parse the content-security-policy just once

Author: lovasoa

src/app_config.rs

@@ -1,4 +1,4 @@
-use crate::webserver::content_security_policy::DEFAULT_CONTENT_SECURITY_POLICY;
+use crate::webserver::content_security_policy::ContentSecurityPolicyTemplate;
 use crate::webserver::routing::RoutingConfig;
 use anyhow::Context;
 use clap::Parser;
@@ -266,8 +266,8 @@ pub struct AppConfig {
 
     /// Content-Security-Policy header to send to the client.
     /// If not set, a default policy allowing scripts from the same origin is used and from jsdelivr.net
-    #[serde(default = "default_content_security_policy")]
-    pub content_security_policy: String,
+    #[serde(default)]
+    pub content_security_policy: ContentSecurityPolicyTemplate,
 
     /// Whether `sqlpage.fetch` should load trusted certificates from the operating system's certificate store
     /// By default, it loads Mozilla's root certificates that are embedded in the `SQLPage` binary, or the ones pointed to by the
@@ -533,10 +533,6 @@ fn default_compress_responses() -> bool {
     true
 }
 
-fn default_content_security_policy() -> String {
-    String::from(DEFAULT_CONTENT_SECURITY_POLICY)
-}
-
 fn default_system_root_ca_certificates() -> bool {
     std::env::var("SSL_CERT_FILE").is_ok_and(|x| !x.is_empty())
         || std::env::var("SSL_CERT_DIR").is_ok_and(|x| !x.is_empty())

src/webserver/content_security_policy.rs

@@ -4,6 +4,7 @@ use actix_web::http::header::{
 use actix_web::HttpResponseBuilder;
 use awc::http::header::InvalidHeaderValue;
 use rand::random;
+use serde::Deserialize;
 use std::fmt::{Display, Formatter};
 use std::sync::Arc;
 
@@ -19,12 +20,18 @@ pub struct ContentSecurityPolicy {
 /// The template is a string that contains the nonce placeholder.
 /// The nonce placeholder is replaced with the nonce value when the Content Security Policy is applied to a response.
 /// This struct is cheap to clone.
-#[derive(Debug, Clone)]
+#[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ContentSecurityPolicyTemplate {
     pub before_nonce: Arc<str>,
     pub after_nonce: Option<Arc<str>>,
 }
 
+impl Default for ContentSecurityPolicyTemplate {
+    fn default() -> Self {
+        Self::from(DEFAULT_CONTENT_SECURITY_POLICY)
+    }
+}
+
 impl From<&str> for ContentSecurityPolicyTemplate {
     fn from(s: &str) -> Self {
         if let Some((before, after)) = s.split_once("{NONCE}") {
@@ -41,6 +48,16 @@ impl From<&str> for ContentSecurityPolicyTemplate {
     }
 }
 
+impl<'de> Deserialize<'de> for ContentSecurityPolicyTemplate {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: serde::Deserializer<'de>,
+    {
+        let s: &str = Deserialize::deserialize(deserializer)?;
+        Ok(Self::from(s))
+    }
+}
+
 impl ContentSecurityPolicy {
     pub fn new(template: ContentSecurityPolicyTemplate) -> Self {
         Self {
@@ -56,7 +73,7 @@ impl ContentSecurityPolicy {
     }
 
     fn is_enabled(&self) -> bool {
-        !self.template.before_nonce.is_empty()
+        !self.template.before_nonce.is_empty() || self.template.after_nonce.is_some()
     }
 }
 

src/webserver/http.rs

@@ -178,9 +178,7 @@ async fn render_sql(
         let request_context = RequestContext {
             is_embedded: req_param.get_variables.contains_key("_sqlpage_embed"),
             content_security_policy: ContentSecurityPolicy::new(
-                crate::webserver::content_security_policy::ContentSecurityPolicyTemplate::from(
-                    app_state.config.content_security_policy.as_str(),
-                ),
+                app_state.config.content_security_policy.clone(),
             ),
         };
         let mut conn = None;