Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-29 03:59:21 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Improved handling of Content-Security-Policy

Browse source
This commit is contained in:
the-djmaze 2022-11-07 11:38:36 +01:00
parent 5cd5f77c6f
commit 92d967f1e6
5 changed files with 77 additions and 32 deletions
Download patch file Download diff file Expand all files Collapse all files

50
integrations/nextcloud/snappymail/lib/ContentSecurityPolicy.php Normal file
View file

@ -0,0 +1,50 @@
<?php
namespace OCA\SnappyMail;
class ContentSecurityPolicy extends \OCP\AppFramework\Http\ContentSecurityPolicy {
/** @var bool Whether inline JS snippets are allowed */
protected $inlineScriptAllowed = false;
/** @var bool Whether eval in JS scripts is allowed */
protected $evalScriptAllowed = true;
/** @var bool Whether strict-dynamic should be set */
protected $strictDynamicAllowed = true; // NC24+
/** @var bool Whether inline CSS is allowed */
protected $inlineStyleAllowed = true;
function __construct() {
$CSP = \RainLoop\Api::getCSP();
$this->allowedScriptDomains = \array_unique(\array_merge(
$this->allowedScriptDomains,
$CSP->script
));
$this->allowedScriptDomains = \array_diff($this->allowedScriptDomains, ["'unsafe-inline'", "'unsafe-eval'"]);
if (\method_exists($this, 'useStrictDynamic')) {
$this->allowedScriptDomains = \array_diff($this->allowedScriptDomains, ["'strict-dynamic'"]);
}
$this->allowedImageDomains = \array_unique(\array_merge(
$this->allowedImageDomains,
$CSP->img
));
$this->allowedStyleDomains = \array_unique(\array_merge(
$this->allowedStyleDomains,
$CSP->style
));
$this->allowedStyleDomains = \array_diff($this->allowedStyleDomains, ["'unsafe-inline'"]);
$this->allowedFrameDomains = \array_unique(\array_merge(
$this->allowedFrameDomains,
$CSP->frame
));
$this->reportTo = \array_unique(\array_merge(
$this->reportTo,
$CSP->report_to
));
}
}

16
integrations/nextcloud/snappymail/lib/Controller/PageController.php
View file

@ -3,9 +3,9 @@
namespace OCA\SnappyMail\Controller;
use OCA\SnappyMail\Util\SnappyMailHelper;
use OCA\SnappyMail\ContentSecurityPolicy;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\ContentSecurityPolicy;
use OCP\AppFramework\Http\TemplateResponse;
class PageController extends Controller
@ -80,19 +80,7 @@ class PageController extends Controller
$response = new TemplateResponse('snappymail', 'index_embed', $params);
$csp = new ContentSecurityPolicy();
// $csp->addAllowedScriptDomain("'self'");
// CSP level 3
\method_exists($csp, 'useStrictDynamic')
? $csp->useStrictDynamic(true) // NC24+
: $csp->addAllowedScriptDomain("'strict-dynamic'");
// Else CSP level 2
$csp->addAllowedScriptDomain("'unsafe-inline'"); // ignored by CSP 3 'strict-dynamic'
$csp->allowEvalScript(true); // $csp->addAllowedScriptDomain("'unsafe-eval'");
// $csp->addAllowedStyleDomain("'self'");
// $csp->addAllowedStyleDomain("'unsafe-inline'");
// $csp->addAllowedImageDomain("data:");
$response->setContentSecurityPolicy($csp);
$response->setContentSecurityPolicy(new ContentSecurityPolicy());
return $response;
}