2 +-
 templates/packages/stale_relations.html |  2 +-
 templates/public/keys.html              |  2 +-
 templates/releng/release_list.html      |  2 +-
 templates/todolists/list.html           |  2 +-
 templates/todolists/view.html           |  2 +-
 templates/visualize/index.html          |  2 +-
 uv.lock                                 | 15 ---------------
 23 files changed, 30 insertions(+), 48 deletions(-)

diff --git a/pyproject.toml b/pyproject.toml
index 52057fc6f..dce253b3d 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -9,7 +9,6 @@ dependencies = [
     "bleach==6.4.0",
     "django==6.0.9",
     "django-countries==9.1.0",
-    "django-csp==4.0",
     "django-prometheus==2.5.0",
     "feedparser==6.0.14",
     "ipy==1.1",
diff --git a/settings.py b/settings.py
index 914420ce3..9dee71f25 100644
--- a/settings.py
+++ b/settings.py
@@ -2,7 +2,7 @@
 import sys
 from os import path
 
-from csp.constants import NONCE, SELF
+from django.utils.csp import CSP
 
 # Set the debug values
 DEBUG = False
@@ -56,7 +56,7 @@
     'django.middleware.clickjacking.XFrameOptionsMiddleware',
     'django.middleware.security.SecurityMiddleware',
     'django.middleware.http.ConditionalGetMiddleware',
-    'csp.middleware.CSPMiddleware',
+    'django.middleware.csp.ContentSecurityPolicyMiddleware',
 ]
 
 # Base of the URL hierarchy
@@ -97,15 +97,13 @@
 SECURE_CONTENT_TYPE_NOSNIFF = True
 
 # CSP Settings
-CONTENT_SECURITY_POLICY = {
-    "DIRECTIVES": {
-        "default-src": [SELF],
-        "script-src": [SELF, NONCE],
-        "img-src": [SELF, "data:"],
-        "base-uri": ["'none'"],
-        "form-action": [SELF],
-        "frame-ancestors": ["'none'"],
-    }
+SECURE_CSP = {
+    "default-src": [CSP.SELF],
+    "script-src": [CSP.SELF, CSP.NONCE],
+    "img-src": [CSP.SELF, "data:"],
+    "base-uri": [CSP.NONE],
+    "form-action": [CSP.SELF],
+    "frame-ancestors": [CSP.NONE],
 }
 
 # Use new test runner
@@ -252,7 +250,7 @@
                 'django.template.context_processors.request',
                 'django.template.context_processors.debug',
                 'django.contrib.messages.context_processors.messages',
-                'csp.context_processors.nonce',
+                'django.template.context_processors.csp',
                 'main.context_processors.mastodon_link',
             ],
             "loaders": [
diff --git a/templates/devel/clock.html b/templates/devel/clock.html
index 79d315011..eaa538703 100644
--- a/templates/devel/clock.html
+++ b/templates/devel/clock.html
@@ -61,7 +61,7 @@ <h2>Developer World Clocks</h2>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $("#clocks-table:has(tbody tr)").tablesorter({
         widgets: ['zebra'],
diff --git a/templates/devel/index.html b/templates/devel/index.html
index 70a7b21d2..17174ee89 100644
--- a/templates/devel/index.html
+++ b/templates/devel/index.html
@@ -178,7 +178,7 @@ <h2>Developer Stats</h2>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $("#stats-message").html('Loading developer stats…');
     $("#stats-area").load('stats/', function(response, status, xhr) {
diff --git a/templates/devel/packages.html b/templates/devel/packages.html
index e353daeba..683c734ba 100644
--- a/templates/devel/packages.html
+++ b/templates/devel/packages.html
@@ -79,7 +79,7 @@ <h3>Filter Packages</h3>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $(".results").tablesorter({widgets: ['zebra']});
 });
diff --git a/templates/devel/tier0_mirror.html b/templates/devel/tier0_mirror.html
index e4ec3fcec..9b08f14ca 100644
--- a/templates/devel/tier0_mirror.html
+++ b/templates/devel/tier0_mirror.html
@@ -23,7 +23,7 @@ <h2>Tier 0 Mirror usage information</h2>
 {% endblock %}
 
 {% block script_block %}
-<script type="text/javascript" nonce={{ CSP_NONCE }} defer>
+<script type="text/javascript" nonce={{ csp_nonce }} defer>
   const copybutton = document.getElementById('copybutton');
   copybutton.addEventListener('click', function() {
     const text = document.getElementById('serverinfo').textContent;
diff --git a/templates/mirrors/mirror_details.html b/templates/mirrors/mirror_details.html
index 36706241e..f9b85ae87 100644
--- a/templates/mirrors/mirror_details.html
+++ b/templates/mirrors/mirror_details.html
@@ -114,7 +114,7 @@ <h2>Mirror Status Charts</h2>
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}{% d3js %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
 <script type="text/javascript" src="{% static "mirror_status.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $("#available_urls:has(tbody tr)").tablesorter(
         {widgets: ['zebra'], sortList: [[1,0], [2,0]],
diff --git a/templates/mirrors/mirrors.html b/templates/mirrors/mirrors.html
index 014db0a3e..ff69ca422 100644
--- a/templates/mirrors/mirrors.html
+++ b/templates/mirrors/mirrors.html
@@ -47,7 +47,7 @@ <h2>Mirror Overview</h2>
 </div>
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $(".results").tablesorter({widgets: ['zebra'], sortList: [[2,0], [0,0]]});
 });
diff --git a/templates/mirrors/status.html b/templates/mirrors/status.html
index 152e562ca..13e63698d 100644
--- a/templates/mirrors/status.html
+++ b/templates/mirrors/status.html
@@ -77,7 +77,7 @@ <h3>Mirror Syncing Error Log</h3>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     var headers = { 4: { sorter: 'duration' }, 5: { sorter: 'mostlydigit' },
                     6: { sorter: 'mostlydigit' }, 7: { sorter: 'mostlydigit' },
diff --git a/templates/mirrors/url_details.html b/templates/mirrors/url_details.html
index ce4594454..fe211200f 100644
--- a/templates/mirrors/url_details.html
+++ b/templates/mirrors/url_details.html
@@ -64,7 +64,7 @@ <h3>Check Logs</h3>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $("#check_logs:has(tbody tr)").tablesorter(
         {widgets: ['zebra'], sortList: [[0,1]],
diff --git a/templates/news/add.html b/templates/news/add.html
index 754358e08..f968c60a1 100644
--- a/templates/news/add.html
+++ b/templates/news/add.html
@@ -43,7 +43,7 @@ <h2>News: Add Article</h2>
     <h2>News Preview: <span id="news-preview-title"></span></h2>
     <div id="news-preview-data" class="article-content"></div>
 </div>
-<script type="text/javascript" nonce={{ CSP_NONCE }} defer>
+<script type="text/javascript" nonce={{ csp_nonce }} defer>
 function onPreviewButtonClick(event) {
 	event.preventDefault();
 
diff --git a/templates/packages/details.html b/templates/packages/details.html
index 575cab34b..507e3aa37 100644
--- a/templates/packages/details.html
+++ b/templates/packages/details.html
@@ -9,7 +9,7 @@
 {% endblock %}
 
 {% block script_block %}
-<script type="text/javascript" nonce="{{ CSP_NONCE }}">
+<script type="text/javascript" nonce="{{ csp_nonce }}">
 function ajaxifyFiles() {
     filelink.addEventListener("click", function(event) {
 	event.preventDefault();
diff --git a/templates/packages/differences.html b/templates/packages/differences.html
index 0de164a33..1546db76c 100644
--- a/templates/packages/differences.html
+++ b/templates/packages/differences.html
@@ -42,7 +42,7 @@ <h2>Multilib Differences to Main Packages</h2>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $('#table_multilib_differences').tablesorter({widgets: ['zebra'], sortList: [[5, 0]]});
 });
diff --git a/templates/packages/groups.html b/templates/packages/groups.html
index e6807d793..efec6933d 100644
--- a/templates/packages/groups.html
+++ b/templates/packages/groups.html
@@ -34,7 +34,7 @@ <h2>Package Groups Overview{% if arch %} - {{ arch }}{% endif %}</h2>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $(".results").tablesorter({widgets: ['zebra'], sortList: [[1,0], [0,0]]});
 });
diff --git a/templates/packages/packages_list.html b/templates/packages/packages_list.html
index e03543971..9bdbdfb52 100644
--- a/templates/packages/packages_list.html
+++ b/templates/packages/packages_list.html
@@ -45,7 +45,7 @@ <h2>{{ list_title }} - {{ name }} ({{ arch.name }})</h2>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $(".results").tablesorter({widgets: ['zebra'], sortList: [[2,0]]});
 });
diff --git a/templates/packages/signoffs.html b/templates/packages/signoffs.html
index 278848aab..5754026ba 100644
--- a/templates/packages/signoffs.html
+++ b/templates/packages/signoffs.html
@@ -85,7 +85,7 @@ <h3>Filter Displayed Signoffs</h3>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $('.results').tablesorter({widgets: ['zebra'], sortList: [[0,0]],
         headers: { 5: { sorter: 'epochdate' }, 7: { sorter: false }, 8: {sorter: false } } });
diff --git a/templates/packages/stale_relations.html b/templates/packages/stale_relations.html
index f729c1f36..06b04b527 100644
--- a/templates/packages/stale_relations.html
+++ b/templates/packages/stale_relations.html
@@ -113,7 +113,7 @@ <h3>Maintainers with Wrong Permissions ({{ wrong_permissions|length }})</h3>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $('#inactive-user:not(:has(tbody tr.empty))').tablesorter({widgets: ['zebra'], headers: { 0: { sorter: false }, 2: { sorter: false } }, sortList: [[1,0]]});
     $('#missing-pkgbase:not(:has(tbody tr.empty))').tablesorter({widgets: ['zebra'], headers: { 0: { sorter: false } }, sortList: [[1,0]]});
diff --git a/templates/public/keys.html b/templates/public/keys.html
index a3d4a96fc..240759703 100644
--- a/templates/public/keys.html
+++ b/templates/public/keys.html
@@ -138,7 +138,7 @@ <h2 id="cross-sigs">Developer Cross-Signatures</h2>
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}{% d3js %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
 <script type="text/javascript" src="{% static "visualize.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $("#key-status").tablesorter({
         sortLocaleCompare: true,
diff --git a/templates/releng/release_list.html b/templates/releng/release_list.html
index dfe26c4ee..e7e492a25 100644
--- a/templates/releng/release_list.html
+++ b/templates/releng/release_list.html
@@ -57,7 +57,7 @@ <h2>Releases</h2>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $(".results").tablesorter({
         widgets: ['zebra'],
diff --git a/templates/todolists/list.html b/templates/todolists/list.html
index e7c1cf14c..ef43f66b4 100644
--- a/templates/todolists/list.html
+++ b/templates/todolists/list.html
@@ -56,7 +56,7 @@ <h2>Package Todo Lists</h2>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $(".results").tablesorter({widgets: ['zebra'], sortList: [[6, 1], [1, 1]]});
 });
diff --git a/templates/todolists/view.html b/templates/todolists/view.html
index 08d75adba..873213c49 100644
--- a/templates/todolists/view.html
+++ b/templates/todolists/view.html
@@ -121,7 +121,7 @@ <h3>Filter Todo List Packages</h3>
 {% block script_block %}
 {% load cdn %}{% jquery %}{% jquery_tablesorter %}
 <script type="text/javascript" src="{% static "archweb.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 $(document).ready(function() {
     $(".results").tablesorter({
         widgets: ['zebra'],
diff --git a/templates/visualize/index.html b/templates/visualize/index.html
index 50cd39384..6adbaa92b 100644
--- a/templates/visualize/index.html
+++ b/templates/visualize/index.html
@@ -28,7 +28,7 @@ <h2>Visualization of Package Data</h2>
 {% block script_block %}
 {% load cdn %}{% d3js %}
 <script type="text/javascript" src="{% static "visualize.js" %}"></script>
-<script type="text/javascript" nonce={{ CSP_NONCE }}>
+<script type="text/javascript" nonce={{ csp_nonce }}>
 document.addEventListener("DOMContentLoaded", function() {
     const orderings = {
         "repo": { url: "{% url 'visualize-byrepo' %}", color_attr: "repo" },
diff --git a/uv.lock b/uv.lock
index ac01d4458..8a78732d1 100644
--- a/uv.lock
+++ b/uv.lock
@@ -37,7 +37,6 @@ dependencies = [
     { name = "bleach" },
     { name = "django" },
     { name = "django-countries" },
-    { name = "django-csp" },
     { name = "django-ninja" },
     { name = "django-prometheus" },
     { name = "feedparser" },
@@ -82,7 +81,6 @@ requires-dist = [
     { name = "bleach", specifier = "==6.4.0" },
     { name = "django", specifier = "==6.0.9" },
     { name = "django-countries", specifier = "==9.1.0" },
-    { name = "django-csp", specifier = "==4.0" },
     { name = "django-ninja", specifier = "==1.7.1" },
     { name = "django-prometheus", specifier = "==2.5.0" },
     { name = "feedparser", specifier = "==6.0.14" },
@@ -400,19 +398,6 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9c/86/f4a3a1bc0827e19bd0ec7267d80725e4f02916d34a279747672436a0aa5b/django_countries-9.1.0-py3-none-any.whl", hash = "sha256:18c9f6e1a8e32356656b1db5ee94121310cbc3b91dc78171052a9ef9d57d5318", size = 928029, upload-time = "2026-09-10T22:24:16.325Z" },
 ]
 
-[[package]]
-name = "django-csp"
-version = "4.0"
-source = { registry = "https://pypi.org/simple" }
-dependencies = [
-    { name = "django" },
-    { name = "packaging" },
-]
-sdist = { url = "https://files.pythonhosted.org/packages/52/db/23567744dff2169aadb095f726088074476b24dfff5a759ffcf6389cf401/django_csp-4.0.tar.gz", hash = "sha256:b27010bb702eb20a3dad329178df2b61a2b82d338b70fbdc13c3a3bd28712833", size = 20028, upload-time = "2025-04-02T16:41:46.721Z" }
-wheels = [
-    { url = "https://files.pythonhosted.org/packages/e1/a4/736ab90ee527a23e194d1ce7358c6bcced66381ced83c28268b4aea236f7/django_csp-4.0-py3-none-any.whl", hash = "sha256:d5a0a05463a6b75a4f1fc1828c58c89af8db9364d09fc6e12f122b4d7f3d00dc", size = 25689, upload-time = "2025-04-02T16:41:45.689Z" },
-]
-
 [[package]]
 name = "django-debug-toolbar"
 version = "8.0.0"