Comments (9)
Hi. My apologies for letting this languish a bit. I have permissions on this repo but didn't realized that the active maintainers had both left Mozilla and left the project. I'm looking at #36 but it's a lot, so I'm going to have to come up to speed and see what we need to do to get it done. There is some activity within Mozilla on this now though, so hopefully we'll get it done soon. Thanks for filing.
from django-csp.
Hi @kunambi and @some1ataplace - I work on @pmac's team and we now have appropriate access to manage/maintain the project.
Looking at #36, I definitely agree that it's a lot for anyone to wrap their head around cold and so I am thinking about the best approach for getting things over the line.
@some1ataplace, if I/we can promise that we'll get the code merged and releases done, I am politely wondering if you would be willing and have time available to complete #36? I'm asking this based on your very helpful comment here, plus the fact that @DylanYoung
seems to have gone quiet on that thread. I hope this doesn't seem too cheeky to suggest -- and no worries if it's not viable. If you'd prefer to discuss this directly, feel free to email me on [email protected]
Thanks,
Steve
from django-csp.
Updating the community for where we're at now.
While the project fell into an unmaintained state for a while, we've been trying to a ring-fence some time for it.
To that end, I'm currently planning to:
- get it back to health - see #204
- get a new release - initially a 3.8rc with changes from #204 in it, then a 3.8 which will be functionally the same as 3.7 (but I want to check the commits over the last couple of years to confirm that nothing has changed in behaviour)
- review and triage outstanding Issues and PRs
- including dealing with #36 which must be solved if this is to potentially still make it into Django Core (and we need to check back in with Django see whether they still want to do this)
If you've been holding of contributing because (understandably) it's been very, very quiet here, please rest assured that I (and @pmac and @robhudson!) are around and now have appropriate project access to make things happen again.
from django-csp.
Not sure, we are all asking the same questions.
Last time this happened, had to go on Matrix chat and ask for someone from Mozilla who hangs out there to pick up the project again because it gets abandoned because of things like that.
from django-csp.
Read a bit more. It seems that django-csp will be included in django core (#135), as soon as #36 is resolved, and that seems on it's way.
https://code.djangoproject.com/ticket/15727
from django-csp.
Yes I know about that. But since that PR is under review and is being drafted, we need to first get someone from Mozilla to maintain the project again and push the changes so that the main django core devs can implement it in a future version of django.
from django-csp.
Dear @pmac ,
It's been a little over a year, do you have any new information to share?
from django-csp.
@stevejalim To be honest, I am no longer using this library due to not hearing anything back for such a long time and am instead handling CSP on my website myself using middleware. However, I don't wish to do that if django core implements django-csp library directly after 36 is complete.
For my latest replies on 36, I was not sure what I was doing or how exactly the report-only feature works in the first place. I was asking an earlier version of ChatGPT for help without actually testing the code in hopes of any of the replies sparking somebody to do something or get some ideas for solving the issue. So most of that code I posted is probably wrong due to most AI making stuff up.
With newer better versions of the AI though, I am sure somebody could figure this whole thing out. Sorry I could not be of more help. I wish for you and your team and this project much success.
from django-csp.
Related Issues (20)
- nonce, request.csp_nonce and {% script %} all fail to render a nonce HOT 8
- Documentation needs to be updated to mention INSTALLED_APPS HOT 4
- Decorators depending on request method types HOT 3
- broken admin filters HOT 3
- Modify CSP based on database? HOT 1
- `CSP_INCLUDE_NONCE_IN` not working? HOT 4
- New release? HOT 11
- Unrecognized Content Security Policy directive 'worker-src' in Safari Browser HOT 2
- Building the wheel doesn't work HOT 4
- Backwards compatible method of adding 'strict-dynamic' as suffix HOT 1
- Don't include nonces in default-src when CSP_INCLUDE_NONCE_IN is unset / an empty list HOT 3
- Allow direct editing of build policy output HOT 1
- Documentation for context processor HOT 5
- Deprecated Features HOT 5
- interested in adding typing (mypy) support? HOT 4
- Support clearing/unsetting directives via decorator HOT 7
- Support different sets of rules for paths like /admin HOT 8
- Move project to pyproject.toml HOT 1
- Create csp.extensions.NoncedStyle extension HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from django-csp.