#ij bddlZddlmZddlmZmZGddeZGddeZdZd d Z y) N)StrEnum)SimpleLazyObjectemptyc<eZdZdZdZdZdZdZdZdZ dZ d Z d Z d Z d Zy )CSPa Content Security Policy constants for directive values and special tokens. These constants represent: 1. Standard quoted string values from the CSP spec (e.g., 'self', 'unsafe-inline') 2. Special placeholder tokens (NONCE) that get replaced by the middleware Using this enum instead of raw strings provides better type checking, autocompletion, and protection against common mistakes like: - Typos (e.g., 'noone' instead of 'none') - Missing quotes (e.g., ["self"] instead of ["'self'"]) - Inconsistent quote styles (e.g., ["'self'", ""unsafe-inline""]) Example usage in Django settings: SECURE_CSP = { "default-src": [CSP.NONE], "script-src": [CSP.SELF, CSP.NONCE], } zContent-Security-Policyz#Content-Security-Policy-Report-Onlyz'none'z'report-sample'z'self'z'strict-dynamic'z 'unsafe-eval'z'unsafe-hashes'z'unsafe-inline'z'wasm-unsafe-eval'zN)__name__ __module__ __qualname____doc__HEADER_ENFORCEHEADER_REPORT_ONLYNONE REPORT_SAMPLESELFSTRICT_DYNAMIC UNSAFE_EVAL UNSAFE_HASHES UNSAFE_INLINEWASM_UNSAFE_EVALNONCEJ/var/www/html/office/venv/lib/python3.12/site-packages/django/utils/csp.pyrrsF2/N> D%M D'N!K%M%M+ #Errc(eZdZdZfdZdZxZS) LazyNoncea{ Lazily generates a cryptographically secure nonce string, for use in CSP headers. The nonce is only generated when first accessed (e.g., via string interpolation or inside a template). The nonce will evaluate as `True` if it has been generated, and `False` if it has not. This is useful for third-party Django libraries that want to support CSP without requiring it. Example Django template usage with context processors enabled: The `{% if %}` block will only render if the nonce has been evaluated elsewhere. c,t|tyN)super__init__generate_nonce)self __class__s rrzLazyNonce.__init__Is (rc&|jtuSr)_wrappedr)r!s r__bool__zLazyNonce.__bool__Ls}}E))r)rr r r rr% __classcell__)r"s@rrr4s()*rrc,tjdS)N)secrets token_urlsaferrrr r Ps   $$rc(g}|jD]\}}|dvr |durd}nt|tr t|}nt|tt zs|g}t j|vx}r+|r)|Dcgc]}|t jk(rd|dn|}}n%|r#|Dcgc]}|t jk7s|}}|sdj|}|j|d|jdj|Scc}wcc}w)N)NFTz'nonce-' z; ) items isinstancesetsortedlisttuplerrjoinappendrstrip)confignoncepolicy directivevaluesrendered_value has_sentinelvs r build_policyr@Ts F#\\^@ 6 ] "  T>N&#& u 5 !$ V 33 3OUV!SYYGE7!,AEVV%+>qCII~!>> XXf-N  1^$45<<>?5@8 99V W>s5"D  D9Dr) r)enumrdjango.utils.functionalrrrrr r@rrrrCs2;*#'*#Z* *8%r