deps: upgrade django-csp to version 4

Refs: KK-1467

Author: nicobav

kukkuu/consts.py

@@ -38,16 +38,3 @@
 AUTHENTICATION_ERROR = "AUTHENTICATION_ERROR"
 AUTHENTICATION_EXPIRED_ERROR = "AUTHENTICATION_EXPIRED_ERROR"
 VERIFICATION_TOKEN_INVALID_ERROR = "VERIFICATION_TOKEN_INVALID_ERROR"
-
-
-class CSP:
-    """The “special” source values of 'self', 'unsafe-inline', 'unsafe-eval', 'none'
-    and hash-source ('sha256-...') must be quoted! e.g.: CSP_DEFAULT_SRC = ("'self'",).
-    Without quotes they will not work as intended.
-    Ref. https://django-csp.readthedocs.io/en/stable/configuration.html.
-    """
-
-    SELF = "'self'"
-    NONE = "'none'"
-    UNSAFE_INLINE = "'unsafe-inline'"
-    UNSAFE_EVAL = "'unsafe-eval'"

kukkuu/settings.py

@@ -6,14 +6,14 @@
 
 import environ
 import sentry_sdk
+from csp.constants import SELF, UNSAFE_EVAL, UNSAFE_INLINE
 from django.core.exceptions import ImproperlyConfigured
 from django.utils.translation import gettext_lazy as _
 from helusers.defaults import SOCIAL_AUTH_PIPELINE  # noqa: F401
 from jose import ExpiredSignatureError
 from sentry_sdk.integrations.django import DjangoIntegration
 from sentry_sdk.types import Event, Hint
 
-from kukkuu.consts import CSP
 from kukkuu.exceptions import AuthenticationExpiredError
 from kukkuu.tests.utils.jwt_utils import is_valid_256_bit_key
 
@@ -327,42 +327,36 @@ def sentry_before_send(event: Event, hint: Hint):
 CORS_ALLOWED_ORIGIN_REGEXES = env("CORS_ALLOWED_ORIGIN_REGEXES")
 CORS_ALLOW_ALL_ORIGINS = env("CORS_ALLOW_ALL_ORIGINS")
 
-# Configure the default CSP rule for different source types
-CSP_DEFAULT_SRC = ["'self'"]
 
-# CSP_STYLE_SRC includes 'unsafe-inline' for inline styles added by `django-helusers`
-# and `SpectacularRedocView`.
-CSP_STYLE_SRC = [
-    CSP.SELF,
-    CSP.UNSAFE_INLINE,
-    "cdn.jsdelivr.net",
-    "fonts.googleapis.com",
-]
-
-# CSP_SCRIPT_SRC includes 'unsafe-eval' for inline scripts added by
-# `SpectacularRedocView`
-CSP_SCRIPT_SRC = [
-    CSP.SELF,
-    CSP.UNSAFE_EVAL,
-    "cdn.jsdelivr.net",
-    "blob:",
-]
-
-# CSP_FONT_SRC includes Google fonts fetched by `SpectacularRedocView`
-CSP_FONT_SRC = [
-    CSP.SELF,
-    "fonts.googleapis.com",
-    "fonts.gstatic.com",
-    "data:",  # /graphql/ endpoint uses "data:font/woff2"
-]
-
-# CSP_IMG_SRC includes sources for images fetched by `SpectacularRedocView`
-CSP_IMG_SRC = [
-    CSP.SELF,
-    "cdn.redoc.ly",
-    "blob:",
-    "data:",
-]
+CONTENT_SECURITY_POLICY = {
+    "DIRECTIVES": {
+        "default-src": [SELF],
+        "style-src": [
+            SELF,
+            UNSAFE_INLINE,
+            "cdn.jsdelivr.net",
+            "fonts.googleapis.com",
+        ],
+        "script-src": [
+            SELF,
+            UNSAFE_EVAL,
+            "cdn.jsdelivr.net",
+            "blob:",
+        ],
+        "font-src": [
+            SELF,
+            "fonts.googleapis.com",
+            "fonts.gstatic.com",
+            "data:",  # /graphql/ endpoint uses "data:font/woff2"
+        ],
+        "img-src": [
+            SELF,
+            "cdn.redoc.ly",
+            "blob:",
+            "data:",
+        ],
+    }
+}
 
 AUTH_USER_MODEL = "users.User"
 

kukkuu/urls.py

@@ -1,3 +1,4 @@
+from csp.constants import UNSAFE_INLINE
 from csp.decorators import csp_update
 from django.conf import settings
 from django.conf.urls.static import static
@@ -13,7 +14,6 @@
 from common.utils import get_api_version
 from custom_health_checks.views import HealthCheckJSONView
 from kukkuu import __version__
-from kukkuu.consts import CSP
 from kukkuu.views import SentryGraphQLView
 from reports.api import ChildViewSet, EventGroupViewSet, EventViewSet, VenueViewSet
 
@@ -32,8 +32,10 @@
 
 # Add unsafe-inline to enable GraphiQL interface at /graphql/
 @csp_update(
-    SCRIPT_SRC=settings.CSP_SCRIPT_SRC
-    + ([CSP.UNSAFE_INLINE] if IS_GRAPHIQL_ENABLED else [])
+    {
+        "script-src": settings.CONTENT_SECURITY_POLICY["DIRECTIVES"]["script-src"]
+        + ([UNSAFE_INLINE] if IS_GRAPHIQL_ENABLED else [])
+    }
 )
 @csrf_exempt
 def graphql_view(request, *args, **kwargs):

requirements.txt

@@ -301,9 +301,9 @@ django-cors-headers==4.7.0 \
     --hash=sha256:6fdf31bf9c6d6448ba09ef57157db2268d515d94fc5c89a0a1028e1fc03ee52b \
     --hash=sha256:f1c125dcd58479fe7a67fe2499c16ee38b81b397463cf025f0e2c42937421070
     # via -r requirements.in
-django-csp==3.8 \
-    --hash=sha256:19b2978b03fcd73517d7d67acbc04fbbcaec0facc3e83baa502965892d1e0719 \
-    --hash=sha256:ef0f1a9f7d8da68ae6e169c02e9ac661c0ecf04db70e0d1d85640512a68471c0
+django-csp==4.0 \
+    --hash=sha256:b27010bb702eb20a3dad329178df2b61a2b82d338b70fbdc13c3a3bd28712833 \
+    --hash=sha256:d5a0a05463a6b75a4f1fc1828c58c89af8db9364d09fc6e12f122b4d7f3d00dc
     # via -r requirements.in
 django-environ==0.12.0 \
     --hash=sha256:227dc891453dd5bde769c3449cf4a74b6f2ee8f7ab2361c93a07068f4179041a \
@@ -518,7 +518,9 @@ oauthlib==3.2.2 \
 packaging==24.2 \
     --hash=sha256:09abb1bccd265c01f4a3aa3f7a7db064b36514d2cba19a2f694fe6150451a759 \
     --hash=sha256:c228a6dc5e932d346bc5739379109d49e8853dd8223571c7c5b55260edc0b97f
-    # via deprecation
+    # via
+    #   deprecation
+    #   django-csp
 pillow==11.1.0 \
     --hash=sha256:015c6e863faa4779251436db398ae75051469f7c903b043a48f078e437656f83 \
     --hash=sha256:0a2f91f8a8b367e7a57c6e91cd25af510168091fb89ec5146003e424e1558a96 \