From b8c5bff673c297fd143a09dc31ad0a1cc0b124d7 Mon Sep 17 00:00:00 2001 From: Julius Härtl Date: Fri, 23 Feb 2024 10:52:04 +0100 Subject: fix: Adjust user agent pattern for Edge MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julius Härtl --- lib/private/AppFramework/Http/Request.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/private/AppFramework/Http/Request.php b/lib/private/AppFramework/Http/Request.php index b905c6184fa..94054c3e62c 100644 --- a/lib/private/AppFramework/Http/Request.php +++ b/lib/private/AppFramework/Http/Request.php @@ -68,7 +68,7 @@ use Symfony\Component\HttpFoundation\IpUtils; class Request implements \ArrayAccess, \Countable, IRequest { public const USER_AGENT_IE = '/(MSIE)|(Trident)/'; // Microsoft Edge User Agent from https://msdn.microsoft.com/en-us/library/hh869301(v=vs.85).aspx - public const USER_AGENT_MS_EDGE = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Chrome\/[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+ Edge\/[0-9.]+$/'; + public const USER_AGENT_MS_EDGE = '/^Mozilla\/5\.0 \([^)]+\) AppleWebKit\/[0-9.]+ \(KHTML, like Gecko\) Chrome\/[0-9.]+ (Mobile Safari|Safari)\/[0-9.]+ Edge?\/[0-9.]+$/'; // Firefox User Agent from https://developer.mozilla.org/en-US/docs/Web/HTTP/Gecko_user_agent_string_reference public const USER_AGENT_FIREFOX = '/^Mozilla\/5\.0 \([^)]+\) Gecko\/[0-9.]+ Firefox\/[0-9.]+$/'; // Chrome User Agent from https://developer.chrome.com/multidevice/user-agent -- cgit v1.2.3 From 02d6d3f5b128e83589ffde513120e131f28f4de2 Mon Sep 17 00:00:00 2001 From: Julius Härtl Date: Fri, 23 Feb 2024 10:52:31 +0100 Subject: fix: Add edge as supported user agent for CSPv3 nonces MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julius Härtl --- lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php | 1 + 1 file changed, 1 insertion(+) diff --git a/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php index 6573007a459..6dbf86e5c88 100644 --- a/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php +++ b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php @@ -69,6 +69,7 @@ class ContentSecurityPolicyNonceManager { Request::USER_AGENT_CHROME, Request::USER_AGENT_FIREFOX, Request::USER_AGENT_SAFARI, + Request::USER_AGENT_MS_EDGE, ]; if ($this->request->isUserAgent($browserWhitelist)) { -- cgit v1.2.3 From 78ba1b0712a1fd15e408b4e84007d20b6bbe39d6 Mon Sep 17 00:00:00 2001 From: Julius Härtl Date: Fri, 23 Feb 2024 10:53:12 +0100 Subject: fix: Allow nonce in csp header also if no other reasons are given MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Julius Härtl --- lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php index aeee4a4ee74..6662a302d7f 100644 --- a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php +++ b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php @@ -37,8 +37,8 @@ namespace OCP\AppFramework\Http; * @since 9.0.0 */ class EmptyContentSecurityPolicy { - /** @var string JS nonce to be used */ - protected $jsNonce = null; + /** @var ?string JS nonce to be used */ + protected ?string $jsNonce = null; /** @var bool Whether strict-dynamic should be used */ protected $strictDynamicAllowed = null; /** @var bool Whether strict-dynamic should be used on script-src-elem */ @@ -460,7 +460,7 @@ class EmptyContentSecurityPolicy { $policy .= "base-uri 'none';"; $policy .= "manifest-src 'self';"; - if (!empty($this->allowedScriptDomains) || $this->evalScriptAllowed || $this->evalWasmAllowed) { + if (!empty($this->allowedScriptDomains) || $this->evalScriptAllowed || $this->evalWasmAllowed || is_string($this->jsNonce)) { $policy .= 'script-src '; $scriptSrc = ''; if (is_string($this->jsNonce)) { -- cgit v1.2.3