From 579822b6a5639ee608e11ed23760d481a4a78f4b Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Tue, 16 Oct 2018 14:04:22 +0200 Subject: Add report-uri to CSP Signed-off-by: Roeland Jago Douma --- .../AppFramework/Http/ContentSecurityPolicy.php | 3 +++ .../AppFramework/Http/EmptyContentSecurityPolicy.php | 20 ++++++++++++++++++++ 2 files changed, 23 insertions(+) (limited to 'lib/public/AppFramework/Http') diff --git a/lib/public/AppFramework/Http/ContentSecurityPolicy.php b/lib/public/AppFramework/Http/ContentSecurityPolicy.php index 02a52c6c49d..597069fdaaf 100644 --- a/lib/public/AppFramework/Http/ContentSecurityPolicy.php +++ b/lib/public/AppFramework/Http/ContentSecurityPolicy.php @@ -90,4 +90,7 @@ class ContentSecurityPolicy extends EmptyContentSecurityPolicy { /** @var array Domains from which web-workers can be loaded */ protected $allowedWorkerSrcDomains = []; + + /** @var array Locations to report violations to */ + protected $reportTo = []; } diff --git a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php index ddc7918d094..3fcef1d0efd 100644 --- a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php +++ b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php @@ -76,6 +76,9 @@ class EmptyContentSecurityPolicy { /** @var array Domains from which web-workers can be loaded */ protected $allowedWorkerSrcDomains = null; + /** @var array Locations to report violations to */ + protected $reportTo = null; + /** * Whether inline JavaScript snippets are allowed or forbidden * @param bool $state @@ -383,6 +386,18 @@ class EmptyContentSecurityPolicy { return $this; } + /** + * Add location to report CSP violations to + * + * @param string $location + * @return $this + * @since 15.0.0 + */ + public function addReportTo(string $location) { + $this->reportTo[] = $location; + return $this; + } + /** * Get the generated Content-Security-Policy as a string * @return string @@ -472,6 +487,11 @@ class EmptyContentSecurityPolicy { $policy .= ';'; } + if (!empty($this->reportTo)) { + $policy .= 'report-uri ' . implode(' ', $this->reportTo); + $policy .= ';'; + } + return rtrim($policy, ';'); } } -- cgit v1.2.3