GH 36 #179

g-k · 2021-07-29T19:36:35Z

refs: #36

Making a WIP PR, so I can start looking at it without adding Dylan's fork as a remote.

DylanYoung

Notes for finishing up.

DylanYoung · 2022-05-20T04:12:39Z

csp/utils.py

+    )
+     # Technically we're modifying Django settings here,
+     # but it shouldn't matter since the end result of either will be the same
+    deprecation._handle_legacy_settings(custom_definitions)


Design Decision: Should we call _handle_legacy_settings based on whether the user has set CSP_POLICY_DEFINITIONS? i.e. only use the legacy settings if the new settings aren't used.

I think this is probably best, but it require updating a whack-ton of tests, so maybe it could come in a separate PR.

DylanYoung · 2022-05-20T04:18:04Z

csp/middleware.py

+            headers[header].append(csp)
+
+        for header, policies in headers.items():
+            # TODO: Design Decision do we want the optional whitespace?


Design Decision: do we want the optional whitespace? (See convo on issue)

DylanYoung · 2022-05-20T04:20:46Z

csp/middleware.py

            return response

-        response[header] = self.build_policy(request, response)
+        # These won't be ordered properly on Cpython 3.5 or below


Remove October 2020 comments and OrderedDict (not supporting python 3.5 anymore?)

DylanYoung · 2022-05-20T04:36:50Z

csp/decorators.py


-def csp_update(**kwargs):
-    update = dict((k.lower().replace('_', '-'), v) for k, v in kwargs.items())
+def csp_reorder(order):


Big thing left to do is clarify how the decorators should work and write tests for them.

DylanYoung · 2022-05-20T04:45:36Z

setup.cfg


 [tool:pytest]
-addopts = -vs --tb=short --pep8 --flakes
+addopts = -vs --tb=short --pep8 --flakes --ignore docs/conf.py


Not sure what I was doing here: addopts = -vs --tb=short --pep8 --flakes --ignore docs/conf.py

Update docs

DylanYoung · 2022-05-20T04:52:37Z

csp/utils.py

-            if not isinstance(v, (list, tuple)):
-                v = (v,)
-            csp[k] = v
+            # TODO: design decision


Design Decision: Do we need this append functionality or should we just error out if the policy we're updating doesn't exist? I guess the issue is handling legacy calls?

I've simplified this significantly. csp_update and csp_replace no longer support appending. I added a new csp_append decorator, but not sure if it's desirable.

Design Decision: csp_update and csp_append using the old capitalized kwarg style only apply to the "default" policy by default, do we want them to apply to all policies? I think not because it could be a surprise that bites someone.

- Refactor settings

…lect decorators

DylanYoung · 2022-05-24T03:26:42Z

csp/tests/test_middleware.py

 rf = RequestFactory()


+def get_headers(response):


Move get_headers to csp/tests/utils.py

DylanYoung · 2022-05-24T03:30:09Z

docs/configuration.rst

+
+``CSP_POLICIES``
+    A list or tuple specifying which definitions will be applied by default and
+    defining an order on those policies. *['default']*


Order doesn't really matter I think, remove from docs on CSP_POLICIES

…corator

…/csp_select decorators

…NITIONS

…/csp_select decorators

…CY_DEFINITIONS

robhudson · 2024-06-06T17:07:10Z

Closing old PR. #219 has been merged which fixes this same issue. Thank you!

g-k mentioned this pull request Jul 30, 2021

Allow enforced CSP and Report-Only at the same time #36

Closed

DylanYoung reviewed May 20, 2022

View reviewed changes

DylanYoung force-pushed the GH-36 branch from 9ecf75a to a605b32 Compare May 23, 2022 23:18

DylanYoung added 13 commits May 23, 2022 23:59

mozillaGH-36 Update settings for multi-policy support

3227426

- Refactor settings

mozillaGH-36 Update utils to handle multiple policies

2d7aa80

mozillaGH-36 Update csp decorators for multi-policy support

290a57d

mozillaGH-36 Update middleware for multi-policy support

91402da

mozillaGH-36 Update tests to use new multi-policy format

83e2f61

mozillaGH-36 Add csp_select and csp_append decorators

ad9cbae

mozillaGH-36 Add tests for multi-policy support and csp_append/csp_se…

c6cfa87

…lect decorators

mozillaGH-36 Update docs for multi-policy support

6c25fc9

mozillaGH-36 Update CHANGES for multi-policy support

09a0ce6

TEMP: Add utils tests

e2e66a9

Remove legacy django and python support (mozillaGH-36)

90b72fe

Exclude docs/conf.py from tests (mozillaGH-36)

1a7f979

TODO: upgrade test deps

29efdf7

DylanYoung force-pushed the GH-36 branch from d2dd73c to 29efdf7 Compare May 24, 2022 03:12

DylanYoung reviewed May 24, 2022

View reviewed changes

csp/tests/test_middleware.py

rf = RequestFactory()

def get_headers(response):

Copy link

Contributor

DylanYoung May 24, 2022

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Move get_headers to csp/tests/utils.py

DylanYoung reviewed May 24, 2022

View reviewed changes

DylanYoung added 11 commits May 24, 2022 00:54

Fix docs build warnings (mozillaGH-36)

858ec86

TEMP Update docs

6c0de34

Add docs to tox.ini (mozillaGH-36)

02d06bc

mozillaGH-36 Update RateLimitedCSPMiddleware to support csp_select de…

c7bde5c

…corator

fixup! mozillaGH-36 Update CHANGES for multi-policy support

50de343

Deprecate block-all-mixed-content (mozillaGH-36)

9fff323

fixup! mozillaGH-36 Update middleware for multi-policy support

2628ac4

fixup! mozillaGH-36 Update tests to use new multi-policy format

16b0e49

fixup! mozillaGH-36 Add tests for multi-policy support and csp_append…

fcc2d6f

…/csp_select decorators

mozillaGH-36 Disallow mixing deprecated settings with CSP_POLICY_DEFI…

76e1894

…NITIONS

fixup! mozillaGH-36 Update tests to use new multi-policy format

7da7eea

DylanYoung added 11 commits May 25, 2022 00:03

fixup! TODO: upgrade test deps

cdd9bb7

fixup! mozillaGH-36 Update settings for multi-policy support

fb8be39

fixup! mozillaGH-36 Add tests for multi-policy support and csp_append…

a6685c3

…/csp_select decorators

Refactor CSPMiddleware for extensibility (mozillaGH-36)

a218956

fixup! mozillaGH-36 Update settings for multi-policy support

22f7301

fixup! mozillaGH-36 Add tests for multi-policy support and csp_append…

eb66ddc

…/csp_select decorators

fixup! TEMP: Add utils tests

3d157cc

fixup! mozillaGH-36 Update csp decorators for multi-policy support

cf88db5

fixup! mozillaGH-36 Update utils to handle multiple policies

0a947e2

fixup! mozillaGH-36 Disallow mixing deprecated settings with CSP_POLI…

0b1b649

…CY_DEFINITIONS

fixup! mozillaGH-36 Update docs for multi-policy support

1cc55a3

robhudson closed this Jun 6, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

GH 36 #179

GH 36 #179

Uh oh!

g-k commented Jul 29, 2021

Uh oh!

DylanYoung left a comment

Uh oh!

DylanYoung May 20, 2022

Uh oh!

DylanYoung May 23, 2022

Uh oh!

DylanYoung May 20, 2022

Uh oh!

DylanYoung May 20, 2022

Uh oh!

DylanYoung May 23, 2022

Uh oh!

DylanYoung May 20, 2022

Uh oh!

DylanYoung May 20, 2022

Uh oh!

DylanYoung May 20, 2022

Uh oh!

DylanYoung May 20, 2022

Uh oh!

DylanYoung May 23, 2022

Uh oh!

DylanYoung May 24, 2022

Uh oh!

DylanYoung May 24, 2022

Uh oh!

robhudson commented Jun 6, 2024

Uh oh!

Uh oh!

GH 36 #179

GH 36 #179

Uh oh!

Conversation

g-k commented Jul 29, 2021

Uh oh!

DylanYoung left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

robhudson commented Jun 6, 2024

Uh oh!

Uh oh!