From e88bfcead5f46e4a27b88330bd92c932afae586f Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Sun, 2 Nov 2025 23:03:20 +0200 Subject: [PATCH] Bug 38365: (follow-up) Add quotes to the nonce As pointed out by Marcel, the nonce should be quoted. This patch also changes the behavior of _CSP_NONCE_ variable in koha-conf to only hold the value of the nonce, but not the prefix "nonce-". I think it is slightly clearer this way. To test: 1. prove t/db_dependent/Output.t --- Koha/ContentSecurityPolicy.pm | 4 ++-- etc/koha-conf.xml | 8 ++++---- t/db_dependent/Output.t | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/Koha/ContentSecurityPolicy.pm b/Koha/ContentSecurityPolicy.pm index 138bdbe6a7a..b0feeae687f 100644 --- a/Koha/ContentSecurityPolicy.pm +++ b/Koha/ContentSecurityPolicy.pm @@ -130,8 +130,8 @@ sub header_value { $csp_nonce = $nonce if defined $nonce; } if ($csp_nonce) { - $csp_header_value =~ s/_CSP_NONCE_/nonce-$csp_nonce/g; - } elsif ( $csp_nonce eq '' ) { + $csp_header_value =~ s/_CSP_NONCE_/$csp_nonce/g; + } else { $csp_header_value =~ s/_CSP_NONCE_//g; } diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml index cb80a725f95..76d5a51689c 100644 --- a/etc/koha-conf.xml +++ b/etc/koha-conf.xml @@ -312,15 +312,15 @@ - - default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' + + default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' - - default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none' + + default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none' diff --git a/t/db_dependent/Output.t b/t/db_dependent/Output.t index 424701bdd90..47cc06e147d 100755 --- a/t/db_dependent/Output.t +++ b/t/db_dependent/Output.t @@ -236,7 +236,7 @@ subtest 'Content-Security-Policy tests' => sub { my $expected_csp_header = $modes->{$mode}; my $expected_csp_header_value = - "default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'"; + "default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; t::lib::Mocks::mock_config( 'content_security_policy', { $interface => { csp_mode => $mode, csp_header_value => $expected_csp_header_value } } @@ -291,7 +291,7 @@ subtest 'Content-Security-Policy tests' => sub { my $cache = Koha::Cache::Memory::Lite->get_instance; my $nonce = $cache->get_from_cache("csp_nonce"); - $expected_csp_header_value =~ s/_CSP_NONCE_/nonce-$nonce/g; + $expected_csp_header_value =~ s/_CSP_NONCE_/$nonce/g; C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); $stdout =~ /(Content-Security-Policy[A-Za-z\-]*): (.*)\r/im; -- 2.34.1