Skip to content

Switch to Django's builtin CSP #762

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
jelly wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Switch to Django's builtin CSP #762

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 0 additions & 1 deletion pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ dependencies = [
"bleach==6.4.0",
"django==6.0.9",
"django-countries==9.1.0",
"django-csp==4.0",
"django-prometheus==2.5.0",
"feedparser==6.0.14",
"ipy==1.1",
Expand Down
22 changes: 10 additions & 12 deletions settings.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@
import sys
from os import path

from csp.constants import NONCE, SELF
from django.utils.csp import CSP

# Set the debug values
DEBUG = False
Expand Down Expand Up @@ -56,7 +56,7 @@
'django.middleware.clickjacking.XFrameOptionsMiddleware',
'django.middleware.security.SecurityMiddleware',
'django.middleware.http.ConditionalGetMiddleware',
'csp.middleware.CSPMiddleware',
'django.middleware.csp.ContentSecurityPolicyMiddleware',
]

# Base of the URL hierarchy
Expand Down Expand Up @@ -97,15 +97,13 @@
SECURE_CONTENT_TYPE_NOSNIFF = True

# CSP Settings
CONTENT_SECURITY_POLICY = {
"DIRECTIVES": {
"default-src": [SELF],
"script-src": [SELF, NONCE],
"img-src": [SELF, "data:"],
"base-uri": ["'none'"],
"form-action": [SELF],
"frame-ancestors": ["'none'"],
}
SECURE_CSP = {
"default-src": [CSP.SELF],
"script-src": [CSP.SELF, CSP.NONCE],
"img-src": [CSP.SELF, "data:"],
"base-uri": [CSP.NONE],
"form-action": [CSP.SELF],
"frame-ancestors": [CSP.NONE],
}

# Use new test runner
Expand Down Expand Up @@ -252,7 +250,7 @@
'django.template.context_processors.request',
'django.template.context_processors.debug',
'django.contrib.messages.context_processors.messages',
'csp.context_processors.nonce',
'django.template.context_processors.csp',
'main.context_processors.mastodon_link',
],
"loaders": [
Expand Down
2 changes: 1 addition & 1 deletion templates/devel/clock.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,7 +61,7 @@ <h2>Developer World Clocks</h2>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$("#clocks-table:has(tbody tr)").tablesorter({
widgets: ['zebra'],
Expand Down
2 changes: 1 addition & 1 deletion templates/devel/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,7 +178,7 @@ <h2>Developer Stats</h2>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$("#stats-message").html('Loading developer stats…');
$("#stats-area").load('stats/', function(response, status, xhr) {
Expand Down
2 changes: 1 addition & 1 deletion templates/devel/packages.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -79,7 +79,7 @@ <h3>Filter Packages</h3>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$(".results").tablesorter({widgets: ['zebra']});
});
Expand Down
2 changes: 1 addition & 1 deletion templates/devel/tier0_mirror.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ <h2>Tier 0 Mirror usage information</h2>
{% endblock %}

{% block script_block %}
<script type="text/javascript" nonce={{ CSP_NONCE }} defer>
<script type="text/javascript" nonce={{ csp_nonce }} defer>
const copybutton = document.getElementById('copybutton');
copybutton.addEventListener('click', function() {
const text = document.getElementById('serverinfo').textContent;
Expand Down
2 changes: 1 addition & 1 deletion templates/mirrors/mirror_details.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -114,7 +114,7 @@ <h2>Mirror Status Charts</h2>
{% load cdn %}{% jquery %}{% jquery_tablesorter %}{% d3js %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" src="{% static "mirror_status.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$("#available_urls:has(tbody tr)").tablesorter(
{widgets: ['zebra'], sortList: [[1,0], [2,0]],
Expand Down
2 changes: 1 addition & 1 deletion templates/mirrors/mirrors.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ <h2>Mirror Overview</h2>
</div>
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$(".results").tablesorter({widgets: ['zebra'], sortList: [[2,0], [0,0]]});
});
Expand Down
2 changes: 1 addition & 1 deletion templates/mirrors/status.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,7 +77,7 @@ <h3>Mirror Syncing Error Log</h3>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
var headers = { 4: { sorter: 'duration' }, 5: { sorter: 'mostlydigit' },
6: { sorter: 'mostlydigit' }, 7: { sorter: 'mostlydigit' },
Expand Down
2 changes: 1 addition & 1 deletion templates/mirrors/url_details.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,7 +64,7 @@ <h3>Check Logs</h3>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$("#check_logs:has(tbody tr)").tablesorter(
{widgets: ['zebra'], sortList: [[0,1]],
Expand Down
2 changes: 1 addition & 1 deletion templates/news/add.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ <h2>News: Add Article</h2>
<h2>News Preview: <span id="news-preview-title"></span></h2>
<div id="news-preview-data" class="article-content"></div>
</div>
<script type="text/javascript" nonce={{ CSP_NONCE }} defer>
<script type="text/javascript" nonce={{ csp_nonce }} defer>
function onPreviewButtonClick(event) {
event.preventDefault();

Expand Down
2 changes: 1 addition & 1 deletion templates/packages/details.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
{% endblock %}

{% block script_block %}
<script type="text/javascript" nonce="{{ CSP_NONCE }}">
<script type="text/javascript" nonce="{{ csp_nonce }}">
function ajaxifyFiles() {
filelink.addEventListener("click", function(event) {
event.preventDefault();
Expand Down
2 changes: 1 addition & 1 deletion templates/packages/differences.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -42,7 +42,7 @@ <h2>Multilib Differences to Main Packages</h2>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$('#table_multilib_differences').tablesorter({widgets: ['zebra'], sortList: [[5, 0]]});
});
Expand Down
2 changes: 1 addition & 1 deletion templates/packages/groups.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ <h2>Package Groups Overview{% if arch %} - {{ arch }}{% endif %}</h2>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$(".results").tablesorter({widgets: ['zebra'], sortList: [[1,0], [0,0]]});
});
Expand Down
2 changes: 1 addition & 1 deletion templates/packages/packages_list.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,7 +45,7 @@ <h2>{{ list_title }} - {{ name }} ({{ arch.name }})</h2>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$(".results").tablesorter({widgets: ['zebra'], sortList: [[2,0]]});
});
Expand Down
2 changes: 1 addition & 1 deletion templates/packages/signoffs.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ <h3>Filter Displayed Signoffs</h3>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$('.results').tablesorter({widgets: ['zebra'], sortList: [[0,0]],
headers: { 5: { sorter: 'epochdate' }, 7: { sorter: false }, 8: {sorter: false } } });
Expand Down
2 changes: 1 addition & 1 deletion templates/packages/stale_relations.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,7 +113,7 @@ <h3>Maintainers with Wrong Permissions ({{ wrong_permissions|length }})</h3>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$('#inactive-user:not(:has(tbody tr.empty))').tablesorter({widgets: ['zebra'], headers: { 0: { sorter: false }, 2: { sorter: false } }, sortList: [[1,0]]});
$('#missing-pkgbase:not(:has(tbody tr.empty))').tablesorter({widgets: ['zebra'], headers: { 0: { sorter: false } }, sortList: [[1,0]]});
Expand Down
2 changes: 1 addition & 1 deletion templates/public/keys.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ <h2 id="cross-sigs">Developer Cross-Signatures</h2>
{% load cdn %}{% jquery %}{% jquery_tablesorter %}{% d3js %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" src="{% static "visualize.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$("#key-status").tablesorter({
sortLocaleCompare: true,
Expand Down
2 changes: 1 addition & 1 deletion templates/releng/release_list.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,7 +57,7 @@ <h2>Releases</h2>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$(".results").tablesorter({
widgets: ['zebra'],
Expand Down
2 changes: 1 addition & 1 deletion templates/todolists/list.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ <h2>Package Todo Lists</h2>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$(".results").tablesorter({widgets: ['zebra'], sortList: [[6, 1], [1, 1]]});
});
Expand Down
2 changes: 1 addition & 1 deletion templates/todolists/view.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,7 @@ <h3>Filter Todo List Packages</h3>
{% block script_block %}
{% load cdn %}{% jquery %}{% jquery_tablesorter %}
<script type="text/javascript" src="{% static "archweb.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
$(document).ready(function() {
$(".results").tablesorter({
widgets: ['zebra'],
Expand Down
2 changes: 1 addition & 1 deletion templates/visualize/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ <h2>Visualization of Package Data</h2>
{% block script_block %}
{% load cdn %}{% d3js %}
<script type="text/javascript" src="{% static "visualize.js" %}"></script>
<script type="text/javascript" nonce={{ CSP_NONCE }}>
<script type="text/javascript" nonce={{ csp_nonce }}>
document.addEventListener("DOMContentLoaded", function() {
const orderings = {
"repo": { url: "{% url 'visualize-byrepo' %}", color_attr: "repo" },
Expand Down
15 changes: 0 additions & 15 deletions uv.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading