From 23717cb9a03762ef44dbc829fb3887faa1e4b6e0 Mon Sep 17 00:00:00 2001
From: Seth Michael Larson <seth@python.org>
Date: Fri, 11 Sep 2026 11:23:48 -0500
Subject: [PATCH] Add exceptions to Content-Security-Policy

---
 pydotorg/settings/base.py | 39 ++++++++++++++++++++++++++++++---------
 templates/base.html       | 14 +++++++-------
 2 files changed, 37 insertions(+), 16 deletions(-)

diff --git a/pydotorg/settings/base.py b/pydotorg/settings/base.py
index f4b81d413..0156dc007 100644
--- a/pydotorg/settings/base.py
+++ b/pydotorg/settings/base.py
@@ -2,6 +2,7 @@
 
 from pathlib import Path
 
+from csp.constants import NONCE, SELF, UNSAFE_INLINE
 from decouple import config
 from dj_database_url import parse as dj_database_url_parser
 from django.contrib.messages import constants
@@ -311,16 +312,36 @@
 # enforcing. Rollout tracked in #3041.
 CONTENT_SECURITY_POLICY_REPORT_ONLY = {
     "DIRECTIVES": {
-        "default-src": ["'self'"],
-        "script-src": ["'self'"],
-        "style-src": ["'self'"],
-        "img-src": ["'self'", "data:"],
-        "font-src": ["'self'"],
-        "connect-src": ["'self'"],
-        "frame-ancestors": ["'self'"],
-        "base-uri": ["'self'"],
+        "default-src": [SELF],
+        "script-src": [
+            SELF,
+            NONCE,
+            "https://analytics.python.org",
+            "https://media.ethicalads.io",
+            "https://ajax.googleapis.com",
+        ],
+        "style-src": [
+            SELF,
+            # Modernizr injects <style> tags and requires
+            # using 'unsafe-inline'. If we remove Modernizr
+            # then we can remove this directive.
+            UNSAFE_INLINE,
+            "https://ajax.googleapis.com",
+        ],
+        "img-src": [SELF, "data:", "https://media.ethicalads.io"],
+        "font-src": [SELF, "data:"],
+        "connect-src": [
+            SELF,
+            "https://console.python.org",
+            "https://analytics.python.org",
+            "https://server.ethicalads.io",
+            # Status Page, host included in 'static/js/script.js'
+            "https://2p66nmmycsj3.statuspage.io",
+        ],
+        "frame-ancestors": [SELF],
+        "base-uri": [SELF],
         "object-src": ["'none'"],
-        "form-action": ["'self'"],
+        "form-action": [SELF],
         "report-uri": [_CSP_REPORT_URI],
         # When we upgrade to Django 6, begin using
         # 'report-to' and 'Reporting-Endpoints' header.
diff --git a/templates/base.html b/templates/base.html
index 4d6da62ca..c1c301d5a 100644
--- a/templates/base.html
+++ b/templates/base.html
@@ -9,8 +9,8 @@
 
     <meta charset="utf-8">
 
-    <link rel="prefetch" href="//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js">
-    <link rel="prefetch" href="//ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js">
+    <link rel="prefetch" href="https://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js">
+    <link rel="prefetch" href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js">
 
     <meta name="application-name" content="{{ SITE_INFO.site_name }}">
     <meta name="apple-mobile-web-app-title" content="{{ SITE_INFO.site_name }}">
@@ -37,7 +37,7 @@
     <link rel="stylesheet" href="{{ STATIC_URL }}stylesheets/mq.css" media="not print, speech">
     {% endcomment %}
 
-    <link rel="stylesheet" href="//ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css">
+    <link rel="stylesheet" href="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/themes/smoothness/jquery-ui.css">
 
     {# Place icon files in the root if possible (let browsers look for them where they expect them to be) #}
     <link rel="icon" type="image/x-icon" href="{{ STATIC_URL }}favicon.ico">
@@ -307,10 +307,10 @@
     </div><!-- end #touchnav-wrapper -->
 
     {% block javascript %}
-    <script src="//ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js"></script>
-    <script>window.jQuery || document.write('<script src="{{ STATIC_URL }}js/libs/jquery-1.8.2.min.js"><\/script>')</script>
-    <script src="//ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"></script>
-    <script>window.jQuery || document.write('<script src="{{ STATIC_URL }}js/libs/jquery-ui-1.12.1.min.js"><\/script>')</script>
+    <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.8.2/jquery.min.js"></script>
+    <script nonce="{{ request.csp_nonce }}">window.jQuery || document.write('<script src="{{ STATIC_URL }}js/libs/jquery-1.8.2.min.js"><\/script>')</script>
+    <script src="https://ajax.googleapis.com/ajax/libs/jqueryui/1.12.1/jquery-ui.min.js"></script>
+    <script nonce="{{ request.csp_nonce }}">window.jQuery || document.write('<script src="{{ STATIC_URL }}js/libs/jquery-ui-1.12.1.min.js"><\/script>')</script>
 
     <script src="{{ STATIC_URL }}js/libs/masonry.pkgd.min.js"></script>
     <script src="{{ STATIC_URL }}js/libs/html-includes.js"></script>