fix: Ensure script_nonce is available for security headers to prevent XSS attacks

Author: TheophileDiot

CHANGELOG.md

@@ -1,6 +1,10 @@
 # Changelog
 
-## v1.6.9~rc3 - 2026/03/??
+## v1.6.9 - 2026/03/??
+
+- [BUGFIX] Ensure script_nonce is available for security headers to prevent XSS attacks
+
+## v1.6.9~rc3 - 2026/03/06
 
 - [BUGFIX] Fix issues with the new `multiselect` logic where a custom separator can be used, but the default one (space) was still used if the separator was empty, which caused issues with settings that had an empty string as a value.
 - [BUGFIX] Fix issue with the failover not sending the failover configuration if the reload failed, which caused the failover configuration to not be applied until the next successful reload.

src/ui/main.py

@@ -1161,12 +1161,16 @@ def mark_user_access(user, session_id):
 @app.after_request
 def set_security_headers(response):
     """Set the security headers."""
+    # Ensure script_nonce is available even if before_request didn't complete
+    # (e.g., when CSRF validation fails before our before_request runs)
+    script_nonce = getattr(g, "script_nonce", None) or token_urlsafe(32)
+
     # * Content-Security-Policy header to prevent XSS attacks
     response.headers["Content-Security-Policy"] = (
         "object-src 'none';"
         + " frame-ancestors 'self';"
         + " default-src https: http: 'self' https://www.bunkerweb.io https://assets.bunkerity.com https://bunkerity.us1.list-manage.com https://api.github.com;"
-        + f" script-src https: http: 'self' 'nonce-{g.script_nonce}' 'strict-dynamic' 'unsafe-inline';"
+        + f" script-src https: http: 'self' 'nonce-{script_nonce}' 'strict-dynamic' 'unsafe-inline';"
         + " style-src 'self' 'unsafe-inline';"
         + " img-src 'self' data: blob: https://www.bunkerweb.io https://assets.bunkerity.com https://*.tile.openstreetmap.org;"
         + " font-src 'self' data:;"

src/ui/temp.py

@@ -60,19 +60,21 @@ def before_request():
 def inject_variables():
     return dict(
         current_endpoint=request.path.split("/")[-1],
-        script_nonce=g.script_nonce,
+        script_nonce=getattr(g, "script_nonce", None) or token_urlsafe(32),
     )
 
 
 @app.after_request
 def set_security_headers(response):
     """Set the security headers."""
+    script_nonce = getattr(g, "script_nonce", None) or token_urlsafe(32)
+
     # * Content-Security-Policy header to prevent XSS attacks
     response.headers["Content-Security-Policy"] = (
         "object-src 'none';"
         + " frame-ancestors 'self';"
         + " default-src 'self'"
-        + f" script-src https: http: 'self' 'nonce-{g.script_nonce}' 'strict-dynamic' 'unsafe-inline';"
+        + f" script-src https: http: 'self' 'nonce-{script_nonce}' 'strict-dynamic' 'unsafe-inline';"
         + " style-src 'self' 'unsafe-inline';"
         + " img-src 'self' data: blob: https://assets.bunkerity.com;"
         + " base-uri 'self';"