mirror of
https://github.com/BookStackApp/BookStack.git
synced 2024-08-26 04:05:57 +00:00
Started application of CSP headers
This commit is contained in:
parent
040997fdc4
commit
fd44e4ba74
@ -24,7 +24,7 @@ class Kernel extends HttpKernel
|
|||||||
*/
|
*/
|
||||||
protected $middlewareGroups = [
|
protected $middlewareGroups = [
|
||||||
'web' => [
|
'web' => [
|
||||||
\BookStack\Http\Middleware\ControlIframeSecurity::class,
|
\BookStack\Http\Middleware\ApplyCspRules::class,
|
||||||
\BookStack\Http\Middleware\EncryptCookies::class,
|
\BookStack\Http\Middleware\EncryptCookies::class,
|
||||||
\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
|
\Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
|
||||||
\Illuminate\Session\Middleware\StartSession::class,
|
\Illuminate\Session\Middleware\StartSession::class,
|
||||||
|
69
app/Http/Middleware/ApplyCspRules.php
Normal file
69
app/Http/Middleware/ApplyCspRules.php
Normal file
@ -0,0 +1,69 @@
|
|||||||
|
<?php
|
||||||
|
|
||||||
|
namespace BookStack\Http\Middleware;
|
||||||
|
|
||||||
|
use Closure;
|
||||||
|
use Illuminate\Http\Request;
|
||||||
|
use Illuminate\Support\Str;
|
||||||
|
use Symfony\Component\HttpFoundation\Response;
|
||||||
|
|
||||||
|
|
||||||
|
class ApplyCspRules
|
||||||
|
{
|
||||||
|
/**
|
||||||
|
* Handle an incoming request.
|
||||||
|
*
|
||||||
|
* @param Request $request
|
||||||
|
* @param Closure $next
|
||||||
|
*
|
||||||
|
* @return mixed
|
||||||
|
*/
|
||||||
|
public function handle($request, Closure $next)
|
||||||
|
{
|
||||||
|
$nonce = Str::random(24);
|
||||||
|
view()->share('cspNonce', $nonce);
|
||||||
|
|
||||||
|
// TODO - Assess whether image/style/iframe CSP rules should be set
|
||||||
|
// TODO - Extract nonce application to custom head content in a way that's cacheable.
|
||||||
|
// TODO - Fix remaining CSP issues and test lots
|
||||||
|
|
||||||
|
$response = $next($request);
|
||||||
|
|
||||||
|
$this->setFrameAncestors($response);
|
||||||
|
$this->setScriptSrc($response, $nonce);
|
||||||
|
|
||||||
|
return $response;
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets CSP 'script-src' headers to restrict the forms of script that can
|
||||||
|
* run on the page.
|
||||||
|
*/
|
||||||
|
public function setScriptSrc(Response $response, string $nonce)
|
||||||
|
{
|
||||||
|
$parts = [
|
||||||
|
'\'self\'',
|
||||||
|
'\'nonce-' . $nonce . '\'',
|
||||||
|
'\'strict-dynamic\'',
|
||||||
|
];
|
||||||
|
$response->headers->set('Content-Security-Policy', 'script-src ' . implode(' ', $parts));
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* Sets CSP "frame-ancestors" headers to restrict the hosts that BookStack can be
|
||||||
|
* iframed within. Also adjusts the cookie samesite options so that cookies will
|
||||||
|
* operate in the third-party context.
|
||||||
|
*/
|
||||||
|
protected function setFrameAncestors(Response $response)
|
||||||
|
{
|
||||||
|
$iframeHosts = collect(explode(' ', config('app.iframe_hosts', '')))->filter();
|
||||||
|
|
||||||
|
if ($iframeHosts->count() > 0) {
|
||||||
|
config()->set('session.same_site', 'none');
|
||||||
|
}
|
||||||
|
|
||||||
|
$iframeHosts->prepend("'self'");
|
||||||
|
$cspValue = 'frame-ancestors ' . $iframeHosts->join(' ');
|
||||||
|
$response->headers->set('Content-Security-Policy', $cspValue);
|
||||||
|
}
|
||||||
|
}
|
@ -1,37 +0,0 @@
|
|||||||
<?php
|
|
||||||
|
|
||||||
namespace BookStack\Http\Middleware;
|
|
||||||
|
|
||||||
use Closure;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Sets CSP headers to restrict the hosts that BookStack can be
|
|
||||||
* iframed within. Also adjusts the cookie samesite options
|
|
||||||
* so that cookies will operate in the third-party context.
|
|
||||||
*/
|
|
||||||
class ControlIframeSecurity
|
|
||||||
{
|
|
||||||
/**
|
|
||||||
* Handle an incoming request.
|
|
||||||
*
|
|
||||||
* @param \Illuminate\Http\Request $request
|
|
||||||
* @param \Closure $next
|
|
||||||
*
|
|
||||||
* @return mixed
|
|
||||||
*/
|
|
||||||
public function handle($request, Closure $next)
|
|
||||||
{
|
|
||||||
$iframeHosts = collect(explode(' ', config('app.iframe_hosts', '')))->filter();
|
|
||||||
if ($iframeHosts->count() > 0) {
|
|
||||||
config()->set('session.same_site', 'none');
|
|
||||||
}
|
|
||||||
|
|
||||||
$iframeHosts->prepend("'self'");
|
|
||||||
|
|
||||||
$response = $next($request);
|
|
||||||
$cspValue = 'frame-ancestors ' . $iframeHosts->join(' ');
|
|
||||||
$response->headers->set('Content-Security-Policy', $cspValue);
|
|
||||||
|
|
||||||
return $response;
|
|
||||||
}
|
|
||||||
}
|
|
@ -10,7 +10,7 @@ use DOMXPath;
|
|||||||
class HtmlContentFilter
|
class HtmlContentFilter
|
||||||
{
|
{
|
||||||
/**
|
/**
|
||||||
* Remove all of the script elements from the given HTML.
|
* Remove all the script elements from the given HTML.
|
||||||
*/
|
*/
|
||||||
public static function removeScripts(string $html): string
|
public static function removeScripts(string $html): string
|
||||||
{
|
{
|
||||||
|
52
app/Util/HtmlNonceApplicator.php
Normal file
52
app/Util/HtmlNonceApplicator.php
Normal file
@ -0,0 +1,52 @@
|
|||||||
|
<?php
|
||||||
|
|
||||||
|
namespace BookStack\Util;
|
||||||
|
|
||||||
|
use DOMDocument;
|
||||||
|
use DOMElement;
|
||||||
|
use DOMNodeList;
|
||||||
|
use DOMXPath;
|
||||||
|
|
||||||
|
class HtmlNonceApplicator
|
||||||
|
{
|
||||||
|
/**
|
||||||
|
* Apply the given nonce to all scripts and styles in the given html.
|
||||||
|
*/
|
||||||
|
public static function apply(string $html, string $nonce): string
|
||||||
|
{
|
||||||
|
if (empty($html)) {
|
||||||
|
return $html;
|
||||||
|
}
|
||||||
|
|
||||||
|
$html = '<body>' . $html . '</body>';
|
||||||
|
libxml_use_internal_errors(true);
|
||||||
|
$doc = new DOMDocument();
|
||||||
|
$doc->loadHTML(mb_convert_encoding($html, 'HTML-ENTITIES', 'UTF-8'));
|
||||||
|
$xPath = new DOMXPath($doc);
|
||||||
|
|
||||||
|
// Apply to scripts
|
||||||
|
$scriptElems = $xPath->query('//script');
|
||||||
|
static::addNonceAttributes($scriptElems, $nonce);
|
||||||
|
|
||||||
|
// Apply to styles
|
||||||
|
$styleElems = $xPath->query('//style');
|
||||||
|
static::addNonceAttributes($styleElems, $nonce);
|
||||||
|
|
||||||
|
$returnHtml = '';
|
||||||
|
$topElems = $doc->documentElement->childNodes->item(0)->childNodes;
|
||||||
|
foreach ($topElems as $child) {
|
||||||
|
$returnHtml .= $doc->saveHTML($child);
|
||||||
|
}
|
||||||
|
|
||||||
|
return $returnHtml;
|
||||||
|
}
|
||||||
|
|
||||||
|
protected static function addNonceAttributes(DOMNodeList $nodes, string $nonce): void
|
||||||
|
{
|
||||||
|
/** @var DOMElement $node */
|
||||||
|
foreach ($nodes as $node) {
|
||||||
|
$node->setAttribute('nonce', $nonce);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
}
|
@ -1,5 +1,5 @@
|
|||||||
@if(setting('app-custom-head') && \Route::currentRouteName() !== 'settings')
|
@if(setting('app-custom-head') && \Route::currentRouteName() !== 'settings')
|
||||||
<!-- Custom user content -->
|
<!-- Custom user content -->
|
||||||
{!! setting('app-custom-head') !!}
|
{!! \BookStack\Util\HtmlNonceApplicator::apply(setting('app-custom-head'), $cspNonce) !!}
|
||||||
<!-- End custom user content -->
|
<!-- End custom user content -->
|
||||||
@endif
|
@endif
|
Loading…
Reference in New Issue
Block a user