Skip to content

Commit 766894f

Browse files
author
Rob Hudson
committed
Fix #229: Document constant NONE vs Python's None
1 parent 7a8a44d commit 766894f

2 files changed

Lines changed: 44 additions & 36 deletions

File tree

‎csp/utils.py‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@
4848
"webrtc": None,
4949
"worker-src": None,
5050
# Directives Defined in Other Documents
51-
"upgrade-insecure-requests": None,
52-
"block-all-mixed-content": None, # Deprecated.
51+
"upgrade-insecure-requests": False,
52+
"block-all-mixed-content": False, # Deprecated.
5353
}
5454

5555
DIRECTIVES_T = Dict[str, Any]

‎docs/configuration.rst‎

Lines changed: 42 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -142,16 +142,26 @@ policy.
142142

143143
.. code-block:: python
144144
145-
from csp.constants import SELF, STRICT_DYNAMIC
145+
from csp.constants import NONE, SELF, STRICT_DYNAMIC
146146
147147
CONTENT_SECURITY_POLICY = {
148148
"DIRECTIVES": {
149-
"default-src": [SELF, "cdn.example.net"],
149+
# No sources allowed for default-src by using `csp.constants.NONE`.
150+
"default-src": [NONE],
150151
"script-src": [SELF, STRICT_DYNAMIC],
151152
"style-src": [SELF],
153+
# Using Python's `None` will not include the directive in the header. Useful
154+
# to override previous settings or when using the decorators.
155+
"base-uri": None,
152156
}
153157
}
154158
159+
.. note::
160+
The CSP keyword ``csp.constants.NONE`` is distinct from Python's ``None`` value. The CSP
161+
keyword ``'none'`` is a special value that signifies that you do not want any sources for
162+
the directive. The ``None`` value is a Python keyword that represents the absence of a value
163+
and when used as the value of a directive, it will remove the directive from the header.
164+
155165
.. note::
156166
Deprecated features of CSP in general have been moved to the bottom of this list.
157167

@@ -161,113 +171,111 @@ policy.
161171

162172
``default-src``
163173
Set the ``default-src`` directive. A ``tuple`` or ``list`` of values,
164-
e.g.: ``("'self'", 'cdn.example.net')``. *["'self'"]*
174+
e.g.: ``("'self'", "cdn.example.net")``. *default=["'self'"]*
165175

166176
``script-src``
167-
Set the ``script-src`` directive. A ``tuple`` or ``list``. *None*
177+
Set the ``script-src`` directive. A ``tuple`` or ``list``. *default=None*
168178

169179
``script-src-attr``
170-
Set the ``script-src-attr`` directive. A ``tuple`` or ``list``. *None*
180+
Set the ``script-src-attr`` directive. A ``tuple`` or ``list``. *default=None*
171181

172182
``script-src-elem``
173-
Set the ``script-src-elem`` directive. A ``tuple`` or ``list``. *None*
183+
Set the ``script-src-elem`` directive. A ``tuple`` or ``list``. *default=None*
174184

175185
``img-src``
176-
Set the ``img-src`` directive. A ``tuple`` or ``list``. *None*
186+
Set the ``img-src`` directive. A ``tuple`` or ``list``. *default=None*
177187

178188
``object-src``
179-
Set the ``object-src`` directive. A ``tuple`` or ``list``. *None*
189+
Set the ``object-src`` directive. A ``tuple`` or ``list``. *default=None*
180190

181191
``media-src``
182-
Set the ``media-src`` directive. A ``tuple`` or ``list``. *None*
192+
Set the ``media-src`` directive. A ``tuple`` or ``list``. *default=None*
183193

184194
``frame-src``
185-
Set the ``frame-src`` directive. A ``tuple`` or ``list``. *None*
195+
Set the ``frame-src`` directive. A ``tuple`` or ``list``. *default=None*
186196

187197
``font-src``
188-
Set the ``font-src`` directive. A ``tuple`` or ``list``. *None*
198+
Set the ``font-src`` directive. A ``tuple`` or ``list``. *default=None*
189199

190200
``connect-src``
191-
Set the ``connect-src`` directive. A ``tuple`` or ``list``. *None*
201+
Set the ``connect-src`` directive. A ``tuple`` or ``list``. *default=None*
192202

193203
``style-src``
194-
Set the ``style-src`` directive. A ``tuple`` or ``list``. *None*
204+
Set the ``style-src`` directive. A ``tuple`` or ``list``. *default=None*
195205

196206
``style-src-attr``
197-
Set the ``style-src-attr`` directive. A ``tuple`` or ``list``. *None*
207+
Set the ``style-src-attr`` directive. A ``tuple`` or ``list``. *default=None*
198208

199209
``style-src-elem``
200-
Set the ``style-src-elem`` directive. A ``tuple`` or ``list``. *None*
210+
Set the ``style-src-elem`` directive. A ``tuple`` or ``list``. *default=None*
201211

202212
``base-uri``
203-
Set the ``base-uri`` directive. A ``tuple`` or ``list``. *None*
213+
Set the ``base-uri`` directive. A ``tuple`` or ``list``. *default=None*
204214

205215
Note: This doesn't use ``default-src`` as a fall-back.
206216

207217
``child-src``
208-
Set the ``child-src`` directive. A ``tuple`` or ``list``. *None*
218+
Set the ``child-src`` directive. A ``tuple`` or ``list``. *default=None*
209219

210220
``frame-ancestors``
211-
Set the ``frame-ancestors`` directive. A ``tuple`` or ``list``. *None*
221+
Set the ``frame-ancestors`` directive. A ``tuple`` or ``list``. *default=None*
212222

213223
Note: This doesn't use ``default-src`` as a fall-back.
214224

215225
``navigate-to``
216-
Set the ``navigate-to`` directive. A ``tuple`` or ``list``. *None*
226+
Set the ``navigate-to`` directive. A ``tuple`` or ``list``. *default=None*
217227

218228
Note: This doesn't use ``default-src`` as a fall-back.
219229

220230
``form-action``
221-
Set the ``FORM_ACTION`` directive. A ``tuple`` or ``list``. *None*
231+
Set the ``form-action`` directive. A ``tuple`` or ``list``. *default=None*
222232

223233
Note: This doesn't use ``default-src`` as a fall-back.
224234

225235
``sandbox``
226-
Set the ``sandbox`` directive. A ``tuple`` or ``list``. *None*
236+
Set the ``sandbox`` directive. A ``tuple`` or ``list``. *default=None*
227237

228238
Note: This doesn't use ``default-src`` as a fall-back.
229239

230240
``report-uri``
231241
Set the ``report-uri`` directive. A ``tuple`` or ``list`` of URIs.
232-
Each URI can be a full or relative URI. *None*
242+
Each URI can be a full or relative URI. *default=None*
233243

234244
Note: This doesn't use ``default-src`` as a fall-back.
235245

236246
``report-to``
237247
Set the ``report-to`` directive. A ``string`` describing a reporting
238-
group. *None*
248+
group. *default=None*
239249

240250
See Section 1.2: https://w3c.github.io/reporting/#group
241251

242252
Also `see this MDN note on <https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/report-uri>`_ ``report-uri`` and ``report-to``.
243253

244254
``manifest-src``
245-
Set the ``manifest-src`` directive. A ``tuple`` or ``list``. *None*
255+
Set the ``manifest-src`` directive. A ``tuple`` or ``list``. *default=None*
246256

247257
``worker-src``
248-
Set the ``worker-src`` directive. A ``tuple`` or ``list``. *None*
258+
Set the ``worker-src`` directive. A ``tuple`` or ``list``. *default=None*
249259

250260
``require-sri-for``
251-
Set the ``require-sri-for`` directive. A ``tuple`` or ``list``. *None*
261+
Set the ``require-sri-for`` directive. A ``tuple`` or ``list``. *default=None*
252262

253263
Valid values: a ``list`` containing ``'script'``, ``'style'``, or both.
254264

255265
Spec: require-sri-for-known-tokens_
256266

257267
``upgrade-insecure-requests``
258-
Include ``upgrade-insecure-requests`` directive. A ``boolean``. *False*
268+
Include ``upgrade-insecure-requests`` directive. A ``boolean``. *default=False*
259269

260270
Spec: upgrade-insecure-requests_
261271

262272
``require-trusted-types-for``
263-
Include ``require-trusted-types-for`` directive.
264-
A ``tuple`` or ``list``. *None*
273+
Include ``require-trusted-types-for`` directive. A ``tuple`` or ``list``. *default=None*
265274

266275
Valid values: ``["'script'"]``
267276

268277
``trusted-types``
269-
Include ``trusted-types`` directive.
270-
A ``tuple`` or ``list``. *None*
278+
Include ``trusted-types`` directive. A ``tuple`` or ``list``. *default=None*
271279

272280
Valid values: a ``list`` of allowed policy names that may include
273281
``default`` and/or ``'allow-duplicates'``
@@ -280,23 +288,23 @@ in terms of the latest implementation of the relevant spec.
280288

281289

282290
``block-all-mixed-content``
283-
Include ``block-all-mixed-content`` directive. A ``boolean``. *False*
291+
Include ``block-all-mixed-content`` directive. A ``boolean``. *default=False*
284292

285293
Related `note on MDN <block-all-mixed-content_mdn_>`_.
286294

287295
Spec: block-all-mixed-content_
288296

289297

290298
``plugin-types``
291-
Set the ``plugin-types`` directive. A ``tuple`` or ``list``. *None*
299+
Set the ``plugin-types`` directive. A ``tuple`` or ``list``. *default=None*
292300

293301
Note: This doesn't use ``default-src`` as a fall-back.
294302

295303
Related `note on MDN <plugin_types_mdn_>`_.
296304

297305

298306
``prefetch-src``
299-
Set the ``prefetch-src`` directive. A ``tuple`` or ``list``. *None*
307+
Set the ``prefetch-src`` directive. A ``tuple`` or ``list``. *default=None*
300308

301309
Related `note on MDN <prefetch_src_mdn_>`_.
302310

0 commit comments

Comments
 (0)