BookStack/app/Util/HtmlNonceApplicator.php

64 lines
1.7 KiB
PHP
Raw Normal View History

2021-09-03 18:32:42 -04:00
<?php
namespace BookStack\Util;
use DOMDocument;
use DOMElement;
use DOMNodeList;
use DOMXPath;
class HtmlNonceApplicator
{
protected static $placeholder = '[CSP_NONCE_VALUE]';
2021-09-03 18:32:42 -04:00
/**
* Prepare the given HTML content with nonce attributes including a placeholder
* value which we can target later.
2021-09-03 18:32:42 -04:00
*/
public static function prepare(string $html): string
2021-09-03 18:32:42 -04:00
{
if (empty($html)) {
return $html;
}
$html = '<?xml encoding="utf-8" ?><body>' . $html . '</body>';
2021-09-03 18:32:42 -04:00
libxml_use_internal_errors(true);
$doc = new DOMDocument();
$doc->loadHTML($html, LIBXML_SCHEMA_CREATE);
2021-09-03 18:32:42 -04:00
$xPath = new DOMXPath($doc);
// Apply to scripts
$scriptElems = $xPath->query('//script');
static::addNonceAttributes($scriptElems, static::$placeholder);
2021-09-03 18:32:42 -04:00
// Apply to styles
$styleElems = $xPath->query('//style');
static::addNonceAttributes($styleElems, static::$placeholder);
2021-09-03 18:32:42 -04:00
$returnHtml = '';
$topElems = $doc->documentElement->childNodes->item(0)->childNodes;
foreach ($topElems as $child) {
2021-09-06 17:19:06 -04:00
$content = $doc->saveHTML($child);
$returnHtml .= $content;
2021-09-03 18:32:42 -04:00
}
return $returnHtml;
}
/**
* Apply the give nonce value to the given prepared HTML.
*/
public static function apply(string $html, string $nonce): string
{
return str_replace(static::$placeholder, $nonce, $html);
}
protected static function addNonceAttributes(DOMNodeList $nodes, string $attrValue): void
2021-09-03 18:32:42 -04:00
{
/** @var DOMElement $node */
foreach ($nodes as $node) {
$node->setAttribute('nonce', $attrValue);
2021-09-03 18:32:42 -04:00
}
}
}