Always yield a CSP policy instance

If the app has the CSP disabled globally allow a controller action
to enable the policy for that request.

1 files changed, 5 insertions, 1 deletions

diff --git a/actionpack/lib/action_controller/metal/content_security_policy.rb b/actionpack/lib/action_controller/metal/content_security_policy.rb
index 67682e7f4f..b8fab4ebe3 100644
--- a/actionpack/lib/action_controller/metal/content_security_policy.rb
+++ b/actionpack/lib/action_controller/metal/content_security_policy.rb
@@ -17,7 +17,7 @@ module ActionController #:nodoc:
       def content_security_policy(enabled = true, **options, &block)
         before_action(options) do
           if block_given?
-            policy = request.content_security_policy.clone
+            policy = current_content_security_policy
             yield policy
             request.content_security_policy = policy
           end
@@ -44,5 +44,9 @@ module ActionController #:nodoc:
       def content_security_policy_nonce
         request.content_security_policy_nonce
       end
+
+      def current_content_security_policy
+        request.content_security_policy.try(:clone) || ActionDispatch::ContentSecurityPolicy.new
+      end
   end
 end