From 852c122e56862d04da2e43b3c0685a65284610d2 Mon Sep 17 00:00:00 2001
From: the-djmaze <>
Date: Tue, 5 Apr 2022 14:36:09 +0200
Subject: [PATCH] Prevent base-uri injection

---
 snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php b/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
index 1b9ad019a..85fd5c23f 100644
--- a/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
+++ b/snappymail/v/0.0.0/app/libraries/snappymail/http/csp.php
@@ -8,6 +8,7 @@ namespace SnappyMail\HTTP;
 class CSP
 {
 	public
+		$base = ["'self'"],
 		$default = ["'self'"],
 		// Knockout.js requires unsafe-inline?
 		// Knockout.js requires eval() for observable binding purposes
@@ -34,6 +35,7 @@ class CSP
 	function __toString() : string
 	{
 		$params = [
+			'base-uri ' . \implode(' ', $this->base),
 			'default-src ' . \implode(' ', $this->default)
 		];
 		if ($this->script) {