ContentSecurityPolicyManager.php 2.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990
  1. <?php
  2. declare(strict_types=1);
  3. /**
  4. * @copyright Copyright (c) 2016, ownCloud, Inc.
  5. *
  6. * @author Christoph Wurst <christoph@winzerhof-wurst.at>
  7. * @author Lukas Reschke <lukas@statuscode.ch>
  8. * @author Morris Jobke <hey@morrisjobke.de>
  9. * @author Roeland Jago Douma <roeland@famdouma.nl>
  10. *
  11. * @license AGPL-3.0
  12. *
  13. * This code is free software: you can redistribute it and/or modify
  14. * it under the terms of the GNU Affero General Public License, version 3,
  15. * as published by the Free Software Foundation.
  16. *
  17. * This program is distributed in the hope that it will be useful,
  18. * but WITHOUT ANY WARRANTY; without even the implied warranty of
  19. * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  20. * GNU Affero General Public License for more details.
  21. *
  22. * You should have received a copy of the GNU Affero General Public License, version 3,
  23. * along with this program. If not, see <http://www.gnu.org/licenses/>
  24. *
  25. */
  26. namespace OC\Security\CSP;
  27. use OCP\AppFramework\Http\ContentSecurityPolicy;
  28. use OCP\AppFramework\Http\EmptyContentSecurityPolicy;
  29. use OCP\EventDispatcher\IEventDispatcher;
  30. use OCP\Security\CSP\AddContentSecurityPolicyEvent;
  31. use OCP\Security\IContentSecurityPolicyManager;
  32. class ContentSecurityPolicyManager implements IContentSecurityPolicyManager {
  33. /** @var ContentSecurityPolicy[] */
  34. private array $policies = [];
  35. public function __construct(
  36. private IEventDispatcher $dispatcher,
  37. ) {
  38. }
  39. /** {@inheritdoc} */
  40. public function addDefaultPolicy(EmptyContentSecurityPolicy $policy): void {
  41. $this->policies[] = $policy;
  42. }
  43. /**
  44. * Get the configured default policy. This is not in the public namespace
  45. * as it is only supposed to be used by core itself.
  46. */
  47. public function getDefaultPolicy(): ContentSecurityPolicy {
  48. $event = new AddContentSecurityPolicyEvent($this);
  49. $this->dispatcher->dispatchTyped($event);
  50. $defaultPolicy = new \OC\Security\CSP\ContentSecurityPolicy();
  51. foreach ($this->policies as $policy) {
  52. $defaultPolicy = $this->mergePolicies($defaultPolicy, $policy);
  53. }
  54. return $defaultPolicy;
  55. }
  56. /**
  57. * Merges the first given policy with the second one
  58. */
  59. public function mergePolicies(
  60. ContentSecurityPolicy $defaultPolicy,
  61. EmptyContentSecurityPolicy $originalPolicy,
  62. ): ContentSecurityPolicy {
  63. foreach ((object)(array)$originalPolicy as $name => $value) {
  64. $setter = 'set'.ucfirst($name);
  65. if (\is_array($value)) {
  66. $getter = 'get'.ucfirst($name);
  67. $currentValues = \is_array($defaultPolicy->$getter()) ? $defaultPolicy->$getter() : [];
  68. $defaultPolicy->$setter(array_values(array_unique(array_merge($currentValues, $value))));
  69. } elseif (\is_bool($value)) {
  70. $getter = 'is'.ucfirst($name);
  71. $currentValue = $defaultPolicy->$getter();
  72. // true wins over false
  73. if ($value > $currentValue) {
  74. $defaultPolicy->$setter($value);
  75. }
  76. }
  77. }
  78. return $defaultPolicy;
  79. }
  80. }