feat: add Content-Security-Policy header with nonce for inline bootstrap by clean6378-max-it · Pull Request #147 · cppalliance/cppa-cursor-browser

clean6378-max-it · 2026-07-21T15:14:27Z

Closes #141

adds a content-security-policy header on html pages only. each response gets a random nonce; inline scripts in the page templates use it, and the head theme bootstrap moved to static/js/theme-bootstrap.js so script-src stays tight. json api routes don't get the header.

pulled all onclick/onchange handlers out of the templates and wired them with addeventlistener instead, including sidebar click delegation in workspace.html. policy allows self plus cdnjs for scripts and styles; style-src keeps unsafe-inline because highlight.js themes need it.

tests/test_csp_header.py checks the header on page routes, nonce matches the inline script, and /api/workspaces has no csp. pytest tests/test_csp_header.py passes.

Summary by CodeRabbit

Security
- Enabled per-response Content Security Policy (CSP) with nonce protection for all HTML pages, and added tests to verify nonce matching, correct directive behavior, and omission of CSP on JSON endpoints.
User Experience
- Improved theme initialization to apply the stored theme earlier.
- Removed inline event handlers across the UI (theme toggle, search filters/actions, config save, exports, workspace actions) and replaced them with script-driven wiring.
Bug Fixes
- Improved “Copy all” button detection for more reliable clipboard behavior.

coderabbitai · 2026-07-21T15:14:50Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 1d4f3302-c4ee-437f-9105-2dfa3f1a9d9b

📥 Commits

Reviewing files that changed from the base of the PR and between c9c376d and eb4aa67.

📒 Files selected for processing (1)

tests/test_csp_header.py

🚧 Files skipped from review as they are similar to previous changes (1)

tests/test_csp_header.py

📝 Walkthrough

Walkthrough

The Flask app now generates per-response CSP nonces for HTML responses, exposes them to templates, and removes inline event handlers across affected pages. Client scripts bind interactions through DOM listeners, while tests validate CSP headers, nonce propagation, and JSON API behavior.

Changes

CSP nonce rollout

Layer / File(s)	Summary
CSP generation and response hooks `app.py`	Builds nonce-based CSP policies, stores a request nonce, exposes it to templates, and adds the CSP header only to HTML responses.
Nonce-protected template interactions `templates/base.html`, `templates/config.html`, `templates/index.html`, `templates/search.html`, `templates/workspace.html`	Replaces inline event handlers with element IDs, data attributes, and nonce-protected `addEventListener` wiring.
Theme and button client wiring `static/js/app.js`, `static/js/download.js`, `static/js/theme-bootstrap.js`	Initializes stored themes, wires the theme toggle when present, and identifies the copy button by ID.
CSP endpoint validation `tests/test_csp_header.py`	Checks CSP directives, nonce rotation and propagation on HTML routes, and confirms the JSON API omits the CSP header.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Browser
  participant FlaskHooks
  participant TemplateRenderer
  Browser->>FlaskHooks: request HTML page
  FlaskHooks->>FlaskHooks: generate request nonce
  FlaskHooks->>TemplateRenderer: render with csp_nonce
  TemplateRenderer-->>FlaskHooks: nonce-protected HTML
  FlaskHooks-->>Browser: HTML and CSP header

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly states the main change: adding a CSP header with a nonce for inline bootstrap.
Linked Issues check	✅ Passed	The PR adds a CSP on HTML responses, uses per-response nonces, avoids inline handlers, and leaves JSON APIs untouched.
Out of Scope Changes check	✅ Passed	The non-CSP file edits refactor inline handlers and theme bootstrap to support the CSP, so they stay in scope.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/csp-header

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 3

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/test_csp_header.py`:
- Around line 27-34: Extend test_html_page_nonce_matches_inline_script with a
second client.get("/search") request, extract its Content-Security-Policy nonce
using _extract_csp_nonce, and assert it differs from the first response’s nonce
while preserving the existing inline-script and policy assertions.
- Around line 27-34: Update test_html_page_nonce_matches_inline_script to assert
that the extracted nonce appears on a nonce-bearing script element rendered by
templates/search.html, rather than merely anywhere in the HTML. Preserve the
existing CSP equality assertion and response checks.
- Around line 21-34: Update the CSP tests around
test_html_page_nonce_matches_inline_script to define the expected policy
directives explicitly in the test and assert their parsed tokens are present,
rather than relying on substring checks or comparing against
build_content_security_policy(nonce). Keep nonce extraction and the assertion
that the HTML inline script uses that nonce, while ensuring the expected CSP is
independent of the production helper.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7d628bdb-efc3-414d-a0e1-7d3c5b64f250

📥 Commits

Reviewing files that changed from the base of the PR and between bdd85fa and 9735d95.

📒 Files selected for processing (10)

app.py
static/js/app.js
static/js/download.js
static/js/theme-bootstrap.js
templates/base.html
templates/config.html
templates/index.html
templates/search.html
templates/workspace.html
tests/test_csp_header.py

…tation

bradjin8

Nice to have: add /config to CSP header tests

test_html_page_has_content_security_policy_header covers / and workspace covers /workspace/global, but /config is the only remaining page route without an explicit CSP assertion. Quick addition for full page-route coverage.

coderabbitai

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

tests/test_csp_header.py (1)
105-108: 🔒 Security & Privacy | 🟡 Minor | ⚡ Quick win

Validate the workspace CSP directives, not only header presence.

A malformed or nonce-less policy on /workspace/global could pass while the other route tests remain green. Extract the nonce and reuse _assert_expected_csp_directives here.
Proposed assertion
     assert csp
+    nonce = _extract_csp_nonce(csp)
+    _assert_expected_csp_directives(csp, nonce)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_csp_header.py` around lines 105 - 108, Update
test_workspace_page_has_content_security_policy_header to extract the CSP nonce
from the response and pass it to _assert_expected_csp_directives, validating the
expected directives rather than only asserting header presence. Preserve the
existing status-code assertion and use the response’s Content-Security-Policy
header as the assertion input.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/test_csp_header.py`:
- Around line 82-96: Update test_html_page_nonce_matches_inline_script to
validate the second response body as well: call _assert_expected_csp_directives
with second_csp and second_nonce, then call _assert_inline_script_nonce with
second.get_data(as_text=True) and second_nonce, while preserving the existing
first-response assertions.

---

Outside diff comments:
In `@tests/test_csp_header.py`:
- Around line 105-108: Update
test_workspace_page_has_content_security_policy_header to extract the CSP nonce
from the response and pass it to _assert_expected_csp_directives, validating the
expected directives rather than only asserting header presence. Preserve the
existing status-code assertion and use the response’s Content-Security-Policy
header as the assertion input.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d68cb543-5c2c-4285-8e75-ea5e51c9d7b1

📥 Commits

Reviewing files that changed from the base of the PR and between 9735d95 and c9c376d.

📒 Files selected for processing (1)

tests/test_csp_header.py

feat: add Content-Security-Policy header with nonce for inline bootstrap

9735d95

clean6378-max-it self-assigned this Jul 21, 2026

coderabbitai Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread tests/test_csp_header.py Outdated

Comment thread tests/test_csp_header.py Outdated

test(csp): tighten CSP assertions with parsed directives and nonce ro…

81ee2b6

…tation

clean6378-max-it requested a review from bradjin8 July 21, 2026 15:52

bradjin8 approved these changes Jul 21, 2026

View reviewed changes

test(csp): cover /config in CSP page-route tests

c9c376d

coderabbitai Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread tests/test_csp_header.py

test(csp): check workspace directives and second /search nonce in HTML

eb4aa67

clean6378-max-it requested a review from wpak-ai July 21, 2026 19:21

wpak-ai approved these changes Jul 21, 2026

View reviewed changes

wpak-ai merged commit 8e9ee40 into master Jul 21, 2026
17 checks passed

wpak-ai deleted the feat/csp-header branch July 21, 2026 19:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: add Content-Security-Policy header with nonce for inline bootstrap#147

feat: add Content-Security-Policy header with nonce for inline bootstrap#147
wpak-ai merged 4 commits into
masterfrom
feat/csp-header

clean6378-max-it commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

bradjin8 left a comment

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

clean6378-max-it commented Jul 21, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

bradjin8 left a comment

Choose a reason for hiding this comment

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

clean6378-max-it commented Jul 21, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 21, 2026 •

edited

Loading