Bugzilla – Attachment 191667 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: Add Koha::Template::Plugin::Koha::CSPNonce
Bug-38365-Add-KohaTemplatePluginKohaCSPNonce.patch (text/plain), 4.67 KB, created by
David Cook
on 2026-01-20 01:04:43 UTC
(
hide
)
Description:
Bug 38365: Add Koha::Template::Plugin::Koha::CSPNonce
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-01-20 01:04:43 UTC
Size:
4.67 KB
patch
obsolete
>From 3cbfc434a4c902494cde4fefe034e0ef428335fb Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@hypernova.fi> >Date: Fri, 16 Jan 2026 15:02:13 +0200 >Subject: [PATCH] Bug 38365: Add Koha::Template::Plugin::Koha::CSPNonce > >This patch adds a new Template plugin method, Koha.CSPNonce, that can be used to >attach the Content Security Policy nonce into our templates. > >To test: >1. prove t/Koha/Middleware/ContentSecurityPolicy.t >2. prove t/db_dependent/Koha/Template/Plugin/Koha.t > >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > Koha/Template/Plugin/Koha.pm | 13 +++++++++++ > t/Koha/Middleware/ContentSecurityPolicy.t | 13 ++++++++--- > t/db_dependent/Koha/Template/Plugin/Koha.t | 23 ++++++++++++++++++- > .../bootstrap/en/modules/opac-csp.tt | 2 ++ > 4 files changed, 47 insertions(+), 4 deletions(-) > create mode 100644 t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt > >diff --git a/Koha/Template/Plugin/Koha.pm b/Koha/Template/Plugin/Koha.pm >index 992b1974ecc..3cab6b5ef14 100644 >--- a/Koha/Template/Plugin/Koha.pm >+++ b/Koha/Template/Plugin/Koha.pm >@@ -25,6 +25,7 @@ use C4::Context; > use Koha::Token; > use Koha; > use Koha::Cache::Memory::Lite; >+use Koha::ContentSecurityPolicy; > > =head1 NAME > >@@ -162,4 +163,16 @@ sub GenerateCSRF { > return $csrf_token; > } > >+=head3 CSPNonce >+ >+Retrieves the Content-Security-Policy nonce. >+ >+It should be cached by Koha::Middleware::ContentSecurityPolicy. >+ >+=cut >+ >+sub CSPNonce { >+ return Koha::ContentSecurityPolicy->new->nonce; >+} >+ > 1; >diff --git a/t/Koha/Middleware/ContentSecurityPolicy.t b/t/Koha/Middleware/ContentSecurityPolicy.t >index a03b3a7cdf4..e735d78a50f 100755 >--- a/t/Koha/Middleware/ContentSecurityPolicy.t >+++ b/t/Koha/Middleware/ContentSecurityPolicy.t >@@ -24,11 +24,14 @@ use Test::NoWarnings; > use Test::More tests => 3; > use Test::Warn; > >+use File::Basename qw(dirname); > use HTTP::Request::Common; > use Plack::Builder; > use Plack::Util; > use Plack::Test; > >+use C4::Templates; >+ > use t::lib::Mocks; > > use_ok("Koha::Middleware::ContentSecurityPolicy"); >@@ -50,9 +53,13 @@ subtest 'test Content-Security-Policy header' => sub { > # Set nonce > Koha::ContentSecurityPolicy->new->nonce($test_nonce); > >+ t::lib::Mocks::mock_config( 'opachtdocs', C4::Context->config('intranetdir') . '/t/mock_templates/opac-tmpl' ); >+ > my $env = {}; > my $app = sub { >- my $resp = [ >+ require Koha::Plugins; # this should probably be "use Koha::Plugins;" in C4::Templates instead >+ my $template = C4::Templates::gettemplate( 'opac-csp.tt', 'opac' ); >+ my $resp = [ > 200, > [ > 'Content-Type', >@@ -60,7 +67,7 @@ subtest 'test Content-Security-Policy header' => sub { > 'Content-Length', > 12 > ], >- [ Koha::ContentSecurityPolicy->new->nonce ] >+ [ $template->output ] > ]; > return $resp; > }; >@@ -79,7 +86,7 @@ subtest 'test Content-Security-Policy header' => sub { > "Response contains Content-Security-Policy header with the expected value" > ); > is( >- $res->content, $test_nonce, >+ $res->content, '<script nonce="' . $test_nonce . '">' . "\n" . '</script>' . "\n", > "Response contains generated nonce in the body" > ); > >diff --git a/t/db_dependent/Koha/Template/Plugin/Koha.t b/t/db_dependent/Koha/Template/Plugin/Koha.t >index b152553225e..2903fb020d1 100755 >--- a/t/db_dependent/Koha/Template/Plugin/Koha.t >+++ b/t/db_dependent/Koha/Template/Plugin/Koha.t >@@ -17,7 +17,7 @@ > > use Modern::Perl; > >-use Test::More tests => 3; >+use Test::More tests => 4; > > use Template::Context; > use Template::Stash; >@@ -79,3 +79,24 @@ subtest 'GenerateCSRF - New CSRF token generated every time we need one' => sub > $schema->storage->txn_rollback; > > }; >+ >+subtest 'CSPNonce' => sub { >+ plan tests => 1; >+ >+ $schema->storage->txn_begin; >+ >+ my $stash = Template::Stash->new( { sessionID => $session_id } ); >+ my $context = Template::Context->new( { STASH => $stash } ); >+ >+ my $plugin = Koha::Template::Plugin::Koha->new($context); >+ >+ my $csp = Koha::ContentSecurityPolicy->new; >+ my $nonce = $csp->nonce; >+ >+ my $token = $plugin->CSPNonce; >+ >+ is( $plugin->CSPNonce, $nonce, 'the correct nonce was provided' ); >+ >+ $schema->storage->txn_rollback; >+ >+}; >diff --git a/t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt b/t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt >new file mode 100644 >index 00000000000..80d65e6b711 >--- /dev/null >+++ b/t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt >@@ -0,0 +1,2 @@ >+[% USE raw %][% USE Koha %]<script nonce="[% Koha.CSPNonce | $raw %]"> >+</script> >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968