The "Trashbin" and "WebDav" traits were using each other in a circular
dependency ("WebDav" -> "Sharing" -> "Provisioning" -> "BasicStructure"
-> "Trashbin" -> "WebDav"). In PHP 7.3 this worked fine, but in PHP 7.4
the fatal error "Trait 'WebDav' not found in .../Trashbin.php" was
thrown. To solve this now the "TrashBin" trait no longer explicitly uses
"WebDav".
However, due to this change, the class using "TrashBin" is now expected
to also use "WebDav". As the "Trashbin" trait was not needed by most
contexts using the "BasicStructure" trait "Trashbin" was removed from it
and added only to those contexts that actually need it.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Even on solid color images the resizing can cause some small artifacts
that slightly modify the color of certain pixels. Due to this now the
color comparison is no longer strict but fuzzy.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
"sendingAToWithRequesttoken" needs to be used to test some non OCS
endpoints which require the request token to be sent in the request. Now
it is possible to specify the body (or, rather, additional contents
beside the cookies and the request token) for those requests, as it will
be needed for example to upload an avatar.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
Until now requests always had "auth" headers either for an admin or a
regular user, depending on the value of "currentUser". Now, if
"currentUser" starts by "anonymous" no "auth" header is sent, which
makes possible to also test requests with users not logged in.
Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
This adds the Psalm Security Analysis, as described at
https://psalm.dev/docs/security_analysis/
It also adds a plugin for adding input into AppFramework.
The results can be viewed in the GitHub Security tab at
https://github.com/nextcloud/server/security/code-scanning
**Q&A:**
Q: Why do you not use the shipped Psalm version?
A: I do a lot of changes to the Psalm Taint behaviour. Using released
versions is not gonna get us the results we want.
Q: How do I improve false positives?
A: https://psalm.dev/docs/security_analysis/avoiding_false_positives/
Q: How do I add custom sources?
A: https://psalm.dev/docs/security_analysis/custom_taint_sources/
Q: We should run this on apps!
A: Yes.
Q: What will change in Psalm?
A: Quite some of the PHP core functions are not yet marked to propagate
the taint. This leads to results where the taint flow is lost. That's
something that I am currently working on.
Q: Why is the plugin MIT licensed?
A: Because its the first of its kind (based on GitHub Code Search) and
I want other people to copy it if they want to. Security is for all :)
Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
frame-ancestors doesn't fall back to default-src. So when we apply a
very restricted CSP we should make sure to set it to 'none' and not
leave it empty.
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
Nextcloud-PR-Bot
Christoph Wurst
Roeland Jago Douma
Christoph Wurst
Roeland Jago Douma
Daniel Calviño Sánchez
dependabot-preview[bot]
Julius Härtl
Joas Schilling
Joas Schilling
Morris Jobke
Robin Appelman
Lukas Reschke