nextcloud/lib/private/Security/CSP/ContentSecurityPolicy.php

216 lines
4.7 KiB
PHP
Raw Normal View History

Add public API to give developers the possibility to adjust the global CSP defaults Allows to inject something into the default content policy. This is for example useful when you're injecting Javascript code into a view belonging to another controller and cannot modify its Content-Security-Policy itself. Note that the adjustment is only applied to applications that use AppFramework controllers. To use this from your `app.php` use `\OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy)`, $policy has to be of type `\OCP\AppFramework\Http\ContentSecurityPolicy`. To test this add something like the following into an `app.php` of any enabled app: ``` $manager = \OC::$server->getContentSecurityPolicyManager(); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('asdf'); $policy->addAllowedScriptDomain('yolo.com'); $policy->allowInlineScript(false); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFontDomain('yolo.com'); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('banana.com'); $manager->addDefaultPolicy($policy); ``` If you now open the files app the policy should be: ``` Content-Security-Policy:default-src 'none';script-src yolo.com 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src yolo.com 'self';connect-src 'self';media-src 'self';frame-src asdf banana.com 'self' ```
2016-01-28 16:33:02 +03:00
<?php
/**
2016-07-21 18:07:57 +03:00
* @copyright Copyright (c) 2016, ownCloud, Inc.
*
2016-05-26 20:56:05 +03:00
* @author Lukas Reschke <lukas@statuscode.ch>
* @author Thomas Citharel <tcit@tcit.fr>
Add public API to give developers the possibility to adjust the global CSP defaults Allows to inject something into the default content policy. This is for example useful when you're injecting Javascript code into a view belonging to another controller and cannot modify its Content-Security-Policy itself. Note that the adjustment is only applied to applications that use AppFramework controllers. To use this from your `app.php` use `\OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy)`, $policy has to be of type `\OCP\AppFramework\Http\ContentSecurityPolicy`. To test this add something like the following into an `app.php` of any enabled app: ``` $manager = \OC::$server->getContentSecurityPolicyManager(); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('asdf'); $policy->addAllowedScriptDomain('yolo.com'); $policy->allowInlineScript(false); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFontDomain('yolo.com'); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('banana.com'); $manager->addDefaultPolicy($policy); ``` If you now open the files app the policy should be: ``` Content-Security-Policy:default-src 'none';script-src yolo.com 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src yolo.com 'self';connect-src 'self';media-src 'self';frame-src asdf banana.com 'self' ```
2016-01-28 16:33:02 +03:00
*
* @license AGPL-3.0
*
* This code is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License, version 3,
* as published by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License, version 3,
* along with this program. If not, see <http://www.gnu.org/licenses/>
*
*/
namespace OC\Security\CSP;
/**
* Class ContentSecurityPolicy extends the public class and adds getter and setters.
* This is necessary since we don't want to expose the setters and getters to the
* public API.
*
* @package OC\Security\CSP
*/
class ContentSecurityPolicy extends \OCP\AppFramework\Http\ContentSecurityPolicy {
/**
* @return boolean
*/
public function isInlineScriptAllowed() {
return $this->inlineScriptAllowed;
}
/**
* @param boolean $inlineScriptAllowed
*/
public function setInlineScriptAllowed($inlineScriptAllowed) {
$this->inlineScriptAllowed = $inlineScriptAllowed;
}
/**
* @return boolean
*/
public function isEvalScriptAllowed() {
return $this->evalScriptAllowed;
}
/**
* @param boolean $evalScriptAllowed
*/
public function setEvalScriptAllowed($evalScriptAllowed) {
$this->evalScriptAllowed = $evalScriptAllowed;
}
/**
* @return array
*/
public function getAllowedScriptDomains() {
return $this->allowedScriptDomains;
}
/**
* @param array $allowedScriptDomains
*/
public function setAllowedScriptDomains($allowedScriptDomains) {
$this->allowedScriptDomains = $allowedScriptDomains;
}
/**
* @return boolean
*/
public function isInlineStyleAllowed() {
return $this->inlineStyleAllowed;
}
/**
* @param boolean $inlineStyleAllowed
*/
public function setInlineStyleAllowed($inlineStyleAllowed) {
$this->inlineStyleAllowed = $inlineStyleAllowed;
}
/**
* @return array
*/
public function getAllowedStyleDomains() {
return $this->allowedStyleDomains;
}
/**
* @param array $allowedStyleDomains
*/
public function setAllowedStyleDomains($allowedStyleDomains) {
$this->allowedStyleDomains = $allowedStyleDomains;
}
/**
* @return array
*/
public function getAllowedImageDomains() {
return $this->allowedImageDomains;
}
/**
* @param array $allowedImageDomains
*/
public function setAllowedImageDomains($allowedImageDomains) {
$this->allowedImageDomains = $allowedImageDomains;
}
/**
* @return array
*/
public function getAllowedConnectDomains() {
return $this->allowedConnectDomains;
}
/**
* @param array $allowedConnectDomains
*/
public function setAllowedConnectDomains($allowedConnectDomains) {
$this->allowedConnectDomains = $allowedConnectDomains;
}
/**
* @return array
*/
public function getAllowedMediaDomains() {
return $this->allowedMediaDomains;
}
/**
* @param array $allowedMediaDomains
*/
public function setAllowedMediaDomains($allowedMediaDomains) {
$this->allowedMediaDomains = $allowedMediaDomains;
}
/**
* @return array
*/
public function getAllowedObjectDomains() {
return $this->allowedObjectDomains;
}
/**
* @param array $allowedObjectDomains
*/
public function setAllowedObjectDomains($allowedObjectDomains) {
$this->allowedObjectDomains = $allowedObjectDomains;
}
/**
* @return array
*/
public function getAllowedFrameDomains() {
return $this->allowedFrameDomains;
}
/**
* @param array $allowedFrameDomains
*/
public function setAllowedFrameDomains($allowedFrameDomains) {
$this->allowedFrameDomains = $allowedFrameDomains;
}
/**
* @return array
*/
public function getAllowedFontDomains() {
return $this->allowedFontDomains;
}
/**
* @param array $allowedFontDomains
*/
public function setAllowedFontDomains($allowedFontDomains) {
$this->allowedFontDomains = $allowedFontDomains;
}
/**
* @return array
*/
public function getAllowedChildSrcDomains() {
return $this->allowedChildSrcDomains;
}
/**
* @param array $allowedChildSrcDomains
*/
public function setAllowedChildSrcDomains($allowedChildSrcDomains) {
$this->allowedChildSrcDomains = $allowedChildSrcDomains;
}
/**
* @return array
*/
public function getAllowedFrameAncestors() {
return $this->allowedFrameAncestors;
}
/**
* @param array $allowedFrameAncestors
*/
public function setAllowedFrameAncestors($allowedFrameAncestors) {
$this->allowedFrameAncestors = $allowedFrameAncestors;
}
Add public API to give developers the possibility to adjust the global CSP defaults Allows to inject something into the default content policy. This is for example useful when you're injecting Javascript code into a view belonging to another controller and cannot modify its Content-Security-Policy itself. Note that the adjustment is only applied to applications that use AppFramework controllers. To use this from your `app.php` use `\OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy)`, $policy has to be of type `\OCP\AppFramework\Http\ContentSecurityPolicy`. To test this add something like the following into an `app.php` of any enabled app: ``` $manager = \OC::$server->getContentSecurityPolicyManager(); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('asdf'); $policy->addAllowedScriptDomain('yolo.com'); $policy->allowInlineScript(false); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFontDomain('yolo.com'); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('banana.com'); $manager->addDefaultPolicy($policy); ``` If you now open the files app the policy should be: ``` Content-Security-Policy:default-src 'none';script-src yolo.com 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src yolo.com 'self';connect-src 'self';media-src 'self';frame-src asdf banana.com 'self' ```
2016-01-28 16:33:02 +03:00
}