Allow direct editing of build policy output about django-csp HOT 1 OPEN

from csp.utils import build_policy, get_nonce_generator

def custom_build_policy(
        policies, overrides=None, nonce_generator=get_nonce_generator(),
        report_only=False):
    # Include your custom logic here to manipulate policies and overrides as desired

    csp = build_policy(policies, overrides=overrides, report_only=report_only)
    return csp

def construct_final_string(policy_parts):
    # Include your custom logic here to construct the final string
    # based on policy_parts

    final = "; ".join(policy_parts)
    final = " ".join([final, "report-uri /csp_reports/"])
    return final

def add_nonce(policy, source):
    # Include logic here to add a nonce to the specified source if necessary
    return source

# Update the original build_policy function to call the new functions
def build_policy(policies, overrides=None, nonce_generator=get_nonce_generator(),
                 report_only=False):
    policy_parts = []
    for policy in policies:
        for name, value in policy.items():
            # Handle the nonce directive here
            if name == 'nonce':
                continue
            elif name in ('default-src', 'script-src', 'style-src', 'img-src', 'connect-src', 
                 'font-src','media-src', 'object-src', 'child-src', 'frame-src', 'worker-src',
                 'manifest-src', 'base-uri', 'form-action', 'frame-ancestors',
                 'plugin-types', 'sandbox', 'navigate-to', 'block-all-mixed-content',
                 'upgrade-insecure-requests', 'require-sri-for'):
                # Split multiple directives where necessary
                values = [v.strip() for v in value.split(';') if v.strip()]

                # Add nonces to sources if necessary
                if nonce_generator and name in ('script-src', 'style-src', 'default-src'):
                    values = [add_nonce(policy, v) if 'nonce' not in v else v for v in values]

                # Append the directive with its values
                policy_parts.append(' '.join([name] + values))

    final = construct_final_string(policy_parts)
    return final

from django.test import TestCase, RequestFactory
from django.http import HttpResponse
from django.urls import reverse
from django_csp.middleware import CSPMiddleware

class CSPMiddlewareTests(TestCase):
    def setUp(self):
        self.factory = RequestFactory()

    def test_can_process_request(self):
        request = self.factory.get(reverse('home'))
        middleware = CSPMiddleware(None)
        response = middleware.process_request(request)
        self.assertIsNone(response)

    def test_can_pre_process_response_with_empty_policy(self):
        request = self.factory.get(reverse('home'))
        middleware = CSPMiddleware(lambda r: HttpResponse())
        response = middleware(request)
        self.assertIn('Content-Security-Policy', response)
        self.assertEqual(response['Content-Security-Policy'], "default-src 'self'")

    def test_can_pre_process_response_with_non_empty_policy(self):
        request = self.factory.get(reverse('home'))
        middleware = CSPMiddleware(lambda r: HttpResponse())
        middleware.policy = {'default-src': ['www.example.com', 'maxcdn.bootstrapcdn.com']}
        response = middleware(request)
        self.assertIn('Content-Security-Policy', response)
        self.assertEqual(response['Content-Security-Policy'], "default-src www.example.com maxcdn.bootstrapcdn.com")

def build_policy(policies, overrides=None, nonce_generator=get_nonce_generator(),
                 report_only=False):
    csp = {}
    for policy in policies:
        for name, value in policy.items():
            if name == 'nonce':
                continue
            elif name in ('default-src', 'script-src', 'style-src', 'img-src', 'connect-src', 
                 'font-src','media-src', 'object-src', 'child-src', 'frame-src', 'worker-src',
                 'manifest-src', 'base-uri', 'form-action', 'frame-ancestors',
                 'plugin-types', 'sandbox', 'navigate-to', 'block-all-mixed-content',
                 'upgrade-insecure-requests', 'require-sri-for'):
                values = [v.strip() for v in value.split(';') if v.strip()]
                if nonce_generator and name in ('script-src', 'style-src', 'default-src'):
                    values = [add_nonce(policy, v) if 'nonce' not in v else v for v in values]
                csp[name] = values

    return csp

def add_nonce_to_policy(policy, source):
    return source

def construct_csp_header(policy_parts):
    final = "; ".join(policy_parts)
    final = " ".join([final, "report-uri /csp_reports/"])
    return final

from django.test import TestCase
from django_csp.utils import build_policy

class BuildPolicyTestCase(TestCase):
    def test_build_policy(self):
        policies = [
            {'default-src': "'self'"},
            {'script-src': "'self'"},
            {'style-src': "'self'"},
            {'img-src': "'self'"},
        ]
        overrides = {'script-src': "'unsafe-inline'"}
        csp = build_policy(policies, overrides=overrides)

        expected_csp = {
            'default-src': ["'self'"],
            'script-src': ["'self'", "'unsafe-inline'"],
            'style-src': ["'self'"],
            'img-src': ["'self'"],
        }
        self.assertEqual(csp, expected_csp)