From 2916e5df7e08fc588e752beaf486d907112a34ee Mon Sep 17 00:00:00 2001 From: Ferdinand Thiessen Date: Thu, 1 Aug 2024 23:06:55 +0200 Subject: feat: Provide CSP nonce as `` element This way we use the CSP nonce for dynamically loaded scripts. Important to notice: The CSP nonce must NOT be injected in `content` as this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors). Signed-off-by: Ferdinand Thiessen --- lib/private/legacy/OC_Template.php | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) (limited to 'lib/private/legacy') diff --git a/lib/private/legacy/OC_Template.php b/lib/private/legacy/OC_Template.php index 5caa733b115..e3e9a7abc5f 100644 --- a/lib/private/legacy/OC_Template.php +++ b/lib/private/legacy/OC_Template.php @@ -43,6 +43,7 @@ class OC_Template extends \OC\Template\Base { $theme = OC_Util::getTheme(); $requestToken = (OC::$server->getSession() && $registerCall) ? \OCP\Util::callRegister() : ''; + $cspNonce = \OCP\Server::get(\OC\Security\CSP\ContentSecurityPolicyNonceManager::class)->getNonce(); $parts = explode('/', $app); // fix translation when app is something like core/lostpassword $l10n = \OC::$server->getL10N($parts[0]); @@ -56,7 +57,13 @@ class OC_Template extends \OC\Template\Base { $this->path = $path; $this->app = $app; - parent::__construct($template, $requestToken, $l10n, $themeDefaults); + parent::__construct( + $template, + $requestToken, + $l10n, + $themeDefaults, + $cspNonce, + ); } -- cgit v1.2.3