From ecf347bd1aaaeb2cd11b8ffbc60da099c68f1d83 Mon Sep 17 00:00:00 2001 From: Thomas Citharel Date: Mon, 19 Jun 2017 13:55:46 +0200 Subject: Add CSP frame-ancestors support Didn't set the @since annotation yet. Signed-off-by: Thomas Citharel --- .../AppFramework/Http/ContentSecurityPolicy.php | 3 +++ .../Http/EmptyContentSecurityPolicy.php | 31 ++++++++++++++++++++++ 2 files changed, 34 insertions(+) (limited to 'lib/public/AppFramework/Http') diff --git a/lib/public/AppFramework/Http/ContentSecurityPolicy.php b/lib/public/AppFramework/Http/ContentSecurityPolicy.php index 17844497f94..0a792fa2630 100644 --- a/lib/public/AppFramework/Http/ContentSecurityPolicy.php +++ b/lib/public/AppFramework/Http/ContentSecurityPolicy.php @@ -84,4 +84,7 @@ class ContentSecurityPolicy extends EmptyContentSecurityPolicy { ]; /** @var array Domains from which web-workers and nested browsing content can load elements */ protected $allowedChildSrcDomains = []; + + /** @var array Domains which can embeed this Nextcloud instance */ + protected $allowedFrameAncestors = []; } diff --git a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php index 64d4eb6e5d0..d0536259f7a 100644 --- a/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php +++ b/lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php @@ -68,6 +68,8 @@ class EmptyContentSecurityPolicy { protected $allowedFontDomains = null; /** @var array Domains from which web-workers and nested browsing content can load elements */ protected $allowedChildSrcDomains = null; + /** @var array Domains which can embeed this Nextcloud instance */ + protected $allowedFrameAncestors = null; /** * Whether inline JavaScript snippets are allowed or forbidden @@ -326,6 +328,30 @@ class EmptyContentSecurityPolicy { return $this; } + /** + * Domains which can embeed an iFrame of the Nextcloud instance + * + * @param string $domain + * @return $this + * @since 12.x + */ + public function addAllowedFrameAncestorDomain($domain) { + $this->allowedFrameAncestors[] = $domain; + return $this; + } + + /** + * Domains which can embeed an iFrame of the Nextcloud instance + * + * @param string $domain + * @return $this + * @since 12.x + */ + public function disallowFrameAncestorDomain($domain) { + $this->allowedFrameAncestors = array_diff($this->allowedFrameAncestors, [$domain]); + return $this; + } + /** * Get the generated Content-Security-Policy as a string * @return string @@ -405,6 +431,11 @@ class EmptyContentSecurityPolicy { $policy .= ';'; } + if(!empty($this->allowedFrameAncestors)) { + $policy .= 'frame-ancestors ' . implode(' ', $this->allowedFrameAncestors); + $policy .= ';'; + } + return rtrim($policy, ';'); } } -- cgit v1.2.3