re-add talisman to un-enforce https, csp

guardrails-ai · Feb 26, 2024 · 44a472e · 44a472e
1 parent 1d8c0fc
commit 44a472e
Show file tree

Hide file tree

Showing 2 changed files with 27 additions and 4 deletions.
diff --git a/app.py b/app.py
@@ -3,7 +3,7 @@
 from flask_cors import CORS
 from werkzeug.middleware.proxy_fix import ProxyFix
 # from flask_seasurf import SeaSurf
-# from flask_talisman import Talisman
+from flask_talisman import Talisman
 
 
 def create_app():
@@ -13,7 +13,29 @@ def create_app():
     # host = os.environ.get("SELF_ENDPOINT", "http://localhost:8000")
     # if host.startswith("https://"):
     #     SeaSurf(app)
-    #     Talisman(app, force_https_permanent=True)
+    Talisman(
+        app,
+        force_https=False,
+        content_security_policy={
+            "default-src": [
+                "'self'",
+                "https://unpkg.com",
+                "http://www.w3.org"
+            ],
+            "script-src": [
+                "'self'",
+                "https://unpkg.com",
+                "http://www.w3.org"
+            ],
+            "img-src": [
+                "'self'",
+                "data:",
+                "https://unpkg.com",
+                "http://www.w3.org"
+            ]
+        },
+        content_security_policy_nonce_in=["script-src"]
+    )
     app.wsgi_app = ProxyFix(
         app.wsgi_app,
         x_for=1,

diff --git a/src/blueprints/root.py b/src/blueprints/root.py
@@ -1,5 +1,6 @@
 import os
 import json
+import flask
 from string import Template
 from flask import Blueprint
 from sqlalchemy import text
@@ -73,7 +74,7 @@ def docs():
 <body>
 <div id="swagger-ui"></div>
 <script src="https://unpkg.com/[email protected]/swagger-ui-bundle.js" crossorigin></script>
-<script>
+<script nonce="{{ csp_nonce() }}">
   window.onload = () => {
     window.ui = SwaggerUIBundle({
       url: '${apiDocUrl}',
@@ -84,4 +85,4 @@ def docs():
 </body>
 </html>""").safe_substitute(apiDocUrl=f"{host}/api-docs")
 
-    return swagger_ui
+    return flask.render_template_string(swagger_ui)