Skip to content

Conversation

jwhitlock
Copy link
Member

To further fix #269, add and test a class CheckableLazyObject, which tests True if the object has been accessed and the value generated, and False if it is still "lazy".

Use this as the wrapper for request.csp_nonce, so that code can test if the nonce is activated before using it:

if (request.csp_nonce):
  print(f"The nonce is set to {request.csp_nonce}")
else:
  print("The nonce has not been set.")

This required a change to the template helpers, to ensure the nonce was read with str(request.csp_nonce). Otherwise, they are treated as falsey.

Copy link
Collaborator

@robhudson robhudson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good stuff.

@jwhitlock jwhitlock requested a review from robhudson March 6, 2025 16:06
@jwhitlock jwhitlock merged commit 40c89d4 into mozilla:main Mar 6, 2025
8 checks passed
@jwhitlock jwhitlock deleted the false-nonce-628 branch March 6, 2025 16:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants