Support CSP Nonce for Jinja2 Assets#204
Merged
JVickery-TBS merged 13 commits intocanada-v2.10from Aug 25, 2025
Merged
Conversation
- Add support for CSP Nonces for strict-dynamic directive.
- Added change log file.
- Continued unsafe inline stuffs.
- More inline things. - More nonce usage.
- More inline things. - More nonce usage.
- Move data images to actual images.
- Set no-cache for logged in users. - Updated change log files.
- Fixed nonce typos. - Removed dev console log. - Added TODO comments.
wardi
reviewed
Aug 22, 2025
wardi
reviewed
Aug 22, 2025
wardi
reviewed
Aug 22, 2025
wardi
reviewed
Aug 22, 2025
Member
wardi
left a comment
wardi
left a comment
There was a problem hiding this comment.
This is going to be rough to merge with the next version of ckan, but maybe still better than copying all these templates to ckanext-canada.
The bits that reference svgs that actually live in ckanext-canada should be moved over there or the svg files should be moved here, though
- Revert any overrides, they ar ein canada plugin now.
Author
|
Yeah merging is gunna be a pain for sure, made sure to put the comments in so it can help us in the future |
- Revert any overrides, they ar ein canada plugin now.
- Revert any overrides, they ar ein canada plugin now.
- New validator for http header values.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Another thing from the VA scan, we need to support the
strict-dynamicdirective in the Content-Security-Policy header to properly use the WET scripts and WET JS Builder. Thestrict-dynamicdirective basically says that other scripts are allowed to add script node objects to the DOM and those scripts are allowed to get executed. This NEEDS to have nonces to work securely though. And it seems that if you have thestrict-dynamicdirective set, some browsers will ignore some of the other directives so we need to add the nonce to all assets, hence this code addition.The
CSP_NONCEenviron value gets set in thecanada_securityplugin now from this PR: open-data/ckanext-canada#1599