mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #11914 from nextcloud/csp/report-uri 

Add report-uri to CSP
This commit is contained in:
Morris Jobke 2018-10-23 16:42:24 +02:00 committed by GitHub
parent ae94c5a94c 579822b6a5
commit 39338aaa67
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 46 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/private/Security/CSP/ContentSecurityPolicy.php
View File

@ -223,4 +223,12 @@ class ContentSecurityPolicy extends \OCP\AppFramework\Http\ContentSecurityPolicy
$this->allowedWorkerSrcDomains = $allowedWorkerSrcDomains;
}
public function getReportTo(): array {
return $this->reportTo;
}
public function setReportTo(array $reportTo) {
$this->reportTo = $reportTo;
}
}

3
lib/public/AppFramework/Http/ContentSecurityPolicy.php
View File

@ -90,4 +90,7 @@ class ContentSecurityPolicy extends EmptyContentSecurityPolicy {
/** @var array Domains from which web-workers can be loaded */
protected $allowedWorkerSrcDomains = [];
/** @var array Locations to report violations to */
protected $reportTo = [];
}

20
lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php
View File

@ -76,6 +76,9 @@ class EmptyContentSecurityPolicy {
/** @var array Domains from which web-workers can be loaded */
protected $allowedWorkerSrcDomains = null;
/** @var array Locations to report violations to */
protected $reportTo = null;
/**
* Whether inline JavaScript snippets are allowed or forbidden
* @param bool $state
@ -383,6 +386,18 @@ class EmptyContentSecurityPolicy {
return $this;
}
/**
* Add location to report CSP violations to
*
* @param string $location
* @return $this
* @since 15.0.0
*/
public function addReportTo(string $location) {
$this->reportTo[] = $location;
return $this;
}
/**
* Get the generated Content-Security-Policy as a string
* @return string
@ -472,6 +487,11 @@ class EmptyContentSecurityPolicy {
$policy .= ';';
}
if (!empty($this->reportTo)) {
$policy .= 'report-uri ' . implode(' ', $this->reportTo);
$policy .= ';';
}
return rtrim($policy, ';');
}
}

15
tests/lib/AppFramework/Http/EmptyContentSecurityPolicyTest.php
View File

@ -451,4 +451,19 @@ class EmptyContentSecurityPolicyTest extends \Test\TestCase {
$this->contentSecurityPolicy->addAllowedScriptDomain("'self'");
$this->assertSame($expectedPolicy, $this->contentSecurityPolicy->buildPolicy());
}
public function testGetPolicyWithReportUri() {
$expectedPolicy = "default-src 'none';base-uri 'none';manifest-src 'self';report-uri https://my-report-uri.com";
$this->contentSecurityPolicy->addReportTo("https://my-report-uri.com");
$this->assertSame($expectedPolicy, $this->contentSecurityPolicy->buildPolicy());
}
public function testGetPolicyWithMultipleReportUri() {
$expectedPolicy = "default-src 'none';base-uri 'none';manifest-src 'self';report-uri https://my-report-uri.com https://my-other-report-uri.com";
$this->contentSecurityPolicy->addReportTo("https://my-report-uri.com");
$this->contentSecurityPolicy->addReportTo("https://my-other-report-uri.com");
$this->assertSame($expectedPolicy, $this->contentSecurityPolicy->buildPolicy());
}
}