averello/nextcloud-server-mirror
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-02-27 18:37:17 +01:00
Code Issues Packages Projects Releases Wiki Activity

feat: Provide CSP nonce as <meta> element

Browse Source 
This way we use the CSP nonce for dynamically loaded scripts.
Important to notice: The CSP nonce must NOT be injected in `content` as
this can lead to value exfiltration using e.g. side-channel attacts (CSS selectors).

Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
This commit is contained in:
Ferdinand Thiessen
2024-08-01 23:06:55 +02:00
parent 009761be58
commit 2916e5df7e
9 changed files with 23 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
core/templates/layout.base.php
View File

@@ -14,6 +14,7 @@
</title>
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
<meta name="theme-color" content="<?php p($theme->getColorPrimary()); ?>">
<meta name="csp-nonce" nonce="<?php p($_['cspNonce']); /* Do not pass into "content" to prevent exfiltration */ ?>">
<link rel="icon" href="<?php print_unescaped(image_path('core', 'favicon.ico')); /* IE11+ supports png */ ?>">
<link rel="apple-touch-icon" href="<?php print_unescaped(image_path('core', 'favicon-touch.png')); ?>">
<link rel="mask-icon" sizes="any" href="<?php print_unescaped(image_path('core', 'favicon-mask.svg')); ?>" color="<?php p($theme->getColorPrimary()); ?>">

1
core/templates/layout.guest.php
View File

@@ -19,6 +19,7 @@
p($theme->getTitle());
?>
</title>
<meta name="csp-nonce" nonce="<?php p($_['cspNonce']); /* Do not pass into "content" to prevent exfiltration */ ?>">
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
<?php if ($theme->getiTunesAppId() !== '') { ?>
<meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>">

6
core/templates/layout.initial-state.php
View File

@@ -5,7 +5,7 @@
*/
?>
<div id="initial-state-container" style="display: none;">
<?php foreach ($_['initialStates'] as $app => $initialState) { ?>
<input type="hidden" id="initial-state-<?php p($app); ?>" value="<?php p(base64_encode($initialState)); ?>">
<?php }?>
<?php foreach ($_['initialStates'] as $app => $initialState) { ?>
<input type="hidden" id="initial-state-<?php p($app); ?>" value="<?php p(base64_encode($initialState)); ?>">
<?php }?>
</div>

1
core/templates/layout.public.php
View File

@@ -14,6 +14,7 @@
p($theme->getTitle());
?>
</title>
<meta name="csp-nonce" nonce="<?php p($_['cspNonce']); /* Do not pass into "content" to prevent exfiltration */ ?>">
<meta name="viewport" content="width=device-width, initial-scale=1.0, minimum-scale=1.0">
<?php if ($theme->getiTunesAppId() !== '') { ?>
<meta name="apple-itunes-app" content="app-id=<?php p($theme->getiTunesAppId()); ?>">

1
core/templates/layout.user.php
View File

@@ -29,6 +29,7 @@ p(!empty($_['application']) ? $_['application'].' - ' : '');
p($theme->getTitle());
?>
</title>
<meta name="csp-nonce" nonce="<?php p($_['cspNonce']); /* Do not pass into "content" to prevent exfiltration */ ?>">
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<?php if ($theme->getiTunesAppId() !== '') { ?>

3
lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php
View File

@@ -33,7 +33,8 @@ class ContentSecurityPolicyNonceManager {
// Get the token from the CSRF token, we only use the "shared secret" part
// as the first part does not add any security / entropy to the token
// so it can be ignored to keep the nonce short while keeping the same randomness
$this->nonce = end(explode(':', ($this->csrfTokenManager->getToken()->getEncryptedValue())));
$csrfSecret = explode(':', ($this->csrfTokenManager->getToken()->getEncryptedValue()));
$this->nonce = end($csrfSecret);
} else {
$this->nonce = $this->request->server['CSP_NONCE'];
}

9
lib/private/Template/Base.php
View File

@@ -24,11 +24,14 @@ class Base {
* @param string $template
* @param string $requestToken
* @param \OCP\IL10N $l10n
* @param string $cspNonce
* @param Defaults $theme
*/
public function __construct($template, $requestToken, $l10n, $theme) {
$this->vars = [];
$this->vars['requesttoken'] = $requestToken;
public function __construct($template, $requestToken, $l10n, $theme, $cspNonce) {
$this->vars = [
'cspNonce' => $cspNonce,
'requesttoken' => $requestToken,
];
$this->l10n = $l10n;
$this->template = $template;
$this->theme = $theme;

9
lib/private/legacy/OC_Template.php
View File

@@ -43,6 +43,7 @@ class OC_Template extends \OC\Template\Base {
$theme = OC_Util::getTheme();
$requestToken = (OC::$server->getSession() && $registerCall) ? \OCP\Util::callRegister() : '';
$cspNonce = \OCP\Server::get(\OC\Security\CSP\ContentSecurityPolicyNonceManager::class)->getNonce();
$parts = explode('/', $app); // fix translation when app is something like core/lostpassword
$l10n = \OC::$server->getL10N($parts[0]);
@@ -56,7 +57,13 @@ class OC_Template extends \OC\Template\Base {
$this->path = $path;
$this->app = $app;
parent::__construct($template, $requestToken, $l10n, $themeDefaults);
parent::__construct(
$template,
$requestToken,
$l10n,
$themeDefaults,
$cspNonce,
);
}

1
tests/lib/AppFramework/Middleware/Security/CSPMiddlewareTest.php
View File

@@ -12,7 +12,6 @@ use OC\AppFramework\Middleware\Security\CSPMiddleware;
use OC\Security\CSP\ContentSecurityPolicy;
use OC\Security\CSP\ContentSecurityPolicyManager;
use OC\Security\CSP\ContentSecurityPolicyNonceManager;
use OC\Security\CSRF\CsrfToken;
use OC\Security\CSRF\CsrfTokenManager;
use OCP\AppFramework\Controller;
use OCP\AppFramework\Http\EmptyContentSecurityPolicy;