From 958f75b109fef69fc503e805cca25e186342909d Mon Sep 17 00:00:00 2001 From: luelista Date: Fri, 7 Aug 2026 14:36:46 +0200 Subject: [PATCH] Add tests to prevent reintroducing CSP nonces (Z#23240534) (#6409) As discussed in PR #6387 --- src/tests/control/test_views.py | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) diff --git a/src/tests/control/test_views.py b/src/tests/control/test_views.py index f169df7024..1560affe12 100644 --- a/src/tests/control/test_views.py +++ b/src/tests/control/test_views.py @@ -224,3 +224,28 @@ def test_one_view(logged_in_client, url, expected, event, item, item_category, o ) response = logged_in_client.get(url) assert response.status_code == expected + + # Do not reintroduce any CSP nonces into control responses, as discussed in PR #6387 + if response['Content-Type'] != 'application/json': + assert 'script-src' in response['Content-Security-Policy'] + assert 'nonce-' not in response['Content-Security-Policy'] + + +@pytest.mark.parametrize('url', [ + '/control/login', + '/', + '/{orga}/{event}/', +]) +@pytest.mark.django_db +def test_csp_header_unauthenticated(client, url, event): + # Do not reintroduce any CSP nonces into most presale responses, as discussed in PR #6387 + with scope(organizer=event.organizer): + url = url.format( + event=event.slug, orga=event.organizer.slug, + ) + event.live = True + event.save() + response = client.get(url) + assert response.status_code == 200 + assert 'script-src' in response['Content-Security-Policy'] + assert 'nonce-' not in response['Content-Security-Policy']