Include CSP nonces in headers for streaming responses

[Sarah Boyce]

Background:
The security team received a report from Michael Codispoti (codispoti) on HackerOne. This report was agreed to be handled in public as a hardening as the CSP middleware doesn't absolve developer responsibility to escape untrusted input.

Issue:
For a StreamingHttpResponse, the response headers are constructed before the streaming iterator is consumed.
If the iterator first accesses csp_nonce while producing the response body, the HTML receives a generated nonce after the CSP header has already been finalized.

This causes the streamed HTML to contain a nonce that is absent from the corresponding Content-Security-Policy header.

Regression test:

tests/middleware/test_csp.py

@@ -2 +2 @@
 from utils_tests.test_csp import basic_config, basic_policy
 
 from django.contrib.staticfiles.testing import StaticLiveServerTestCase
-from django.test import SimpleTestCase
+from django.http import StreamingHttpResponse
+from django.middleware.csp import ContentSecurityPolicyMiddleware
+from django.template import Context, Template
+from django.template.context_processors import csp
+from django.test import RequestFactory, SimpleTestCase
 from django.test.utils import modify_settings, override_settings
 from django.utils.csp import CSP
 
@@ -173 +177 @@
         )
 
 
+class CSPStreamingTests(SimpleTestCase):
+    @override_settings(
+        SECURE_CSP={
+            "default-src": [CSP.SELF],
+            "script-src": [CSP.NONCE],
+        },
+        SECURE_CSP_REPORT_ONLY={},
+    )
+    def test_nonce_generated_during_streaming_is_in_header(self):
+        request = RequestFactory().get("/")
+        template = Template('<script nonce="{{ csp_nonce }}"></script>')
+
+        def view(request):
+            def content():
+                yield template.render(Context(csp(request)))
+
+            return StreamingHttpResponse(content())
+
+        response = ContentSecurityPolicyMiddleware(view)(request)
+        body = b"".join(response.streaming_content).decode()
+
+        nonce = body.split('nonce="', 1)[1].split('"', 1)[0]
+        self.assertTrue(nonce)
+        self.assertIn(f"'nonce-{nonce}'", response["Content-Security-Policy"])
+
+
 @override_settings(
     ROOT_URLCONF="middleware.urls",

[Jacob Walls]

I guess we're taking away the ability of streaming responses to *not* have a nonce applied, but I suppose Django should solve the 80% use case and leave that detail to be worked out with custom middleware if needed.

[Sarah Boyce <42296566+sarahboyce@…>]

In 4e7c04fd:

Refs #37419 -- Moved CSP nonce detection helper to django.utils.csp for middleware reuse.

[Sarah Boyce <42296566+sarahboyce@…>]

In 3d3d943:

Fixed #37419 -- Included CSP nonces in headers for streaming responses.

Thank you Michael Codispoti (codispoti) for the report. Thank you to
Jake Howard, Jacob Walls and Rob Hudson for the reviews.