subject:"Re\: \[Django\] #36784\: Add CSP support to Django's script object and media objects"

#36784: Add CSP support to Django's script object and media objects
-+-
 Reporter:  Johannes Maron   |Owner:  Natalia
 |  Bidart
 Type:  New feature  |   Status:  closed
Component:  Forms|  Version:  6.0
 Severity:  Normal   |   Resolution:  fixed
 Keywords:   | Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by nessita <124304+nessita@…>):

 * resolution:   => fixed
 * status:  assigned => closed

Comment:

 In [changeset:"5686ce41958b21f0ae5bfa290e8d4420a6349c1b" 5686ce41]:
 {{{#!CommitTicketReference repository=""
 revision="5686ce41958b21f0ae5bfa290e8d4420a6349c1b"
 Fixed #36784 -- Added csp_nonce_attr template tag for CSP nonce inclusion.

 New default tag `{% csp_nonce_attr %}` was added for explicit CSP nonce
 inclusion into `

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
-+-
 Reporter:  Johannes Maron   |Owner:  Natalia
 |  Bidart
 Type:  New feature  |   Status:  assigned
Component:  Forms|  Version:  6.0
 Severity:  Normal   |   Resolution:
 Keywords:   | Triage Stage:  Ready for
 |  checkin
Has patch:  1|  Needs documentation:  0
  Needs tests:  0|  Patch needs improvement:  0
Easy pickings:  0|UI/UX:  0
-+-
Changes (by Jacob Walls):

 * stage:  Accepted => Ready for checkin

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019dff02f2b3-c9c37c81-df26-4ab6-b310-3b84961b9cb8-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Natalia Bidart
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--
Changes (by Natalia Bidart):

 * needs_better_patch:  1 => 0
 * needs_tests:  1 => 0

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019dfef34187-0d2c25c1-55dc-4350-898c-023e6abe2821-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Natalia Bidart
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  1   |  Patch needs improvement:  1
Easy pickings:  0   |UI/UX:  0
+--
Changes (by Jacob Walls):

 * needs_better_patch:  0 => 1
 * needs_tests:  0 => 1

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019dfe6ba10c-6dd6abab-322e-4a01-b627-f72daffb6b33-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Natalia Bidart
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--
Changes (by Natalia Bidart):

 * needs_better_patch:  1 => 0
 * needs_tests:  1 => 0

Comment:

 Isolated the work solving this issue alone in
 [https://github.com/django/django/pull/21235 this PR].
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019dfe182dc3-26db5730-f7d0-4bf6-855a-898e26fdb4cb-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Natalia Bidart
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  1   |  Patch needs improvement:  1
Easy pickings:  0   |UI/UX:  0
+--
Changes (by Johannes Maron):

 * needs_better_patch:  0 => 1
 * needs_tests:  0 => 1

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019df913a6ce-afdda53b-39d9-4945-bee2-933688551ae7-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
Reporter: Johannes Maron |Owner: Natalia Bidart
Type: New feature | Status: assigned
Component: Forms | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 |UI/UX: 0
+--
Comment (by Johannes Maron):

Replying to [comment:37 Natalia Bidart]:

> Timeline wise, on March 24th, I indicated on comment:23 that I had a
draft branch for an alternative approach and that I would take ownership
to polish it, explicitly inviting reviews. On March 25, I created a forum
post including a polished PR implementing that option. Given that
sequence, my PR was not intended as taking over someone else's work, but
rather continuing along the process of proposing, validating, and refining
solutions in the open, with concrete implementations to support
discussion.

Very kindly, I don't believe this is a healthy discussion that will lead
to a meaningful outcome.

I have reviewed your PR prior to posting the RFC to the steering council
and the security team but didn't leave any comments to be mindful of your
time. I will now do another thorough round.

> Introduces tight coupling between forms/media and CSP, pulling a
request-specific concern (the nonce) into what is otherwise a static,
declarative API.

I was aiming for specificity deliberately to minimize vulnerability
vectors. It is a security feature, and the ability to inject attributes to
static assets in the template is new.

> Makes Media rendering nonce-aware with render(nonce=...), making the
nonce receive special treatment in forms definitions, rather than
following Django's existing, generic attribute injection pattern.

Same as above.

> Bounds the solution to DTL internals and does not keep the path open for
other template engines.

Where though? Maybe we are talking about different code?

> Lastly, it would be very valuable to have your review on my PR, since it
would help ensure alignment on the current state, progress, and next
steps.

Thank you, I would have appreciated a review from you too.
--
Ticket URL:
Django
The Web framework for perfectionists with deadlines.

--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/0107019df86f6f02-caae4cd2-3b30-46c0-80c2-a9a04161e1d3-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Natalia Bidart
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--
Changes (by Natalia Bidart):

 * owner:  Johannes Maron => Natalia Bidart

-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019df84ab01f-9c16e0a0-44d9-4dbb-9303-f2aa233061c0-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
Reporter: Johannes Maron |Owner: Johannes Maron
Type: New feature | Status: assigned
Component: Forms | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 |UI/UX: 0
+--
Comment (by Natalia Bidart):

Replying to [comment:36 Johannes Maron]:
> Please don't take this the wrong way, and I didn't say this before, but
since we're here again, it feels fairly discouraging to have a
contribution hijacked that people committed a lot of time and effort to.
The support is applaudable, but I also see how first-time contributors
might be discouraged by this.

Thank you for raising this, I appreciate your honesty. From my view, I
think it would be important to consider the earlier comments and
proposals, as the current framing does not seem to fully reflect that. As
it stands, it comes across as somewhat incomplete, which I feel is a bit
unfair. My PR has been available and ready for review since March 24, as
part of the earlier proposal and follow-up discussion. That work involved
revisiting the initial design direction and refining it toward what I
believe is a more Django-idiomatic approach.

Timeline wise, on March 24th, I indicated on comment:23 that I had a draft
branch for an alternative approach and that I would take ownership to
polish it, explicitly inviting reviews. On March 25, I created a forum
post including a polished PR implementing that option. Given that
sequence, my PR was not intended as taking over someone else's work, but
rather continuing along the process of proposing, validating, and refining
solutions in the open, with concrete implementations to support
discussion.

Looking at the current PRs, there is clear alignment in direction
(explicit opt-in via template tag usage), but a notable difference in
architectural approach. One of the approaches on
[https://github.com/django/django/pull/20763/ PR #20763] in particular:

* Introduces tight coupling between forms/media and CSP, pulling a
request-specific concern (the nonce) into what is otherwise a static,
declarative API.
* Makes `Media` rendering nonce-aware with `render(nonce=...)`, making the
nonce receive special treatment in forms definitions, rather than
following Django's existing, generic attribute injection pattern.
* Bounds the solution to DTL internals and does not keep the path open for
other template engines.

From a process perspective, you are already a co-author on the
[https://github.com/django/django/pull/21010 PR #21010], and your work
done so far has directly contributed to moving this forward. The goal here
is to converge on the right design rather than competing implementations.
I would lean towards the option that minimizes coupling and keeps concerns
clearly separated.

Lastly, it would be very valuable to have your review on my PR, since it
would help ensure alignment on the current state, progress, and next
steps.
--
Ticket URL:
Django
The Web framework for perfectionists with deadlines.

--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/0107019df84a6141-c4fbbac4-424c-423c-beb7-0d3d3b8702c9-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Johannes Maron
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--
Comment (by Johannes Maron):

 Please don't take this the wrong way, and I didn't say this before, but
 since we're here again, it feels fairly discouraging to have a
 contribution hijacked that people committed a lot of time and effort to.
 The support is applaudable, but I also see how first-time contributors
 might be discouraged by this.
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019df7cd555b-d543e69b-21da-4970-a3bf-e32d082b5575-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Johannes Maron
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  0
Easy pickings:  0   |UI/UX:  0
+--
Changes (by Johannes Maron):

 * needs_better_patch:  1 => 0
 * owner:  Natalia Bidart => Johannes Maron

Comment:

 Don't get this the wrong way, but I already FINISHED the work and
 @-mentioned Natalia over a week ago.
 Just review my PR. I have time until the feature freeze to move this over
 the finish line.

 I didn't update Trac because I cared about Natalia's feedback before
 getting more fellows involved again.
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019df7c6400d-8f93d615-4f9e-44c7-9421-24a7d2ddf9b1-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

2026-05-04 Thread Django

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Natalia Bidart
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  1
Easy pickings:  0   |UI/UX:  0
+--
Comment (by Natalia Bidart):

 I'll work on incorporating the PR feedback today. Johannes, your review is
 very much appreciated!
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019df3909249-a9461d91-941f-49a8-8074-ef602a7539cc-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

2026-05-04 Thread Django

#36784: Add CSP support to Django's script object and media objects
+--
Reporter: Johannes Maron |Owner: Natalia Bidart
Type: New feature | Status: assigned
Component: Forms | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 |UI/UX: 0
+--
Changes (by Jacob Walls):

* owner: Johannes Maron => Natalia Bidart

Comment:

Replying to [comment:32 Johannes Maron]:
> Natalia, I think we reached somewhat of a consensus on the form, right?
So even without the steering council, I'd be ok to push forward.

That was my understanding also!

> I'll continue my work later today, to be mindful of your time, and add
you as a co-author.

I mentioned reviewing Natalia's
[https://github.com/django/django/pull/21010 PR] in comment:31. The
feature freeze is in two weeks, so for me, the most practical thing would
be to iterate on that PR, as it's already had one thorough review. We will
be mindful as always to credit co-authors and reviewers, of course. Would
that work? I would very much appreciate having your review before we land
anything!
--
Ticket URL:
Django
The Web framework for perfectionists with deadlines.

--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/0107019df37105d8-dbf7effc-5bac-4525-bf33-aef6ca0a711a-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

2026-04-29 Thread Django

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Johannes Maron
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  1
Easy pickings:  0   |UI/UX:  0
+--
Comment (by Johannes Maron):

 Natalia, I think we reached somewhat of a consensus on the form, right? So
 even without the steering council, I'd be ok to push forward.

 I'll continue my work later today, to be mindful of your time, and add you
 as a co-author.
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019dd8eef584-fb12e253-328a-4a69-9b07-18a5a94661a8-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

2026-04-28 Thread Django

#36784: Add CSP support to Django's script object and media objects
+--
Reporter: Johannes Maron |Owner: Johannes Maron
Type: New feature | Status: assigned
Component: Forms | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 |UI/UX: 0
+--
Comment (by Jacob Walls):

I just made an initial review of the
[https://github.com/django/django/pull/21010 PR that was announced on that
forum thread]. It follows option 1, the template-tag approach. The code is
not very involved. IMO, among the "cons" from Joe's table in comment:25,
all that leaves are the updates needed in 3rd party packages, which is
spun as a "pro" (manual review) by some on the forum thread.

In other words, I think the PR looks very good. I left small questions.

Returning to this earlier aside:

> I believe my point isn't "can we trust the context" (We don't; that's
why we're escaping template variables.)

My point was that we should be able to trust that the context does not
contain unexpected, arbitrary key-value pairs. (That is to say, we would
not expect an attacker would be able to get `{"csp_nonce": "evil"}` into
the context somehow.) That's different from acknowledging that the DTL
auto-HTML-escapes template variables. Does that sound right?

(I'd also be very happy to see additional reviews on the above PR!)
--
Ticket URL:
Django
The Web framework for perfectionists with deadlines.

--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/0107019dd61fd32a-1ee6a1c9-25e8-47cd-a69c-3eb932675d16-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Johannes Maron
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  1
Easy pickings:  0   |UI/UX:  0
+--
Comment (by Natalia Bidart):

 Forum post here: https://forum.djangoproject.com/t/csp-nonce-support-for-
 form-media-classes-and-admin-scripts/44698
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d260ac553-af3fd1ef-054e-43a6-a0fa-f3ee371318f2-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
Reporter: Johannes Maron |Owner: Johannes Maron
Type: New feature | Status: assigned
Component: Forms | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 |UI/UX: 0
+--
Comment (by Natalia Bidart):

Thank you everyone for the further commentary.

Given that there is a closely related ticket (#36825) covering the same
problem space from the admin's angle, and that Trac is not the best venue
to gather broad community input on a design question of this scope
(audience here is very limited), I will open a Django Forum post to
consolidate and continue the discussion. A link will be added here once it
is up, and I would kindly ask everyone to follow up there. The Security
team and SC are present on that platform and more "pingeable", while the
broader community can also contribute to the conversation.
--
Ticket URL:
Django
The Web framework for perfectionists with deadlines.

--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/0107019d259fa6de-381ead82-fbc0-4f9d-8198-b631c6c256ce-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
Reporter: Johannes Maron |Owner: Johannes Maron
Type: New feature | Status: assigned
Component: Forms | Version: 6.0
Severity: Normal | Resolution:
Keywords: | Triage Stage: Accepted
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 1
Easy pickings: 0 |UI/UX: 0
+--
Comment (by Johannes Maron):

Hi Jacob,

hm… I hoped to point to more cons than just security considerations in my
previous comment. If you are referring to my deliberation on the PR, yes,
that one is a little trickier.
I believe my point isn't "can we trust the context" (We don't; that's why
we're escaping template variables.) – It's rather, can we trust everyone
with the context? A radical example would be changing `__html__` to always
ingest the full context. I would consider this VERY unsafe (to an
injection attack). We should always explicitly limit the context, but
there are multiple ways to do it.

Unrelated to the context, my other concern was that you might not trust a
3rd party to use safe script sources. I may trust the package, but not its
supply chain. E.G., Django's GeoAdmin uses scripts from a CDN, which opens
the door to a supply chain attack. The automatic solution would be to
unknowingly trust those resources. It does go against the idea of CSP a
little, where you want to explicitly review and whitelist browser
resources.

My main concern with any solution is making any changes to the template
engine. Both Django and Jinja had their fair share of security
vulnerabilities in their early days. New code simply means a new
opportunity to screw up. I consider myself experienced enough to know that
I make mistakes :P

Lastly, yes, 6.1 would be great, since this has been a bit of a pain point
in multiple issues. But Django has thought of patience. ;)

Hi Tim,

Yes, that's why I emphasized the "people with deadlines" part. It should
be easy to do the right (secure) thing. Now we just need to figure out
what that is.

Cheers,
Joe
--
Ticket URL:
Django
The Web framework for perfectionists with deadlines.

--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion visit
https://groups.google.com/d/msgid/django-updates/0107019d252fb11b-ecb28ebc-3f5d-4fc9-8480-6aa5203f94ff-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Johannes Maron
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  1
Easy pickings:  0   |UI/UX:  0
+--
Comment (by Timothy Schilling):

 I think for most Django devs who are not super familiar with CSP, but
 still want to build out robust applications, avoiding `{{
 form.media|with_nonce:csp_nonce }}` would be ideal.
 
[https://discord.com/channels/856567261900832808/859997770274045954/1476226860705644795
 On the Django Discord], there were several long-time django devs who
 agreed that the automatic injection of the nonce would be a preferable
 API, with nobody preferring the explicit template tag.
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d2521eda9-38f68ef0-f2c1-47b1-a395-8a9b86d98d15-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Johannes Maron
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  1
Easy pickings:  0   |UI/UX:  0
+--
Comment (by Jacob Walls):

 Can I ask for some clarification on the security angle? It seems all of
 the "cons" reduce to the proposition that we ''trust'' at least some
 portion of the `request.context`. (Either potentially *any* key with a
 reusable `context` filter, or just a hard-coded key for csp nonces.) I
 thought `request.context` was already trusted, so I'm having to grasp at
 straws to imagine the concern: is it that in a stack of reusable apps not
 totally under your control, you cannot reason about whether or not the
 contents of `request.context` have been sanitized if user-controlled? Or
 something else?

 
 I'm glad to have the Steering Council's eyes here to ratify an approach,
 as I'm very keen to advance this for 6.1 (feature freeze mid-May).
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d24ec8022-a9d999d0-5d55-48b9-ab04-695a284b9ea3-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects

#36784: Add CSP support to Django's script object and media objects
+--
 Reporter:  Johannes Maron  |Owner:  Johannes Maron
 Type:  New feature |   Status:  assigned
Component:  Forms   |  Version:  6.0
 Severity:  Normal  |   Resolution:
 Keywords:  | Triage Stage:  Accepted
Has patch:  1   |  Needs documentation:  0
  Needs tests:  0   |  Patch needs improvement:  1
Easy pickings:  0   |UI/UX:  0
+--
Comment (by Johannes Maron):

 == Request for Comment: CSP nonce in form media

 **Goal:** We want to provide a way to render form media with CSP nonce
 values (currently impossible).

 There are multiple ways to go about this, all with their pros and cons. We
 should put a strong emphasis on dev usability (for people with deadlines)
 while weighing the security considerations (marked with an **(S)**).
 Importantly, any approach (other than a tag) may set a precedent and must
 be considered beyond the scope of this ticket.

 I would kindly ask the steering council and the security team for an
 official comment, including a short explanation for future reference.

 === Tag-based

 {{{
 {% with_nonce form.media %}
 }}}

 ||= Pros =||= Cons =||
 || No changes to the template engine are required.  || Requires updates to
 admin templates & 3rd-party packages. ||
 || Consistent with current logic, that rendering is handled in tags, like
 `csrf`.  || Fairly code-intense in Django. ||
 || **(S)** Explicit choice to add nonce values to form media. || ||

 === Filter-based w/ explicit nonce

 {{{
 {% if csp_nonce %}
   {{ form.media|with_nonce:csp_nonce }}
 {% endif %}

 

 {% if csp_nonce %}
   {{ form.media|context:csp_nonce }}
 {% endif %}
 }}}

 ||= Pros =||= Cons =||
 || No changes to the template engine are required.  || Requires updates to
 admin templates & 3rd-party packages. ||
 || **(S)** Explicit choice to add nonce values to form media. || Requires
 case handling to prevent `VariableDoesNotExist` in Django's admin and 3rd-
 party packages. (The context processor needs to be added to a project.)
 ||
 ||  || Fairly complex template syntax, including branching. ||



 === Filter-based w/ implicit context

 {{{
 {{ form.media|with_nonce }}
 
 {{ form.media|context:"csp_nonce" }}
 }}}

 ||= Pros =||= Cons =||
 || **(S)** Explicit choice to add nonce values to form media.  || Requires
 updates to admin templates & 3rd-party packages. ||
 || A `context` filter would be reusable. || A `context` filter would be
 reusable and requires some form of a public interface. ||
 ||  || **(S)** Requires changes to the template engines. Filters are
 currently not context-aware.  ||

 === Automatic injection (if nonce in context)

 {{{
 {{ form.media }}
 }}}

 ||= Pros =||= Cons =||
 || No updates to existing templates required (incl. 3rd party). || **(S)**
 No explicit opt-in `nonce` in form media. However, the context processor
 and the nonce option in CSP need to be enabled. ||
 || Simple (as is) syntax. || **(S)** Requires a new "special" object that
 gets rendered with a nonce. ||

 === Author's note

 I have implemented all versions and don't have a strong preference. Tag-
 based seems the most in line with Django's current idioms, yet I do like
 the simplicity of the automatic approach. Both filter approaches come with
 a fair bit of complexity for either Django or its users, which is why I,
 personally, wouldn't endorse them. The tag-based implementation was my
 first approach; however, it does require more new code than any other
 solution (similar to CSRF).
-- 
Ticket URL: 
Django 
The Web framework for perfectionists with deadlines.

-- 
You received this message because you are subscribed to the Google Groups 
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion visit 
https://groups.google.com/d/msgid/django-updates/0107019d2495d0e5-841ee651-a2c9-4b53-8e47-4d4c1207edc4-00%40eu-central-1.amazonses.com.

Re: [Django] #36784: Add CSP support to Django's script object and media objects