Create csp.extensions.NoncedStyle extension

[GergelyKalmar]

We're using the csp.extensions.NoncedScript extension in our Jinja templates and it has been very useful. We would love if there was a similar template tag that we could use for inline styles as well.

[stevejalim]

Thanks @GergelyKalmar - makes sense and doesn't look too big a lift. I'm triaging things at the moment, but first thought is that this could be good one as a small contribution, so will label it and see if anyone is interested

[karolyi]

I took a different approach to solve this problem on my own.

In my tools package, I created a render_nonce_attr function that will render a nonce attribute, provided you'll pass it the request in the jinja template:

https://git.ksol.io/karolyi/py-ktools/src/commit/6a540345dce1b94826f09ef3daad3696df94b252/src/ktools/django/jinja/extensions.py#L102

And:

https://git.ksol.io/karolyi/py-ktools/src/branch/master/src/ktools/django/csp/tags.py

Then I just render everything with this tag added from the template, e.g.:

<script type="text/javascript" src="{{ static('ts-outdated-browser.js')}}"{{ render_nonce_attr(request=request) }}></script>
<script{{ render_nonce_attr(request=request) }} type="text/javascript">alert('hello world')</script>
<link rel="stylesheet" href="{{ static('outdatedbrowser/outdatedbrowser.min.css') }}" type="text/css"{{ render_nonce_attr(request=request) }}/>

... and so on, you get the gist of it.

Also, I've committed significant upgrades to the django-webpack project, as well as the django-debug-toolbar, and others I don't remember off the top of my head. If you you look at the KToolsDjangoExtension I linked in the first link, there are even more helpers for CSP stuff, for example the Form.Media renderer that will add nonces to form media tags, provided you wrap them up.

The tools are free to be used, I put it to good use in many of my own projects.

[karolyi]

Btw, I use 4.0 from this repo, and with all my modifications I mentioned above, it works nicely in a huge project that is extensively used.