From 85d90fcfdfc88e509b55a4f34f704f7c8a4c9372 Mon Sep 17 00:00:00 2001 From: Lari Taskula Date: Fri, 16 Jan 2026 15:02:13 +0200 Subject: [PATCH] Bug 38365: Add Koha::Template::Plugin::Koha::CSPNonce This patch adds a new Template plugin method, Koha.CSPNonce, that can be used to attach the Content Security Policy nonce into our templates. To test: 1. prove t/Koha/Middleware/ContentSecurityPolicy.t 2. prove t/db_dependent/Koha/Template/Plugin/Koha.t Signed-off-by: David Cook Signed-off-by: Martin Renvoize --- Koha/Template/Plugin/Koha.pm | 13 +++++++++++ t/Koha/Middleware/ContentSecurityPolicy.t | 13 ++++++++--- t/db_dependent/Koha/Template/Plugin/Koha.t | 23 ++++++++++++++++++- .../bootstrap/en/modules/opac-csp.tt | 2 ++ 4 files changed, 47 insertions(+), 4 deletions(-) create mode 100644 t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt diff --git a/Koha/Template/Plugin/Koha.pm b/Koha/Template/Plugin/Koha.pm index 992b1974ecc..3cab6b5ef14 100644 --- a/Koha/Template/Plugin/Koha.pm +++ b/Koha/Template/Plugin/Koha.pm @@ -25,6 +25,7 @@ use C4::Context; use Koha::Token; use Koha; use Koha::Cache::Memory::Lite; +use Koha::ContentSecurityPolicy; =head1 NAME @@ -162,4 +163,16 @@ sub GenerateCSRF { return $csrf_token; } +=head3 CSPNonce + +Retrieves the Content-Security-Policy nonce. + +It should be cached by Koha::Middleware::ContentSecurityPolicy. + +=cut + +sub CSPNonce { + return Koha::ContentSecurityPolicy->new->nonce; +} + 1; diff --git a/t/Koha/Middleware/ContentSecurityPolicy.t b/t/Koha/Middleware/ContentSecurityPolicy.t index a03b3a7cdf4..e735d78a50f 100755 --- a/t/Koha/Middleware/ContentSecurityPolicy.t +++ b/t/Koha/Middleware/ContentSecurityPolicy.t @@ -24,11 +24,14 @@ use Test::NoWarnings; use Test::More tests => 3; use Test::Warn; +use File::Basename qw(dirname); use HTTP::Request::Common; use Plack::Builder; use Plack::Util; use Plack::Test; +use C4::Templates; + use t::lib::Mocks; use_ok("Koha::Middleware::ContentSecurityPolicy"); @@ -50,9 +53,13 @@ subtest 'test Content-Security-Policy header' => sub { # Set nonce Koha::ContentSecurityPolicy->new->nonce($test_nonce); + t::lib::Mocks::mock_config( 'opachtdocs', C4::Context->config('intranetdir') . '/t/mock_templates/opac-tmpl' ); + my $env = {}; my $app = sub { - my $resp = [ + require Koha::Plugins; # this should probably be "use Koha::Plugins;" in C4::Templates instead + my $template = C4::Templates::gettemplate( 'opac-csp.tt', 'opac' ); + my $resp = [ 200, [ 'Content-Type', @@ -60,7 +67,7 @@ subtest 'test Content-Security-Policy header' => sub { 'Content-Length', 12 ], - [ Koha::ContentSecurityPolicy->new->nonce ] + [ $template->output ] ]; return $resp; }; @@ -79,7 +86,7 @@ subtest 'test Content-Security-Policy header' => sub { "Response contains Content-Security-Policy header with the expected value" ); is( - $res->content, $test_nonce, + $res->content, '' . "\n", "Response contains generated nonce in the body" ); diff --git a/t/db_dependent/Koha/Template/Plugin/Koha.t b/t/db_dependent/Koha/Template/Plugin/Koha.t index b152553225e..2903fb020d1 100755 --- a/t/db_dependent/Koha/Template/Plugin/Koha.t +++ b/t/db_dependent/Koha/Template/Plugin/Koha.t @@ -17,7 +17,7 @@ use Modern::Perl; -use Test::More tests => 3; +use Test::More tests => 4; use Template::Context; use Template::Stash; @@ -79,3 +79,24 @@ subtest 'GenerateCSRF - New CSRF token generated every time we need one' => sub $schema->storage->txn_rollback; }; + +subtest 'CSPNonce' => sub { + plan tests => 1; + + $schema->storage->txn_begin; + + my $stash = Template::Stash->new( { sessionID => $session_id } ); + my $context = Template::Context->new( { STASH => $stash } ); + + my $plugin = Koha::Template::Plugin::Koha->new($context); + + my $csp = Koha::ContentSecurityPolicy->new; + my $nonce = $csp->nonce; + + my $token = $plugin->CSPNonce; + + is( $plugin->CSPNonce, $nonce, 'the correct nonce was provided' ); + + $schema->storage->txn_rollback; + +}; diff --git a/t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt b/t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt new file mode 100644 index 00000000000..80d65e6b711 --- /dev/null +++ b/t/mock_templates/opac-tmpl/bootstrap/en/modules/opac-csp.tt @@ -0,0 +1,2 @@ +[% USE raw %][% USE Koha %] -- 2.52.0