Bugzilla – Attachment 192704 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: Fix nonce caching and add to framework plugin scripts
Bug-38365-Fix-nonce-caching-and-add-to-framework-p.patch (text/plain), 13.05 KB, created by
David Cook
on 2026-02-09 02:27:04 UTC
(
hide
)
Description:
Bug 38365: Fix nonce caching and add to framework plugin scripts
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-09 02:27:04 UTC
Size:
13.05 KB
patch
obsolete
>From 6294c8715d4b743534f6e6ff973612ef26fe3cb8 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Wed, 4 Feb 2026 02:00:44 +0000 >Subject: [PATCH] Bug 38365: Fix nonce caching and add to framework plugin > scripts > >Signed-off-by: David Cook <dcook@prosentient.com.au> >Signed-off-by: Lari Taskula <lari.taskula@hypernova.fi> >--- > Koha/ContentSecurityPolicy.pm | 60 +++++++++++-------- > Koha/FrameworkPlugin.pm | 11 +++- > Koha/Middleware/ContentSecurityPolicy.pm | 1 + > Koha/Template/Plugin/Koha.pm | 2 +- > t/Koha/ContentSecurityPolicy.t | 19 +++--- > t/Koha/Middleware/ContentSecurityPolicy.t | 5 +- > .../Koha/Middleware/ContentSecurityPolicy.t | 15 ++--- > t/db_dependent/Koha/Template/Plugin/Koha.t | 2 +- > 8 files changed, 61 insertions(+), 54 deletions(-) > >diff --git a/Koha/ContentSecurityPolicy.pm b/Koha/ContentSecurityPolicy.pm >index de17672e813..d112b586154 100644 >--- a/Koha/ContentSecurityPolicy.pm >+++ b/Koha/ContentSecurityPolicy.pm >@@ -57,7 +57,7 @@ sub new { > my ( $class, $params ) = @_; > my $self = bless $params // {}, $class; > >- $self->nonce( $params->{nonce} ); >+ $self->set_nonce( $params->{nonce} ) if $params->{nonce}; > $self->{config} = Koha::Config->get_instance; > return $self; > } >@@ -127,7 +127,7 @@ sub header_value { > unless exists $conf_csp->{$interface}->{csp_header_value}; > > my $csp_header_value = $conf_csp->{$interface}->{csp_header_value}; >- my $csp_nonce = $self->nonce; >+ my $csp_nonce = $self->get_nonce; > > $csp_header_value =~ s/_CSP_NONCE_/$csp_nonce/g; > >@@ -166,44 +166,52 @@ sub is_enabled { > return 0; > } > >-=head2 nonce >+=head2 get_nonce > >- $csp->nonce(); >+ $csp->get_nonce(); > >- Generates and returns the nonce. >+ Returns the previously set nonce. > >- $csp->nonce($nonce); >+ A CSP nonce is a random token that is used both in the inline scripts >+ and the Content-Security-Policy[-Report-Only] response header. >+ >+=cut >+ >+sub get_nonce { >+ my ($self) = @_; >+ >+ #Koha::Middleware::ContentSecurityPolicy sets an environmental variable >+ #We cannot use the L1 cache since it is cleared after the middleware is applied >+ my $env_value = $ENV{CSP_NONCE}; >+ >+ return $env_value; >+} >+ >+=head2 set_nonce > >- Sets and returns the nonce. >+ $csp->set_nonce($nonce); >+ >+ Set the nonce value. >+ >+ If value is provided, that value is used. Otherwise, a value is generated. > > A CSP nonce is a random token that is used both in the inline scripts > and the Content-Security-Policy[-Report-Only] response header. > > =cut > >-sub nonce { >+sub set_nonce { > my ( $self, $nonce ) = @_; >- my $cache = Koha::Cache::Memory::Lite->new; > >+ #Koha::Middleware::ContentSecurityPolicy sets an environmental variable >+ #We cannot use the L1 cache since it is cleared after the middleware is applied > if ($nonce) { >- $cache->set_in_cache( 'CSP-NONCE', $nonce ); >- $self->{nonce} = $nonce; >- return $self->{nonce}; >- } >- >- if ( $nonce = $cache->get_from_cache('CSP-NONCE') ) { >- $self->{nonce} = $nonce; >- return $self->{nonce}; >+ $ENV{CSP_NONCE} = $nonce; >+ } else { >+ my $nonce = Koha::Token->new()->generate( { pattern => '\w{22}' } ); >+ $ENV{CSP_NONCE} = $nonce; > } >- >- unless ( $self->{nonce} ) { >- $nonce = Koha::Token->new()->generate( { pattern => '\w{22}' } ); >- $self->{nonce} = $nonce; >- } >- >- $cache->set_in_cache( 'CSP-NONCE', $self->{nonce} ); >- >- return $self->{nonce}; >+ return 1; > } > > 1; >diff --git a/Koha/FrameworkPlugin.pm b/Koha/FrameworkPlugin.pm >index 844957bf0d1..d7d8f61920f 100644 >--- a/Koha/FrameworkPlugin.pm >+++ b/Koha/FrameworkPlugin.pm >@@ -117,6 +117,7 @@ use Cwd qw//; > use base qw(Class::Accessor); > > use C4::Context; >+use Koha::ContentSecurityPolicy; > > __PACKAGE__->mk_ro_accessors( > qw| >@@ -137,7 +138,11 @@ __PACKAGE__->mk_ro_accessors( > > sub new { > my ( $class, $params ) = @_; >- my $self = $class->SUPER::new(); >+ my $self = $class->SUPER::new(); >+ my $csp_nonce = Koha::ContentSecurityPolicy->new->get_nonce; >+ if ($csp_nonce) { >+ $self->{csp_nonce} = $csp_nonce; >+ } > if ( ref($params) eq 'HASH' ) { > foreach ( 'name', 'path', 'item_style' ) { > $self->{$_} = $params->{$_}; >@@ -356,6 +361,8 @@ sub _generate_js { > sub _process_javascript { > my ( $self, $params, $script ) = @_; > >+ my $csp_nonce = $self->{csp_nonce}; >+ > #remove the script tags; we add them again later > $script =~ s/\<script[^>]*\>\s*(\/\/\<!\[CDATA\[)?\s*//s; > $script =~ s/(\/\/\]\]\>\s*)?\<\/script\>//s; >@@ -372,7 +379,7 @@ sub _process_javascript { > } > $self->{noclick} = !$clickfound; > $self->{javascript} = <<JS; >-<script> >+<script nonce="$csp_nonce"> > \$(document).ready(function () { > $script > }); >diff --git a/Koha/Middleware/ContentSecurityPolicy.pm b/Koha/Middleware/ContentSecurityPolicy.pm >index 2f61747209a..816922a9986 100644 >--- a/Koha/Middleware/ContentSecurityPolicy.pm >+++ b/Koha/Middleware/ContentSecurityPolicy.pm >@@ -39,6 +39,7 @@ sub call { > my $req = Plack::Request->new($env); > > my $csp = Koha::ContentSecurityPolicy->new; >+ $csp->set_nonce(); > > my $res = $self->app->($env); > return $res unless $csp->is_enabled; >diff --git a/Koha/Template/Plugin/Koha.pm b/Koha/Template/Plugin/Koha.pm >index 3cab6b5ef14..f98a1392aaa 100644 >--- a/Koha/Template/Plugin/Koha.pm >+++ b/Koha/Template/Plugin/Koha.pm >@@ -172,7 +172,7 @@ It should be cached by Koha::Middleware::ContentSecurityPolicy. > =cut > > sub CSPNonce { >- return Koha::ContentSecurityPolicy->new->nonce; >+ return Koha::ContentSecurityPolicy->new->get_nonce; > } > > 1; >diff --git a/t/Koha/ContentSecurityPolicy.t b/t/Koha/ContentSecurityPolicy.t >index ba4f9714ef0..b24f26e9acf 100755 >--- a/t/Koha/ContentSecurityPolicy.t >+++ b/t/Koha/ContentSecurityPolicy.t >@@ -140,10 +140,8 @@ subtest 'header_value tests' => sub { > $conf_csp_section, > { opac => { csp_header_value => 'begin nonce-_CSP_NONCE_ end' } } > ); >- my $cache = Koha::Cache::Memory::Lite->get_instance(); >- $cache->set_in_cache( 'CSP-NONCE', 'cached value' ); >+ $csp->set_nonce('cached value'); > is( $csp->header_value, 'begin nonce-cached value end', 'Cached csp_header_value' ); >- $cache->flush; > > $csp = Koha::ContentSecurityPolicy->new( { nonce => 'forced value' } ); > is( $csp->header_value, 'begin nonce-forced value end', 'Forced csp_header_value' ); >@@ -158,21 +156,20 @@ subtest 'nonce tests' => sub { > my $csp = Koha::ContentSecurityPolicy->new; > > $csp = Koha::ContentSecurityPolicy->new( { nonce => 'forced value' } ); >- is( $csp->nonce, 'forced value', 'nonce is not re-generated as it was passed to new()' ); >+ is( $csp->get_nonce, 'forced value', 'nonce is not re-generated as it was passed to new()' ); > > $csp = Koha::ContentSecurityPolicy->new( { nonce => 'forced value' } ); >- is( $csp->nonce, 'forced value', 'nonce is not re-generated as was cached in memory' ); >+ is( $csp->get_nonce, 'forced value', 'nonce is not re-generated as was cached in memory' ); > >- my $cache = Koha::Cache::Memory::Lite->get_instance(); >- $cache->flush; >+ $csp->set_nonce(); > > $csp = Koha::ContentSecurityPolicy->new(); >- my $nonce = $csp->nonce; >+ my $nonce = $csp->get_nonce; > like( $nonce, qr/\w{22}/, 'nonce is a random string of 22 characters (128+ bits entropy)' ); >- is( $nonce, $csp->nonce, 're-calling nonce() returns the same randomly generated cached value' ); >+ is( $nonce, $csp->get_nonce, 're-calling nonce() returns the same randomly generated cached value' ); > >- $cache->set_in_cache( 'CSP-NONCE', 'cached value' ); >- is( $csp->nonce, 'cached value', 'nonce is not re-generated as it was previously cached' ); >+ $csp->set_nonce('cached value'); >+ is( $csp->get_nonce, 'cached value', 'nonce is not re-generated as it was previously cached' ); > }; > > 1; >diff --git a/t/Koha/Middleware/ContentSecurityPolicy.t b/t/Koha/Middleware/ContentSecurityPolicy.t >index e735d78a50f..d4b41d77aa4 100755 >--- a/t/Koha/Middleware/ContentSecurityPolicy.t >+++ b/t/Koha/Middleware/ContentSecurityPolicy.t >@@ -41,7 +41,6 @@ my $conf_csp_section = 'content_security_policy'; > subtest 'test Content-Security-Policy header' => sub { > plan tests => 3; > >- my $test_nonce = 'TEST_NONCE'; > my $csp_header_value = > "default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; > >@@ -50,9 +49,6 @@ subtest 'test Content-Security-Policy header' => sub { > { opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } > ); > >- # Set nonce >- Koha::ContentSecurityPolicy->new->nonce($test_nonce); >- > t::lib::Mocks::mock_config( 'opachtdocs', C4::Context->config('intranetdir') . '/t/mock_templates/opac-tmpl' ); > > my $env = {}; >@@ -79,6 +75,7 @@ subtest 'test Content-Security-Policy header' => sub { > > my $test = Plack::Test->create($app); > my $res = $test->request( GET "/" ); >+ my $test_nonce = Koha::ContentSecurityPolicy->new->get_nonce(); > my $expected_csp_header_value = $csp_header_value; > $expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; > is( >diff --git a/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t b/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >index 4c768217f3a..6095169ca11 100755 >--- a/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >+++ b/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >@@ -37,7 +37,6 @@ my $conf_csp_section = 'content_security_policy'; > subtest 'test CSP in OPAC' => sub { > plan tests => 5; > >- my $test_nonce = 'TEST_NONCE'; > my $csp_header_value = > "default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; > >@@ -47,9 +46,6 @@ subtest 'test CSP in OPAC' => sub { > { opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } > ); > >- # Set nonce >- Koha::ContentSecurityPolicy->new->nonce($test_nonce); >- > my $env = {}; > my $home = $ENV{KOHA_HOME}; > my $app = Plack::App::CGIBin->new( root => $ENV{GIT_INSTALL} ? "$home/opac" : "$home/opac/cgi-bin/opac" )->to_app; >@@ -63,6 +59,7 @@ subtest 'test CSP in OPAC' => sub { > > my $test = Plack::Test->create($app); > my $res = $test->request( GET "/opac/opac-main.pl" ); >+ my $test_nonce = Koha::ContentSecurityPolicy->new->get_nonce(); > my $expected_csp_header_value = $csp_header_value; > $expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; > is( >@@ -100,7 +97,6 @@ subtest 'test CSP in OPAC' => sub { > subtest 'test CSP in staff client' => sub { > plan tests => 5; > >- my $test_nonce = 'TEST_NONCE'; > my $csp_header_value = > "default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; > >@@ -109,9 +105,6 @@ subtest 'test CSP in staff client' => sub { > { opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } > ); > >- # Set nonce >- Koha::ContentSecurityPolicy->new->nonce($test_nonce); >- > my $env = {}; > my $home = $ENV{KOHA_HOME}; > my $app = Plack::App::CGIBin->new( root => $ENV{GIT_INSTALL} ? $home : "$home/intranet/cgi-bin/" )->to_app; >@@ -125,6 +118,7 @@ subtest 'test CSP in staff client' => sub { > > my $test = Plack::Test->create($app); > my $res = $test->request( GET "/intranet/mainpage.pl" ); >+ my $test_nonce = Koha::ContentSecurityPolicy->new->get_nonce(); > my $expected_csp_header_value = $csp_header_value; > $expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; > is( >@@ -154,7 +148,10 @@ subtest 'test CSP in staff client' => sub { > { intranet => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } > ); > >- $res = $test->request( GET "/intranet/mainpage.pl" ); >+ $res = $test->request( GET "/intranet/mainpage.pl" ); >+ $test_nonce = Koha::ContentSecurityPolicy->new->get_nonce(); >+ $expected_csp_header_value = $csp_header_value; >+ $expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; > is( > $res->header('content-security-policy'), $expected_csp_header_value, > "Response contains Content-Security-Policy header when it is enabled in koha-conf.xml" >diff --git a/t/db_dependent/Koha/Template/Plugin/Koha.t b/t/db_dependent/Koha/Template/Plugin/Koha.t >index 2903fb020d1..67c0d986dd0 100755 >--- a/t/db_dependent/Koha/Template/Plugin/Koha.t >+++ b/t/db_dependent/Koha/Template/Plugin/Koha.t >@@ -91,7 +91,7 @@ subtest 'CSPNonce' => sub { > my $plugin = Koha::Template::Plugin::Koha->new($context); > > my $csp = Koha::ContentSecurityPolicy->new; >- my $nonce = $csp->nonce; >+ my $nonce = $csp->get_nonce; > > my $token = $plugin->CSPNonce; > >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968