16 lines
717 B
Python
16 lines
717 B
Python
"""Hash only trusted source inline scripts at image build time for strict CSP."""
|
|
import base64
|
|
import hashlib
|
|
import os
|
|
from pathlib import Path
|
|
import re
|
|
|
|
root=Path('/build')
|
|
hashes=[]
|
|
for html in [root/'dtf-site.html',*(root/'local/static').glob('*.html')]:
|
|
for attributes,body in re.findall(r'<script\b([^>]*)>(.*?)</script>',html.read_text(),re.S|re.I):
|
|
if not re.search(r'\bsrc\s*=',attributes,re.I):
|
|
hashes.append("'sha256-"+base64.b64encode(hashlib.sha256(body.encode()).digest()).decode()+"'")
|
|
template=Path(os.environ.get('NGINX_TEMPLATE', root/'local/nginx.conf.template')).read_text()
|
|
(root/'default.conf.template').write_text(template.replace('@SCRIPT_HASHES@',' '.join(hashes)))
|