mbk-lab
/
nextcloud
2
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Add workerSrc to CSP 

Fixes #11035

Since the child-src directive is deprecated (we should kill it at some
point) we need to have the proper worker-src available

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
This commit is contained in:
Roeland Jago Douma 2018-09-03 16:47:52 +02:00
parent 12a2a754e2
commit c8fe4b4fc8
No known key found for this signature in database
GPG Key ID: F941078878347C0C
3 changed files with 42 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
lib/private/Security/CSP/ContentSecurityPolicy.php
View File

@ -213,4 +213,12 @@ class ContentSecurityPolicy extends \OCP\AppFramework\Http\ContentSecurityPolicy
$this->allowedFrameAncestors = $allowedFrameAncestors;
}
public function getAllowedWorkerSrcDomains(): array {
return $this->allowedWorkerSrcDomains;
}
public function setAllowedWorkerSrcDomains(array $allowedWorkerSrcDomains) {
$this->allowedWorkerSrcDomains = $allowedWorkerSrcDomains;
}
}

3
lib/public/AppFramework/Http/ContentSecurityPolicy.php
View File

@ -91,4 +91,7 @@ class ContentSecurityPolicy extends EmptyContentSecurityPolicy {
/** @var array Domains which can embed this Nextcloud instance */
protected $allowedFrameAncestors = [];
/** @var array Domains from which web-workers can be loaded */
protected $allowedWorkerSrcDomains = [];
}

31
lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php
View File

@ -73,6 +73,8 @@ class EmptyContentSecurityPolicy {
protected $allowedChildSrcDomains = null;
/** @var array Domains which can embed this Nextcloud instance */
protected $allowedFrameAncestors = null;
/** @var array Domains from which web-workers can be loaded */
protected $allowedWorkerSrcDomains = null;
/**
* Whether inline JavaScript snippets are allowed or forbidden
@ -355,6 +357,30 @@ class EmptyContentSecurityPolicy {
return $this;
}
/**
* Domain from which workers can be loaded
*
* @param string $domain
* @return $this
* @since 15.0.0
*/
public function addAllowedWorkerSrcDomain(string $domain) {
$this->allowedWorkerSrcDomains[] = $domain;
return $this;
}
/**
* Remove domain from which workers can be loaded
*
* @param string $domain
* @return $this
* @since 15.0.0
*/
public function disallowWorkerSrcDomain(string $domain) {
$this->allowedWorkerSrcDomains = array_diff($this->allowedWorkerSrcDomains, [$domain]);
return $this;
}
/**
* Get the generated Content-Security-Policy as a string
* @return string
@ -439,6 +465,11 @@ class EmptyContentSecurityPolicy {
$policy .= ';';
}
if (!empty($this->allowedWorkerSrcDomains)) {
$policy .= 'worker-src ' . implode(' ', $this->allowedWorkerSrcDomains);
$policy .= ';';
}
return rtrim($policy, ';');
}
}