Skip to content

Commit

Permalink
Remove deprecation warning for child-src
Browse files Browse the repository at this point in the history
From [the CSP specification](https://w3c.github.io/webappsec-csp/#changes-from-level-2):
> The child-src model has been substantially altered:
>
> 1. The frame-src directive, which was deprecated in CSP Level 2, has been undeprecated, but continues to defer to child-src if not present (which defers to default-src in turn).
> 2. A worker-src directive has been added, deferring to child-src if not present (which likewise defers to script-src and eventually default-src).
> 3. Dedicated workers now always inherit their creator’s policy.

[History of this feature](https://stackoverflow.com/questions/46039068/csp-child-src-and-frame-src-deprecated/46042614#46042614)
  • Loading branch information
rik committed Jun 26, 2020
1 parent cbff891 commit e812729
Show file tree
Hide file tree
Showing 3 changed files with 7 additions and 11 deletions.
5 changes: 5 additions & 0 deletions CHANGES
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,11 @@
CHANGES
=======

Next
====

- Remove deprecation warning for child-src

3.6
===

Expand Down
6 changes: 2 additions & 4 deletions csp/tests/test_utils.py
Original file line number Diff line number Diff line change
@@ -1,6 +1,5 @@
from __future__ import absolute_import

import pytest
import six
from django.conf import settings
from django.test.utils import override_settings
Expand Down Expand Up @@ -208,9 +207,8 @@ def test_base_uri():

@override_settings(CSP_CHILD_SRC=['example.com'])
def test_child_src():
with pytest.warns(DeprecationWarning):
policy = build_policy()
policy_eq("default-src 'self'; child-src example.com", policy)
policy = build_policy()
policy_eq("default-src 'self'; child-src example.com", policy)


@override_settings(CSP_FRAME_ANCESTORS=['example.com'])
Expand Down
7 changes: 0 additions & 7 deletions csp/utils.py
Original file line number Diff line number Diff line change
Expand Up @@ -9,10 +9,6 @@
from django.utils.encoding import force_str


CHILD_SRC_DEPRECATION_WARNING = \
'child-src is deprecated in CSP v3. Use frame-src and worker-src.'


def from_settings():
return {
# Fetch Directives
Expand Down Expand Up @@ -96,9 +92,6 @@ def build_policy(config=None, update=None, replace=None, nonce=None):
else: # directives with many values like src lists
policy_parts[key] = ' '.join(value)

if key == 'child-src':
warnings.warn(CHILD_SRC_DEPRECATION_WARNING, DeprecationWarning)

if report_uri:
report_uri = map(force_str, report_uri)
policy_parts['report-uri'] = ' '.join(report_uri)
Expand Down

0 comments on commit e812729

Please sign in to comment.