-
-
Notifications
You must be signed in to change notification settings - Fork 3.9k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add public API to give developers the possibility to adjust the globa…
…l CSP defaults
Allows to inject something into the default content policy. This is for
example useful when you're injecting Javascript code into a view belonging
to another controller and cannot modify its Content-Security-Policy itself.
Note that the adjustment is only applied to applications that use AppFramework
controllers.
To use this from your `app.php` use `\OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy)`,
$policy has to be of type `\OCP\AppFramework\Http\ContentSecurityPolicy`.
To test this add something like the following into an `app.php` of any enabled app:
```
$manager = \OC::$server->getContentSecurityPolicyManager();
$policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false);
$policy->addAllowedFrameDomain('asdf');
$policy->addAllowedScriptDomain('yolo.com');
$policy->allowInlineScript(false);
$manager->addDefaultPolicy($policy);
$policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false);
$policy->addAllowedFontDomain('yolo.com');
$manager->addDefaultPolicy($policy);
$policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false);
$policy->addAllowedFrameDomain('banana.com');
$manager->addDefaultPolicy($policy);
```
If you now open the files app the policy should be:
```
Content-Security-Policy:default-src 'none';script-src yolo.com 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src yolo.com 'self';connect-src 'self';media-src 'self';frame-src asdf banana.com 'self'
```- Loading branch information
1 parent
8b3d7d0
commit 809ff5a
Showing
15 changed files
with
1,316 additions
and
348 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,199 @@ | ||
| <?php | ||
| /** | ||
| * @author Lukas Reschke <lukas@owncloud.com> | ||
| * | ||
| * @copyright Copyright (c) 2016, ownCloud, Inc. | ||
| * @license AGPL-3.0 | ||
| * | ||
| * This code is free software: you can redistribute it and/or modify | ||
| * it under the terms of the GNU Affero General Public License, version 3, | ||
| * as published by the Free Software Foundation. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * GNU Affero General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU Affero General Public License, version 3, | ||
| * along with this program. If not, see <http://www.gnu.org/licenses/> | ||
| * | ||
| */ | ||
| namespace OC\Security\CSP; | ||
|
|
||
| /** | ||
| * Class ContentSecurityPolicy extends the public class and adds getter and setters. | ||
| * This is necessary since we don't want to expose the setters and getters to the | ||
| * public API. | ||
| * | ||
| * @package OC\Security\CSP | ||
| */ | ||
| class ContentSecurityPolicy extends \OCP\AppFramework\Http\ContentSecurityPolicy { | ||
| /** | ||
| * @return boolean | ||
| */ | ||
| public function isInlineScriptAllowed() { | ||
| return $this->inlineScriptAllowed; | ||
| } | ||
|
|
||
| /** | ||
| * @param boolean $inlineScriptAllowed | ||
| */ | ||
| public function setInlineScriptAllowed($inlineScriptAllowed) { | ||
| $this->inlineScriptAllowed = $inlineScriptAllowed; | ||
| } | ||
|
|
||
| /** | ||
| * @return boolean | ||
| */ | ||
| public function isEvalScriptAllowed() { | ||
| return $this->evalScriptAllowed; | ||
| } | ||
|
|
||
| /** | ||
| * @param boolean $evalScriptAllowed | ||
| */ | ||
| public function setEvalScriptAllowed($evalScriptAllowed) { | ||
| $this->evalScriptAllowed = $evalScriptAllowed; | ||
| } | ||
|
|
||
| /** | ||
| * @return array | ||
| */ | ||
| public function getAllowedScriptDomains() { | ||
| return $this->allowedScriptDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @param array $allowedScriptDomains | ||
| */ | ||
| public function setAllowedScriptDomains($allowedScriptDomains) { | ||
| $this->allowedScriptDomains = $allowedScriptDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @return boolean | ||
| */ | ||
| public function isInlineStyleAllowed() { | ||
| return $this->inlineStyleAllowed; | ||
| } | ||
|
|
||
| /** | ||
| * @param boolean $inlineStyleAllowed | ||
| */ | ||
| public function setInlineStyleAllowed($inlineStyleAllowed) { | ||
| $this->inlineStyleAllowed = $inlineStyleAllowed; | ||
| } | ||
|
|
||
| /** | ||
| * @return array | ||
| */ | ||
| public function getAllowedStyleDomains() { | ||
| return $this->allowedStyleDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @param array $allowedStyleDomains | ||
| */ | ||
| public function setAllowedStyleDomains($allowedStyleDomains) { | ||
| $this->allowedStyleDomains = $allowedStyleDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @return array | ||
| */ | ||
| public function getAllowedImageDomains() { | ||
| return $this->allowedImageDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @param array $allowedImageDomains | ||
| */ | ||
| public function setAllowedImageDomains($allowedImageDomains) { | ||
| $this->allowedImageDomains = $allowedImageDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @return array | ||
| */ | ||
| public function getAllowedConnectDomains() { | ||
| return $this->allowedConnectDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @param array $allowedConnectDomains | ||
| */ | ||
| public function setAllowedConnectDomains($allowedConnectDomains) { | ||
| $this->allowedConnectDomains = $allowedConnectDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @return array | ||
| */ | ||
| public function getAllowedMediaDomains() { | ||
| return $this->allowedMediaDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @param array $allowedMediaDomains | ||
| */ | ||
| public function setAllowedMediaDomains($allowedMediaDomains) { | ||
| $this->allowedMediaDomains = $allowedMediaDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @return array | ||
| */ | ||
| public function getAllowedObjectDomains() { | ||
| return $this->allowedObjectDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @param array $allowedObjectDomains | ||
| */ | ||
| public function setAllowedObjectDomains($allowedObjectDomains) { | ||
| $this->allowedObjectDomains = $allowedObjectDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @return array | ||
| */ | ||
| public function getAllowedFrameDomains() { | ||
| return $this->allowedFrameDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @param array $allowedFrameDomains | ||
| */ | ||
| public function setAllowedFrameDomains($allowedFrameDomains) { | ||
| $this->allowedFrameDomains = $allowedFrameDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @return array | ||
| */ | ||
| public function getAllowedFontDomains() { | ||
| return $this->allowedFontDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @param array $allowedFontDomains | ||
| */ | ||
| public function setAllowedFontDomains($allowedFontDomains) { | ||
| $this->allowedFontDomains = $allowedFontDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @return array | ||
| */ | ||
| public function getAllowedChildSrcDomains() { | ||
| return $this->allowedChildSrcDomains; | ||
| } | ||
|
|
||
| /** | ||
| * @param array $allowedChildSrcDomains | ||
| */ | ||
| public function setAllowedChildSrcDomains($allowedChildSrcDomains) { | ||
| $this->allowedChildSrcDomains = $allowedChildSrcDomains; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,73 @@ | ||
| <?php | ||
| /** | ||
| * @author Lukas Reschke <lukas@owncloud.com> | ||
| * | ||
| * @copyright Copyright (c) 2016, ownCloud, Inc. | ||
| * @license AGPL-3.0 | ||
| * | ||
| * This code is free software: you can redistribute it and/or modify | ||
| * it under the terms of the GNU Affero General Public License, version 3, | ||
| * as published by the Free Software Foundation. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * GNU Affero General Public License for more details. | ||
| * | ||
| * You should have received a copy of the GNU Affero General Public License, version 3, | ||
| * along with this program. If not, see <http://www.gnu.org/licenses/> | ||
| * | ||
| */ | ||
|
|
||
| namespace OC\Security\CSP; | ||
|
|
||
| use OCP\AppFramework\Http\ContentSecurityPolicy; | ||
| use OCP\AppFramework\Http\EmptyContentSecurityPolicy; | ||
| use OCP\Security\IContentSecurityPolicyManager; | ||
|
|
||
| class ContentSecurityPolicyManager implements IContentSecurityPolicyManager { | ||
| /** @var ContentSecurityPolicy[] */ | ||
| private $policies = []; | ||
|
|
||
| /** {@inheritdoc} */ | ||
| public function addDefaultPolicy(EmptyContentSecurityPolicy $policy) { | ||
| $this->policies[] = $policy; | ||
| } | ||
|
|
||
| /** | ||
| * Get the configured default policy. This is not in the public namespace | ||
| * as it is only supposed to be used by core itself. | ||
| * | ||
| * @return ContentSecurityPolicy | ||
| */ | ||
| public function getDefaultPolicy() { | ||
| $defaultPolicy = new \OC\Security\CSP\ContentSecurityPolicy(); | ||
| foreach($this->policies as $policy) { | ||
| $defaultPolicy = $this->mergePolicies($defaultPolicy, $policy); | ||
| } | ||
| return $defaultPolicy; | ||
| } | ||
|
|
||
| /** | ||
| * Merges the first given policy with the second one | ||
| * | ||
| * @param ContentSecurityPolicy $defaultPolicy | ||
| * @param EmptyContentSecurityPolicy $originalPolicy | ||
| * @return ContentSecurityPolicy | ||
| */ | ||
| public function mergePolicies(ContentSecurityPolicy $defaultPolicy, | ||
| EmptyContentSecurityPolicy $originalPolicy) { | ||
| foreach((object)(array)$originalPolicy as $name => $value) { | ||
| $setter = 'set'.ucfirst($name); | ||
| if(is_array($value)) { | ||
| $getter = 'get'.ucfirst($name); | ||
| $currentValues = is_array($defaultPolicy->$getter()) ? $defaultPolicy->$getter() : []; | ||
| $defaultPolicy->$setter(array_values(array_unique(array_merge($currentValues, $value)))); | ||
| } elseif (is_bool($value)) { | ||
| $defaultPolicy->$setter($value); | ||
| } | ||
| } | ||
|
|
||
| return $defaultPolicy; | ||
| } | ||
| } |
Oops, something went wrong.