From b8c5008acf0e2bd04d9a72241943311db99cc833 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Sat, 27 Jul 2019 15:33:55 +0200 Subject: Add feature policy header This adds the events and the classes to modify the feature policy. It also adds a default restricted feature policy. Signed-off-by: Roeland Jago Douma --- .../Security/FeaturePolicy/FeaturePolicy.php | 76 ++++++++++++++++++++++ .../FeaturePolicy/FeaturePolicyManager.php | 76 ++++++++++++++++++++++ 2 files changed, 152 insertions(+) create mode 100644 lib/private/Security/FeaturePolicy/FeaturePolicy.php create mode 100644 lib/private/Security/FeaturePolicy/FeaturePolicyManager.php (limited to 'lib/private/Security') diff --git a/lib/private/Security/FeaturePolicy/FeaturePolicy.php b/lib/private/Security/FeaturePolicy/FeaturePolicy.php new file mode 100644 index 00000000000..bcfb02bf7c2 --- /dev/null +++ b/lib/private/Security/FeaturePolicy/FeaturePolicy.php @@ -0,0 +1,76 @@ + + * + * @author Roeland Jago Douma + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +namespace OC\Security\FeaturePolicy; + +class FeaturePolicy extends \OCP\AppFramework\Http\FeaturePolicy { + + public function getAutoplayDomains(): array { + return $this->autoplayDomains; + } + + public function setAutoplayDomains(array $autoplayDomains): void { + $this->autoplayDomains = $autoplayDomains; + } + + public function getCameraDomains(): array { + return $this->cameraDomains; + } + + public function setCameraDomains(array $cameraDomains): void { + $this->cameraDomains = $cameraDomains; + } + + public function getFullscreenDomains(): array { + return $this->fullscreenDomains; + } + + public function setFullscreenDomains(array $fullscreenDomains): void { + $this->fullscreenDomains = $fullscreenDomains; + } + + public function getGeolocationDomains(): array { + return $this->geolocationDomains; + } + + public function setGeolocationDomains(array $geolocationDomains): void { + $this->geolocationDomains = $geolocationDomains; + } + + public function getMicrophoneDomains(): array { + return $this->microphoneDomains; + } + + public function setMicrophoneDomains(array $microphoneDomains): void { + $this->microphoneDomains = $microphoneDomains; + } + + public function getPaymentDomains(): array { + return $this->paymentDomains; + } + + public function setPaymentDomains(array $paymentDomains): void { + $this->paymentDomains = $paymentDomains; + } +} diff --git a/lib/private/Security/FeaturePolicy/FeaturePolicyManager.php b/lib/private/Security/FeaturePolicy/FeaturePolicyManager.php new file mode 100644 index 00000000000..d5b04a6c16b --- /dev/null +++ b/lib/private/Security/FeaturePolicy/FeaturePolicyManager.php @@ -0,0 +1,76 @@ + + * + * @author Roeland Jago Douma + * + * @license GNU AGPL version 3 or any later version + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU Affero General Public License as + * published by the Free Software Foundation, either version 3 of the + * License, or (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU Affero General Public License for more details. + * + * You should have received a copy of the GNU Affero General Public License + * along with this program. If not, see . + * + */ + +namespace OC\Security\FeaturePolicy; + +use OCP\AppFramework\Http\EmptyFeaturePolicy; +use OCP\EventDispatcher\IEventDispatcher; +use OCP\Security\FeaturePolicy\AddFeaturePolicyEvent; + +class FeaturePolicyManager { + /** @var EmptyFeaturePolicy[] */ + private $policies = []; + + /** @var IEventDispatcher */ + private $dispatcher; + + public function __construct(IEventDispatcher $dispatcher) { + $this->dispatcher = $dispatcher; + } + + public function addDefaultPolicy(EmptyFeaturePolicy $policy): void { + $this->policies[] = $policy; + } + + public function getDefaultPolicy(): FeaturePolicy { + $event = new AddFeaturePolicyEvent($this); + $this->dispatcher->dispatch(AddFeaturePolicyEvent::class, $event); + + $defaultPolicy = new FeaturePolicy(); + foreach ($this->policies as $policy) { + $defaultPolicy = $this->mergePolicies($defaultPolicy, $policy); + } + return $defaultPolicy; + } + + /** + * Merges the first given policy with the second one + * + */ + public function mergePolicies(FeaturePolicy $defaultPolicy, + EmptyFeaturePolicy $originalPolicy): FeaturePolicy { + foreach ((object)(array)$originalPolicy as $name => $value) { + $setter = 'set' . ucfirst($name); + if (\is_array($value)) { + $getter = 'get' . ucfirst($name); + $currentValues = \is_array($defaultPolicy->$getter()) ? $defaultPolicy->$getter() : []; + $defaultPolicy->$setter(\array_values(\array_unique(\array_merge($currentValues, $value)))); + } elseif (\is_bool($value)) { + $defaultPolicy->$setter($value); + } + } + + return $defaultPolicy; + } +} -- cgit v1.2.3