Bugzilla – Attachment 192422 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: Add script to insert CSP nonces into templates
Bug-38365-Add-script-to-insert-CSP-nonces-into-tem.patch (text/plain), 6.85 KB, created by
David Cook
on 2026-02-04 02:17:45 UTC
(
hide
)
Description:
Bug 38365: Add script to insert CSP nonces into templates
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-04 02:17:45 UTC
Size:
6.85 KB
patch
obsolete
>From ab11ff8a8b81a954d6005a8b7735e9a8fea3f8a0 Mon Sep 17 00:00:00 2001 >From: Martin Renvoize <martin.renvoize@openfifth.co.uk> >Date: Mon, 2 Feb 2026 10:12:55 +0000 >Subject: [PATCH] Bug 38365: Add script to insert CSP nonces into templates > >Add misc/devel/add_csp_nonces.pl which automatically adds CSP nonce >attributes to inline <script> tags in Koha templates. > >The script: >- Finds all .tt and .inc files in koha-tmpl/ >- Adds nonce="[% Koha.CSPNonce | $raw %]" to inline scripts >- Skips external scripts (those with src= attribute) >- Skips scripts that already have nonce= attribute >- Skips third-party library files in lib/ and vendor/ > >Usage: > perl misc/devel/add_csp_nonces.pl # Dry run > perl misc/devel/add_csp_nonces.pl --apply # Apply changes > >This script enables easy backporting of CSP nonce support to older >Koha versions by running it against their template directories. > >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > misc/devel/add_csp_nonces.pl | 201 +++++++++++++++++++++++++++++++++++ > 1 file changed, 201 insertions(+) > create mode 100755 misc/devel/add_csp_nonces.pl > >diff --git a/misc/devel/add_csp_nonces.pl b/misc/devel/add_csp_nonces.pl >new file mode 100755 >index 00000000000..0f49d0c0740 >--- /dev/null >+++ b/misc/devel/add_csp_nonces.pl >@@ -0,0 +1,201 @@ >+#!/usr/bin/env perl >+ >+# This file is part of Koha. >+# >+# Koha is free software; you can redistribute it and/or modify it >+# under the terms of the GNU General Public License as published by >+# the Free Software Foundation; either version 3 of the License, or >+# (at your option) any later version. >+# >+# Koha is distributed in the hope that it will be useful, but >+# WITHOUT ANY WARRANTY; without even the implied warranty of >+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >+# GNU General Public License for more details. >+# >+# You should have received a copy of the GNU General Public License >+# along with Koha; if not, see <https://www.gnu.org/licenses>. >+ >+=head1 NAME >+ >+add_csp_nonces.pl - Add CSP nonces to inline script tags in templates >+ >+=head1 SYNOPSIS >+ >+ # Dry run (default) - show what would be changed >+ perl misc/devel/add_csp_nonces.pl >+ >+ # Actually modify files >+ perl misc/devel/add_csp_nonces.pl --apply >+ >+ # Verbose output >+ perl misc/devel/add_csp_nonces.pl --verbose >+ >+ # Process specific directory >+ perl misc/devel/add_csp_nonces.pl --dir koha-tmpl/opac-tmpl >+ >+=head1 DESCRIPTION >+ >+This script adds CSP (Content Security Policy) nonce attributes to inline >+<script> tags in Koha templates. This is required for CSP compliance. >+ >+The script: >+- Finds all .tt and .inc files in koha-tmpl/ >+- Identifies inline <script> tags (those without src= attribute) >+- Adds nonce="[% Koha.CSPNonce | $raw %]" attribute >+- Skips tags that already have nonce attributes >+- Skips external scripts (those with src= attribute) >+ >+=cut >+ >+use Modern::Perl; >+use Carp qw( carp ); >+use File::Find; >+use Getopt::Long; >+use Pod::Usage; >+ >+my $apply = 0; >+my $verbose = 0; >+my $help = 0; >+my $dir = 'koha-tmpl'; >+ >+GetOptions( >+ 'apply' => \$apply, >+ 'verbose|v' => \$verbose, >+ 'help|h' => \$help, >+ 'dir=s' => \$dir, >+) or pod2usage(2); >+ >+pod2usage(1) if $help; >+ >+# The nonce attribute to add >+my $nonce_attr = 'nonce="[% Koha.CSPNonce | $raw %]"'; >+ >+# Patterns to skip (library files, etc.) >+my @skip_patterns = ( >+ qr{/lib/}, # Third-party libraries >+ qr{/vendor/}, # Vendor files >+ qr{\.min\.}, # Minified files >+ qr{/node_modules/}, # Node modules >+); >+ >+my %stats = ( >+ files_scanned => 0, >+ files_modified => 0, >+ tags_modified => 0, >+); >+ >+sub should_skip_file { >+ my ($file) = @_; >+ for my $pattern (@skip_patterns) { >+ return 1 if $file =~ $pattern; >+ } >+ return 0; >+} >+ >+sub process_file { >+ my ($file) = @_; >+ >+ return unless -f $file; >+ return unless $file =~ /\.(tt|inc)$/; >+ return if should_skip_file($file); >+ >+ $stats{files_scanned}++; >+ >+ open my $fh, '<:encoding(UTF-8)', $file or do { >+ carp "Cannot read $file: $!"; >+ return; >+ }; >+ my $content = do { local $/; <$fh> }; >+ close $fh; >+ >+ my $original = $content; >+ my $modified = 0; >+ >+ # Match <script tags that: >+ # - Don't have src= attribute (inline scripts) >+ # - Don't already have nonce= attribute >+ # >+ # We use a callback replacement to handle each match individually >+ $content =~ s{ >+ (<script) # Capture opening <script >+ ( # Capture existing attributes >+ (?: >+ \s+ # Whitespace before attribute >+ (?!src\s*=) # Not followed by src= >+ (?!nonce\s*=) # Not followed by nonce= >+ [a-zA-Z][\w-]* # Attribute name >+ (?: # Optional attribute value >+ \s*=\s* >+ (?: >+ "[^"]*" # Double-quoted value >+ |'[^']*' # Single-quoted value >+ |[^\s>]+ # Unquoted value >+ ) >+ )? >+ )* >+ ) >+ (\s*) # Whitespace before > >+ (>) # Closing > >+ }{ >+ my ($open, $attrs, $ws, $close) = ($1, $2, $3, $4); >+ >+ # Check if this tag has src= (external script - skip) >+ if ($attrs =~ /\bsrc\s*=/i) { >+ "$open$attrs$ws$close"; # Return unchanged >+ } >+ # Check if already has nonce= (skip) >+ elsif ($attrs =~ /\bnonce\s*=/i) { >+ "$open$attrs$ws$close"; # Return unchanged >+ } >+ else { >+ $modified++; >+ "$open $nonce_attr$attrs$ws$close"; >+ } >+ }xsge; >+ >+ if ($modified) { >+ $stats{files_modified}++; >+ $stats{tags_modified} += $modified; >+ >+ if ( $verbose || !$apply ) { >+ say "File: $file ($modified tag" . ( $modified > 1 ? 's' : '' ) . ")"; >+ } >+ >+ if ($apply) { >+ open my $out, '>:encoding(UTF-8)', $file or do { >+ carp "Cannot write $file: $!"; >+ return; >+ }; >+ print $out $content; >+ close $out; >+ say " Modified" if $verbose; >+ } >+ } >+} >+ >+# Find and process all template files >+find( >+ { >+ wanted => sub { >+ process_file($File::Find::name); >+ }, >+ no_chdir => 1, >+ }, >+ $dir >+); >+ >+# Print summary >+say ""; >+say "=" x 60; >+say "Summary:"; >+say " Files scanned: $stats{files_scanned}"; >+say " Files modified: $stats{files_modified}"; >+say " Tags modified: $stats{tags_modified}"; >+say "=" x 60; >+ >+if ( !$apply && $stats{tags_modified} > 0 ) { >+ say ""; >+ say "This was a dry run. Use --apply to actually modify files."; >+} >+ >+exit( $stats{tags_modified} > 0 ? 0 : 1 ); >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968