mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #14952 from nextcloud/enh/14179/api_csp 

Set empty CSP by default
This commit is contained in:
Roeland Jago Douma 2019-04-16 16:43:32 +02:00 committed by GitHub
parent 34aa51f126 7276735eb4
commit 29d78eaf80
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
15 changed files with 38 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
lib/public/AppFramework/Http/DataDisplayResponse.php
View File

@ -49,6 +49,8 @@ class DataDisplayResponse extends Response {
*/
public function __construct($data='', $statusCode=Http::STATUS_OK,
$headers=[]) {
parent::__construct();
$this->data = $data;
$this->setStatus($statusCode);
$this->setHeaders(array_merge($this->getHeaders(), $headers));

2
lib/public/AppFramework/Http/DataResponse.php
View File

@ -52,6 +52,8 @@ class DataResponse extends Response {
*/
public function __construct($data=array(), $statusCode=Http::STATUS_OK,
array $headers=array()) {
parent::__construct();
$this->data = $data;
$this->setStatus($statusCode);
$this->setHeaders(array_merge($this->getHeaders(), $headers));

4
lib/public/AppFramework/Http/DownloadResponse.php
View File

@ -30,7 +30,7 @@ namespace OCP\AppFramework\Http;
* Prompts the user to download the a file
* @since 7.0.0
*/
class DownloadResponse extends \OCP\AppFramework\Http\Response {
class DownloadResponse extends Response {
private $filename;
private $contentType;
@ -42,6 +42,8 @@ class DownloadResponse extends \OCP\AppFramework\Http\Response {
* @since 7.0.0
*/
public function __construct($filename, $contentType) {
parent::__construct();
$this->filename = $filename;
$this->contentType = $contentType;

2
lib/public/AppFramework/Http/FileDisplayResponse.php
View File

@ -45,6 +45,8 @@ class FileDisplayResponse extends Response implements ICallbackResponse {
*/
public function __construct($file, $statusCode=Http::STATUS_OK,
$headers=[]) {
parent::__construct();
$this->file = $file;
$this->setStatus($statusCode);
$this->setHeaders(array_merge($this->getHeaders(), $headers));

2
lib/public/AppFramework/Http/JSONResponse.php
View File

@ -53,6 +53,8 @@ class JSONResponse extends Response {
* @since 6.0.0
*/
public function __construct($data=array(), $statusCode=Http::STATUS_OK) {
parent::__construct();
$this->data = $data;
$this->setStatus($statusCode);
$this->addHeader('Content-Type', 'application/json; charset=utf-8');

2
lib/public/AppFramework/Http/NotFoundResponse.php
View File

@ -35,6 +35,8 @@ class NotFoundResponse extends Response {
* @since 8.1.0
*/
public function __construct() {
parent::__construct();
$this->setStatus(404);
}

2
lib/public/AppFramework/Http/OCSResponse.php
View File

@ -59,6 +59,8 @@ class OCSResponse extends Response {
public function __construct($format, $statuscode, $message,
$data=[], $itemscount='',
$itemsperpage='') {
parent::__construct();
$this->format = $format;
$this->statuscode = $statuscode;
$this->message = $message;

2
lib/public/AppFramework/Http/RedirectResponse.php
View File

@ -43,6 +43,8 @@ class RedirectResponse extends Response {
* @since 7.0.0
*/
public function __construct($redirectURL) {
parent::__construct();
$this->redirectURL = $redirectURL;
$this->setStatus(Http::STATUS_SEE_OTHER);
$this->addHeader('Location', $redirectURL);

9
lib/public/AppFramework/Http/Response.php
View File

@ -89,6 +89,15 @@ class Response {
/** @var array */
private $throttleMetadata = [];
/**
* Response constructor.
*
* @since 17.0.0
*/
public function __construct() {
$this->setContentSecurityPolicy(new EmptyContentSecurityPolicy());
}
/**
* Caches the response
* @param int $cacheSeconds the amount of seconds that should be cached

2
lib/public/AppFramework/Http/StreamResponse.php
View File

@ -42,6 +42,8 @@ class StreamResponse extends Response implements ICallbackResponse {
* @since 8.1.0
*/
public function __construct ($filePath) {
parent::__construct();
$this->filePath = $filePath;
}

4
lib/public/AppFramework/Http/TemplateResponse.php
View File

@ -75,10 +75,14 @@ class TemplateResponse extends Response {
*/
public function __construct($appName, $templateName, array $params=array(),
$renderAs='user') {
parent::__construct();
$this->templateName = $templateName;
$this->appName = $appName;
$this->params = $params;
$this->renderAs = $renderAs;
$this->setContentSecurityPolicy(new ContentSecurityPolicy());
}

2
lib/public/AppFramework/Http/ZipResponse.php
View File

@ -44,6 +44,8 @@ class ZipResponse extends Response implements ICallbackResponse {
* @since 15.0.0
*/
public function __construct(IRequest $request, string $name = 'output') {
parent::__construct();
$this->name = $name;
$this->request = $request;
}

2
tests/lib/AppFramework/Controller/ControllerTest.php
View File

@ -116,7 +116,7 @@ class ControllerTest extends \Test\TestCase {
'test' => 'something',
'Cache-Control' => 'no-cache, no-store, must-revalidate',
'Content-Type' => 'application/json; charset=utf-8',
'Content-Security-Policy' => "default-src 'none';base-uri 'none';manifest-src 'self';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self' data:;connect-src 'self';media-src 'self';frame-ancestors 'self'",
'Content-Security-Policy' => "default-src 'none';base-uri 'none';manifest-src 'self'",
];
$response = $this->controller->customDataResponse(array('hi'));

2
tests/lib/AppFramework/Http/DataResponseTest.php
View File

@ -68,7 +68,7 @@ class DataResponseTest extends \Test\TestCase {
$expectedHeaders = [
'Cache-Control' => 'no-cache, no-store, must-revalidate',
'Content-Security-Policy' => "default-src 'none';base-uri 'none';manifest-src 'self';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self' data:;connect-src 'self';media-src 'self';frame-ancestors 'self'",
'Content-Security-Policy' => "default-src 'none';base-uri 'none';manifest-src 'self'",
];
$expectedHeaders = array_merge($expectedHeaders, $headers);

4
tests/lib/AppFramework/Http/ResponseTest.php
View File

@ -59,7 +59,7 @@ class ResponseTest extends \Test\TestCase {
$this->childResponse->setHeaders($expected);
$headers = $this->childResponse->getHeaders();
$expected['Content-Security-Policy'] = "default-src 'none';base-uri 'none';manifest-src 'self';script-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src 'self' data:;connect-src 'self';media-src 'self';frame-ancestors 'self'";
$expected['Content-Security-Policy'] = "default-src 'none';base-uri 'none';manifest-src 'self'";
$this->assertEquals($expected, $headers);
}
@ -86,7 +86,7 @@ class ResponseTest extends \Test\TestCase {
}
public function testGetCspEmpty() {
$this->assertNull($this->childResponse->getContentSecurityPolicy());
$this->assertEquals(new Http\EmptyContentSecurityPolicy(), $this->childResponse->getContentSecurityPolicy());
}
public function testAddHeaderValueNullDeletesIt(){