aboutsummaryrefslogtreecommitdiffstats
path: root/lib/private/Security/CSP
Commit message (Collapse)AuthorAgeFilesLines
* chore(deps): Update nextcloud/coding-standard to v1.3.1provokateurin2024-09-191-3/+3
| | | | Signed-off-by: provokateurin <kate@provokateurin.de>
* feat: Provide CSP nonce as `<meta>` elementFerdinand Thiessen2024-08-131-1/+2
| | | | | | | | This way we use the CSP nonce for dynamically loaded scripts. Important to notice: The CSP nonce must NOT be injected in `content` as this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors). Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* fix: Make sure CSP nonce is not double base64 encodedFerdinand Thiessen2024-08-131-1/+4
| | | | Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* chore: Add SPDX headerAndy Scherzinger2024-05-243-66/+8
| | | | Signed-off-by: Andy Scherzinger <info@andy-scherzinger.de>
* fix(CSP): Add CSP nonce by default and convert `browserSupportsCspV3` to ↵Ferdinand Thiessen2024-03-261-8/+5
| | | | | | blocklist Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* fix: Add edge as supported user agent for CSPv3 noncesJulius Härtl2024-03-081-0/+1
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* feat(ContentSecurityPolicy): Allow to set `strict-dynamic` on ↵Ferdinand Thiessen2023-11-171-0/+8
| | | | | | | | | `script-src-elem` only This adds the possibility to set `strict-dynamic` on `script-src-elem` only while keep the default rules for `script-src`. The idea is to allow loading module js which imports other files and thus does not allow nonces on import but on the initial script tag. Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
* Refactors lib/private/Security.Faraz Samapoor2023-09-273-125/+31
| | | | | | Mainly using PHP8's constructor property promotion. Signed-off-by: Faraz Samapoor <fsa@adlas.at>
* Allow "wasm-unsafe-eval" in CSPDaniel Calviño Sánchez2023-08-101-0/+8
| | | | | | | | | | | | | | | | | | If a page has a Content Security Policy header and the `script-src` (or `default-src`) directive does not contain neither `wasm-unsafe-eval` nor `unsafe-eval` loading and executing WebAssembly is blocked in the page (although it is still possible to load and execute WebAssembly in a worker thread). Although the Nextcloud classes to manage the CSP already supported allowing `unsafe-eval` this affects not only WebAssembly, but also the `eval` operation in JavaScript. To make possible to allow WebAssembly execution without allowing JavaScript `eval` this commit adds support for allowing `wasm-unsafe-eval`. Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>
* Fix detection of firefox in ContentSecurityPolicyNonceManagerCarl Schwan2022-06-291-4/+2
| | | | | | | | Reuse Request::USER_AGENT_FIREFOX, and also update the safari detection since safari < 12 is not supported anymore and we can remove a bit of code duplication Signed-off-by: Carl Schwan <carl@carlschwan.eu>
* Add CSP policy merge priority for booleansVincent Petry2022-04-012-1/+13
| | | | | | When two booleans conflict when merging CSP policies, true will win. Signed-off-by: Vincent Petry <vincent@nextcloud.com>
* Allow to set a strict-dynamic CSP through the APIJulius Härtl2022-03-091-0/+7
| | | | Signed-off-by: Julius Härtl <jus@bitgrid.net>
* Update php licensesJohn Molakvoæ (skjnldsv)2021-06-043-4/+1
| | | | Signed-off-by: John Molakvoæ (skjnldsv) <skjnldsv@protonmail.com>
* Update the license headers for Nextcloud 20Christoph Wurst2020-08-241-0/+1
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Prefer typed event over string based onesMorris Jobke2020-08-101-1/+1
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Update license headers for 19Christoph Wurst2020-04-292-0/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Format control structures, classes, methods and functionChristoph Wurst2020-04-103-6/+5
| | | | | | | | | | | | | | | To continue this formatting madness, here's a tiny patch that adds unified formatting for control structures like if and loops as well as classes, their methods and anonymous functions. This basically forces the constructs to start on the same line. This is not exactly what PSR2 wants, but I think we can have a few exceptions with "our" style. The starting of braces on the same line is pracrically standard for our code. This also removes and empty lines from method/function bodies at the beginning and end. Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Update the license headers for Nextcloud 19Christoph Wurst2020-03-312-1/+2
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* fix safari useragent for versions with 3 digitsPavel Krasikov2020-03-141-1/+1
| | | | Signed-off-by: Pavel Krasikov <klonishe@gmail.com>
* Update license headersChristoph Wurst2019-12-053-3/+12
| | | | Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>
* Some php-cs fixesRoeland Jago Douma2019-11-221-0/+1
| | | | | | | | | | | * Order the imports * No leading slash on imports * Empty line before namespace * One line per import * Empty after imports * Emmpty line at bottom of file Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add form-action CSP elementRoeland Jago Douma2019-07-311-0/+9
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* setting unsafe-eval is deprecatedRoeland Jago Douma2019-07-301-0/+2
| | | | | | This will be removed in a future version of Nextcloud. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add support for CSP_NONCE server variableSam Bull2019-07-181-1/+5
| | | | | | | Allow passing a nonce from the web server, allowing the possibility to enforce a strict CSP from the web server. Signed-off-by: Sam Bull <git@sambull.org> Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add an event to edit the CSPRoeland Jago Douma2019-07-081-0/+12
| | | | | | | | This introduces and event that can be listend to when we actually use the CSP. This means that apps no longer have to always inject their CSP but only do so when it is required. Yay for being lazy. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Merge pull request #11914 from nextcloud/csp/report-uriMorris Jobke2018-10-231-0/+8
|\ | | | | Add report-uri to CSP
| * Add report-uri to CSPRoeland Jago Douma2018-10-211-0/+8
| | | | | | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* | Add nonce for Safari 12+Roeland Jago Douma2018-10-211-0/+2
|/ | | | | | As far as I can tell this should work now. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Deprecate the childSrc functionsRoeland Jago Douma2018-09-041-0/+2
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add workerSrc to CSPRoeland Jago Douma2018-09-041-0/+8
| | | | | | | | | Fixes #11035 Since the child-src directive is deprecated (we should kill it at some point) we need to have the proper worker-src available Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Make OC\Security\CSP strictRoeland Jago Douma2018-03-053-30/+33
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Update license headersMorris Jobke2017-11-062-0/+5
| | | | Signed-off-by: Morris Jobke <hey@morrisjobke.de>
* Add CSP frame-ancestors supportThomas Citharel2017-09-151-0/+14
| | | | | | Didn't set the @since annotation yet. Signed-off-by: Thomas Citharel <tcit@tcit.fr>
* Safari CSPv3 support is sub-parLukas Reschke2016-12-141-2/+0
| | | | | | | | With 10.0.1 CSPv3 is broken in Safari if it doesn't run from a local IP. Awesome. => Let's remove this for Safari and keep chrome and Firefox in the whitelist. Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Identify Chromium as ChromeJoas Schilling2016-10-261-2/+2
| | | | Signed-off-by: Joas Schilling <coding@schilljs.com>
* Missing returns + autoloader fileLukas Reschke2016-10-251-0/+1
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Move browserSupportsCspV3 to CSPNonceManagerRoeland Jago Douma2016-10-251-1/+28
| | | | Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>
* Add ContentSecurityPolicyNonceManagerLukas Reschke2016-10-241-0/+54
| | | | Signed-off-by: Lukas Reschke <lukas@statuscode.ch>
* Fix othersJoas Schilling2016-07-212-2/+4
|
* Update license headersLukas Reschke2016-05-262-2/+2
|
* Move \OC\Security to PSR-4Roeland Jago Douma2016-04-142-0/+272
generated by cgit v1.2.3 (git 2.39.1) at 2025-06-30 05:27:12 +0000