From db8bc6b1a43d3e724879b09e45928eabbb49f768 Mon Sep 17 00:00:00 2001
From: Chandra Yemparala <cyemparala@tacc.utexas.edu>
Date: Wed, 12 Jul 2023 10:56:10 -0500
Subject: [PATCH] Fix more issues related to CSP and Vite

---
 client/vite.config.ts                      | 18 ++++++++++++++++++
 server/portal/settings/settings.py         |  6 ++++++
 server/portal/settings/settings_default.py |  2 +-
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/client/vite.config.ts b/client/vite.config.ts
index 129aa277d..0af8d90cd 100644
--- a/client/vite.config.ts
+++ b/client/vite.config.ts
@@ -11,6 +11,24 @@ export default defineConfig({
   plugins: [
     {...eslint({include: 'src/**/*.+(js|jsx|ts|tsx)', fix: false}), enforce: 'pre', },
     react(),
+    {
+      name: "html-inject-nonce-into-script-tag",
+      enforce: "post",
+      transformIndexHtml(html: string) {
+          const regex = /<script(.*?)/gi;
+          const replacement = '<script nonce="{{ CSP_NONCE }}"$1';
+          return html.replace(regex, replacement);
+      },
+    },
+    {
+      name: "html-inject-nonce-into-link-tag",
+      enforce: "post",
+      transformIndexHtml(html: string) {
+          const regex = /<link(.*?)/gi;
+          const replacement = '<link nonce="{{ CSP_NONCE }}"$1';
+          return html.replace(regex, replacement);
+      },
+    },
   ],
 
   resolve: {
diff --git a/server/portal/settings/settings.py b/server/portal/settings/settings.py
index 0437145ee..bbc0455e1 100644
--- a/server/portal/settings/settings.py
+++ b/server/portal/settings/settings.py
@@ -713,12 +713,15 @@
 """
 CSP_CONNECT_SRC = [
     "'self'",
+    "ws:",
+    "wss:",
     "*.google-analytics.com",
     "*.googletagmanager.com"
 ]
 CSP_DEFAULT_SRC = ["'none'"]
 CSP_FONT_SRC = [
     "'self'",
+    "data:",
     "*.bootstrapcdn.com",
     "cdnjs.cloudflare.com",
 	"*.googleapis.com",
@@ -745,6 +748,9 @@
 
 CSP_INCLUDE_NONCE_IN = ['script-src', 'style-src']
 
+# By default report only until all issues are resolved
+CSP_REPORT_ONLY = True
+
 """
 SETTINGS: LOCAL OVERRIDES
 """
diff --git a/server/portal/settings/settings_default.py b/server/portal/settings/settings_default.py
index 7a7d7f307..f0a4719ab 100644
--- a/server/portal/settings/settings_default.py
+++ b/server/portal/settings/settings_default.py
@@ -6,7 +6,7 @@
 # DJANGO SETTINGS COMMON
 ########################
 
-_DEBUG = False
+_DEBUG = True
 
 # Namespace for portal
 _PORTAL_NAMESPACE = 'CEP'