paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-04 14:03:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

csp_nonce: Add nonce to script tags loading minified JS.

Browse Source
This commit is contained in:
Aditya Bansal
2018-04-16 15:59:53 +05:30
parent e9f2efedb5
commit ae398dc48b
3 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
templates/zerver/app/index.html
View File

@@ -35,7 +35,7 @@
{% else %} {% else %}
{% stylesheet 'app' %} {% stylesheet 'app' %}
{% endif %} {% endif %}
{{ minified_js('app')|safe }} {{ minified_js('app', csp_nonce)|safe }}
{{ render_bundle('translations') }} {{ render_bundle('translations') }}

8
zerver/templatetags/minified_js.py
View File

@@ -9,8 +9,9 @@ from django.template.base import Parser, Token
register = Library() register = Library()
class MinifiedJSNode(Node): class MinifiedJSNode(Node):
def __init__(self, sourcefile: str) -> None: def __init__(self, sourcefile: str, csp_nonce: str) -> None:
self.sourcefile = sourcefile self.sourcefile = sourcefile
self.csp_nonce = csp_nonce
def render(self, context: Dict[str, Any]) -> str: def render(self, context: Dict[str, Any]) -> str:
if settings.DEBUG: if settings.DEBUG:
@@ -24,6 +25,7 @@ class MinifiedJSNode(Node):
else: else:
scripts = [settings.JS_SPECS[self.sourcefile]['output_filename']] scripts = [settings.JS_SPECS[self.sourcefile]['output_filename']]
script_urls = [staticfiles_storage.url(script) for script in scripts] script_urls = [staticfiles_storage.url(script) for script in scripts]
script_tags = ['<script type="text/javascript" src="%s" charset="utf-8"></script>' script_tags = [('<script type="text/javascript" nonce="%s"'
% url for url in script_urls] ' src="%s" charset="utf-8"></script>') % (self.csp_nonce, url)
for url in script_urls]
return '\n'.join(script_tags) return '\n'.join(script_tags)

4
zproject/jinja2/compressors.py
View File

@@ -10,9 +10,9 @@ from django.template import TemplateSyntaxError
from zerver.templatetags.minified_js import MinifiedJSNode from zerver.templatetags.minified_js import MinifiedJSNode
def minified_js(sourcefile: str) -> Text: def minified_js(sourcefile: str, csp_nonce: str) -> Text:
if sourcefile not in settings.JS_SPECS: if sourcefile not in settings.JS_SPECS:
raise TemplateSyntaxError( raise TemplateSyntaxError(
"Invalid argument: no JS file %s".format(sourcefile)) "Invalid argument: no JS file %s".format(sourcefile))
return MinifiedJSNode(sourcefile).render({}) return MinifiedJSNode(sourcefile, csp_nonce).render({})