Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Convert FalseLazyObject to CheckableLazyObject, use to wrap nonce #270

Merged
merged 9 commits into from
Mar 6, 2025

Conversation

jwhitlock
Copy link
Member

To further fix #269, add and test a class CheckableLazyObject, which tests True if the object has been accessed and the value generated, and False if it is still "lazy".

Use this as the wrapper for request.csp_nonce, so that code can test if the nonce is activated before using it:

if (request.csp_nonce):
  print(f"The nonce is set to {request.csp_nonce}")
else:
  print("The nonce has not been set.")

This required a change to the template helpers, to ensure the nonce was read with str(request.csp_nonce). Otherwise, they are treated as falsey.

Copy link
Member

@robhudson robhudson left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good stuff.

@jwhitlock jwhitlock requested a review from robhudson March 6, 2025 16:06
@jwhitlock jwhitlock merged commit 40c89d4 into mozilla:main Mar 6, 2025
8 checks passed
@jwhitlock jwhitlock deleted the false-nonce-628 branch March 6, 2025 16:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants