64898b2c79
Some checks failed
Code scanning / CodeQL (push) Failing after 15s
Zulip production suite / Ubuntu 22.04 production build (push) Failing after 26s
Zulip production suite / Debian 12 production install with custom db name and user (push) Has been skipped
Zulip production suite / Ubuntu 22.04 production install and PostgreSQL upgrade with pgroonga (push) Has been skipped
Zulip production suite / Ubuntu 24.04 production install (push) Has been skipped
Zulip production suite / Ubuntu 26.04 production install (push) Has been skipped
Zulip production suite / Debian 13 production install (push) Has been skipped
Zulip production suite / 7.0 Version Upgrade (push) Has been skipped
Zulip production suite / 8.0 Version Upgrade (push) Has been skipped
Zulip production suite / 6.0 Version Upgrade (push) Has been skipped
Zulip production suite / 10.0 Version Upgrade (push) Has been skipped
Zulip production suite / 9.0 Version Upgrade (push) Has been skipped
Zulip production suite / 12.0 Version Upgrade (push) Has been skipped
Zulip production suite / 11.0 Version Upgrade (push) Has been skipped
GitHub Actions Security Analysis with zizmor / zizmor (push) Failing after 3s
Zulip CI / Debian 12 (Python 3.11, backend + documentation) (push) Failing after 26s
Zulip CI / Ubuntu 22.04 (Python 3.10, backend + frontend) (push) Failing after 3s
Zulip CI / Ubuntu 24.04 (Python 3.12, backend) (push) Failing after 25s
Zulip CI / Ubuntu 26.04 (Python 3.14, backend) (push) Failing after 25s
Zulip CI / Debian 13 (Python 3.13, backend) (push) Failing after 28s
Zulip production suite / Required jobs (push) Has been cancelled
Zulip CI / Required jobs (push) Has been cancelled
API Documentation Update Check / check-feature-level-updated (push) Has been cancelled
API Documentation Update Check / notify-if-api-docs-changed (push) Has been cancelled
40 lines
1.3 KiB
Python
40 lines
1.3 KiB
Python
# System documented in https://zulip.readthedocs.io/en/latest/subsystems/logging.html
|
|
import logging
|
|
|
|
from django.http import HttpRequest, HttpResponse
|
|
from django.views.decorators.csrf import csrf_exempt
|
|
from django.views.decorators.http import require_POST
|
|
|
|
from zerver.lib.response import json_success
|
|
from zerver.lib.typed_endpoint import JsonBodyPayload, typed_endpoint
|
|
from zerver.lib.validator import WildValue, check_string
|
|
|
|
|
|
@csrf_exempt
|
|
@require_POST
|
|
@typed_endpoint
|
|
def report_csp_violations(
|
|
request: HttpRequest, *, csp_report: JsonBodyPayload[WildValue]
|
|
) -> HttpResponse:
|
|
def get_attr(csp_report_attr: str) -> str:
|
|
return csp_report.get(csp_report_attr, "").tame(check_string)
|
|
|
|
logging.warning(
|
|
"CSP violation in document('%s'). "
|
|
"blocked URI('%s'), original policy('%s'), "
|
|
"violated directive('%s'), effective directive('%s'), "
|
|
"disposition('%s'), referrer('%s'), "
|
|
"status code('%s'), script sample('%s')",
|
|
get_attr("document-uri"),
|
|
get_attr("blocked-uri"),
|
|
get_attr("original-policy"),
|
|
get_attr("violated-directive"),
|
|
get_attr("effective-directive"),
|
|
get_attr("disposition"),
|
|
get_attr("referrer"),
|
|
get_attr("status-code"),
|
|
get_attr("script-sample"),
|
|
)
|
|
|
|
return json_success(request)
|