1 files changed, 60 insertions, 0 deletions
diff --git a/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php
new file mode 100644
index 00000000000..993f74ae0e4
--- /dev/null
+++ b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php
@@ -0,0 +1,60 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2016 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+namespace OC\Security\CSP;
+
+use OC\AppFramework\Http\Request;
+use OC\Security\CSRF\CsrfTokenManager;
+use OCP\IRequest;
+
+/**
+ * @package OC\Security\CSP
+ */
+class ContentSecurityPolicyNonceManager {
+	private string $nonce = '';
+
+	public function __construct(
+		private CsrfTokenManager $csrfTokenManager,
+		private IRequest $request,
+	) {
+	}
+
+	/**
+	 * Returns the current CSP nonce
+	 */
+	public function getNonce(): string {
+		if ($this->nonce === '') {
+			if (empty($this->request->server['CSP_NONCE'])) {
+				// Get the token from the CSRF token, we only use the "shared secret" part
+				// as the first part does not add any security / entropy to the token
+				// so it can be ignored to keep the nonce short while keeping the same randomness
+				$csrfSecret = explode(':', ($this->csrfTokenManager->getToken()->getEncryptedValue()));
+				$this->nonce = end($csrfSecret);
+			} else {
+				$this->nonce = $this->request->server['CSP_NONCE'];
+			}
+		}
+
+		return $this->nonce;
+	}
+
+	/**
+	 * Check if the browser supports CSP v3
+	 */
+	public function browserSupportsCspV3(): bool {
+		$browserBlocklist = [
+			Request::USER_AGENT_IE,
+		];
+
+		if ($this->request->isUserAgent($browserBlocklist)) {
+			return false;
+		}
+
+		return true;
+	}
+}