nextcloud-server-mirror

mirror of https://github.com/nextcloud/server.git synced 2026-02-27 18:37:17 +01:00

Files

Daniel Calviño Sánchez 41f2d912d2 Allow "wasm-unsafe-eval" in CSP

If a page has a Content Security Policy header and the `script-src` (or
`default-src`) directive does not contain neither `wasm-unsafe-eval` nor
`unsafe-eval` loading and executing WebAssembly is blocked in the page
(although it is still possible to load and execute WebAssembly in a
worker thread).

Although the Nextcloud classes to manage the CSP already supported
allowing `unsafe-eval` this affects not only WebAssembly, but also the
`eval` operation in JavaScript.

To make possible to allow WebAssembly execution without allowing
JavaScript `eval` this commit adds support for allowing
`wasm-unsafe-eval`.

Signed-off-by: Daniel Calviño Sánchez <danxuliu@gmail.com>

2023-08-10 02:38:41 +02:00

ContentSecurityPolicyTest.php

Allow "wasm-unsafe-eval" in CSP

2023-08-10 02:38:41 +02:00

DataResponseTest.php

Change X-Robots-Tag header from "none" to "noindex, nofollow"

2023-02-15 20:16:51 +01:00

DispatcherTest.php

feat(app framework)!: Inject services into controller methods

2023-01-18 14:00:38 +01:00

DownloadResponseTest.php

Escape filename in Content-Disposition