- Added caching for custom html head parsing to add nonce.
- Also moved api docs page into web routes to prevent issues.
namespace BookStack\Http\Middleware;
+use BookStack\Util\CspService;
use Closure;
use Illuminate\Http\Request;
-use Illuminate\Support\Str;
-use Symfony\Component\HttpFoundation\Response;
-
class ApplyCspRules
{
+
+ /**
+ * @var CspService
+ */
+ protected $cspService;
+
+ public function __construct(CspService $cspService)
+ {
+ $this->cspService = $cspService;
+ }
+
/**
* Handle an incoming request.
*
*/
public function handle($request, Closure $next)
{
- $nonce = Str::random(24);
- view()->share('cspNonce', $nonce);
-
- // TODO - Assess whether image/style/iframe CSP rules should be set
- // TODO - Extract nonce application to custom head content in a way that's cacheable.
- // TODO - Fix remaining CSP issues and test lots
+ view()->share('cspNonce', $this->cspService->getNonce());
+ if ($this->cspService->allowedIFrameHostsConfigured()) {
+ config()->set('session.same_site', 'none');
+ }
$response = $next($request);
- $this->setFrameAncestors($response);
- $this->setScriptSrc($response, $nonce);
+ $this->cspService->setFrameAncestors($response);
+ $this->cspService->setScriptSrc($response);
return $response;
}
- /**
- * Sets CSP 'script-src' headers to restrict the forms of script that can
- * run on the page.
- */
- public function setScriptSrc(Response $response, string $nonce)
- {
- $parts = [
- '\'self\'',
- '\'nonce-' . $nonce . '\'',
- '\'strict-dynamic\'',
- ];
- $response->headers->set('Content-Security-Policy', 'script-src ' . implode(' ', $parts));
- }
-
- /**
- * Sets CSP "frame-ancestors" headers to restrict the hosts that BookStack can be
- * iframed within. Also adjusts the cookie samesite options so that cookies will
- * operate in the third-party context.
- */
- protected function setFrameAncestors(Response $response)
- {
- $iframeHosts = collect(explode(' ', config('app.iframe_hosts', '')))->filter();
-
- if ($iframeHosts->count() > 0) {
- config()->set('session.same_site', 'none');
- }
-
- $iframeHosts->prepend("'self'");
- $cspValue = 'frame-ancestors ' . $iframeHosts->join(' ');
- $response->headers->set('Content-Security-Policy', $cspValue);
- }
}
use BookStack\Entities\Models\Page;
use BookStack\Settings\Setting;
use BookStack\Settings\SettingService;
+use BookStack\Util\CspService;
use Illuminate\Contracts\Cache\Repository;
use Illuminate\Database\Eloquent\Relations\Relation;
use Illuminate\Support\Facades\View;
$this->app->singleton(SocialAuthService::class, function ($app) {
return new SocialAuthService($app->make(SocialiteFactory::class), $app->make(LoginService::class));
});
+
+ $this->app->singleton(CspService::class, function($app) {
+ return new CspService();
+ });
}
}
--- /dev/null
+<?php
+
+namespace BookStack\Theming;
+
+use BookStack\Util\CspService;
+use BookStack\Util\HtmlContentFilter;
+use BookStack\Util\HtmlNonceApplicator;
+use Illuminate\Contracts\Cache\Repository as Cache;
+
+class CustomHtmlHeadContentProvider
+{
+ /**
+ * @var CspService
+ */
+ protected $cspService;
+
+ /**
+ * @var Cache
+ */
+ protected $cache;
+
+ public function __construct(CspService $cspService, Cache $cache)
+ {
+ $this->cspService = $cspService;
+ $this->cache = $cache;
+ }
+
+ /**
+ * Fetch our custom HTML head content prepared for use on web pages.
+ * Content has a nonce applied for CSP.
+ */
+ public function forWeb(): string
+ {
+ $content = $this->getSourceContent();
+ $hash = md5($content);
+ $html = $this->cache->remember('custom-head-web:' . $hash, 86400, function() use ($content) {
+ return HtmlNonceApplicator::prepare($content);
+ });
+ return HtmlNonceApplicator::apply($html, $this->cspService->getNonce());
+ }
+
+ /**
+ * Fetch our custom HTML head content prepared for use in export formats.
+ * Scripts are stripped to avoid potential issues.
+ */
+ public function forExport(): string
+ {
+ $content = $this->getSourceContent();
+ $hash = md5($content);
+ return $this->cache->remember('custom-head-export:' . $hash, 86400, function() use ($content) {
+ return HtmlContentFilter::removeScripts($content);
+ });
+ }
+
+ /**
+ * Get the original custom head content to use.
+ */
+ protected function getSourceContent(): string
+ {
+ return setting('app-custom-head', '');
+ }
+
+}
\ No newline at end of file
--- /dev/null
+<?php
+
+namespace BookStack\Util;
+
+use Illuminate\Support\Str;
+use Symfony\Component\HttpFoundation\Response;
+
+class CspService
+{
+ /** @var string */
+ protected $nonce;
+
+ public function __construct(string $nonce = '')
+ {
+ $this->nonce = $nonce ?: Str::random(16);
+ }
+
+ /**
+ * Get the nonce value for CSP.
+ */
+ public function getNonce(): string
+ {
+ return $this->nonce;
+ }
+
+ /**
+ * Sets CSP 'script-src' headers to restrict the forms of script that can
+ * run on the page.
+ */
+ public function setScriptSrc(Response $response)
+ {
+ if (config('app.allow_content_scripts')) {
+ return;
+ }
+
+ $parts = [
+ '\'nonce-' . $this->nonce . '\'',
+ '\'strict-dynamic\'',
+ ];
+ $value = 'script-src ' . implode(' ', $parts);
+ $response->headers->set('Content-Security-Policy', $value, false);
+ }
+
+ /**
+ * Sets CSP "frame-ancestors" headers to restrict the hosts that BookStack can be
+ * iframed within. Also adjusts the cookie samesite options so that cookies will
+ * operate in the third-party context.
+ */
+ public function setFrameAncestors(Response $response)
+ {
+ $iframeHosts = $this->getAllowedIframeHosts();
+ array_unshift($iframeHosts, "'self'");
+ $cspValue = 'frame-ancestors ' . implode(' ', $iframeHosts);
+ $response->headers->set('Content-Security-Policy', $cspValue, false);
+ }
+
+ /**
+ * Check if the user has configured some allowed iframe hosts.
+ */
+ public function allowedIFrameHostsConfigured(): bool
+ {
+ return count($this->getAllowedIframeHosts()) > 0;
+ }
+
+
+ protected function getAllowedIframeHosts(): array
+ {
+ $hosts = config('app.iframe_hosts', '');
+ return array_filter(explode(' ', $hosts));
+ }
+
+}
\ No newline at end of file
class HtmlNonceApplicator
{
+ protected static $placeholder = '[CSP_NONCE_VALUE]';
+
/**
- * Apply the given nonce to all scripts and styles in the given html.
+ * Prepare the given HTML content with nonce attributes including a placeholder
+ * value which we can target later.
*/
- public static function apply(string $html, string $nonce): string
+ public static function prepare(string $html): string
{
if (empty($html)) {
return $html;
// Apply to scripts
$scriptElems = $xPath->query('//script');
- static::addNonceAttributes($scriptElems, $nonce);
+ static::addNonceAttributes($scriptElems, static::$placeholder);
// Apply to styles
$styleElems = $xPath->query('//style');
- static::addNonceAttributes($styleElems, $nonce);
+ static::addNonceAttributes($styleElems, static::$placeholder);
$returnHtml = '';
$topElems = $doc->documentElement->childNodes->item(0)->childNodes;
return $returnHtml;
}
- protected static function addNonceAttributes(DOMNodeList $nodes, string $nonce): void
+ /**
+ * Apply the give nonce value to the given prepared HTML.
+ */
+ public static function apply(string $html, string $nonce): string
+ {
+ return str_replace(static::$placeholder, $nonce, $html);
+ }
+
+ protected static function addNonceAttributes(DOMNodeList $nodes, string $attrValue): void
{
/** @var DOMElement $node */
foreach ($nodes as $node) {
- $node->setAttribute('nonce', $nonce);
+ $node->setAttribute('nonce', $attrValue);
}
}
+@inject('headContent', 'BookStack\Theming\CustomHtmlHeadContentProvider')
+
@if(setting('app-custom-head') && \Route::currentRouteName() !== 'settings')
<!-- Custom user content -->
-{!! \BookStack\Util\HtmlNonceApplicator::apply(setting('app-custom-head'), $cspNonce) !!}
+{!! $headContent->forWeb() !!}
<!-- End custom user content -->
@endif
\ No newline at end of file
+@inject('headContent', 'BookStack\Theming\CustomHtmlHeadContentProvider')
+
@if(setting('app-custom-head'))
<!-- Custom user content -->
-{!! \BookStack\Util\HtmlContentFilter::removeScripts(setting('app-custom-head')) !!}
+{!! $headContent->forExport() !!}
<!-- End custom user content -->
@endif
\ No newline at end of file
<meta property="og:title" content="{{ isset($pageTitle) ? $pageTitle . ' | ' : '' }}{{ setting('app-name') }}">
<meta property="og:url" content="{{ url()->current() }}">
@stack('social-meta')
-
<!-- Styles and Fonts -->
<link rel="stylesheet" href="{{ versioned_asset('dist/styles.css') }}">
</div>
@yield('bottom')
- <script src="{{ versioned_asset('dist/app.js') }}"></script>
+ <script src="{{ versioned_asset('dist/app.js') }}" nonce="{{ $cspNonce }}"></script>
@yield('scripts')
</body>
@extends('layouts.base')
@section('head')
- <script src="{{ url('/libs/tinymce/tinymce.min.js?ver=4.9.4') }}"></script>
+ <script src="{{ url('/libs/tinymce/tinymce.min.js?ver=4.9.4') }}" nonce="{{ $cspNonce }}"></script>
@stop
@section('body-class', 'flexbox')
* Routes have a uri prefix of /api/.
* Controllers are all within app/Http/Controllers/Api.
*/
-Route::get('docs', 'ApiDocsController@display');
Route::get('docs.json', 'ApiDocsController@json');
Route::get('books', 'BookApiController@list');
Route::get('/uploads/images/{path}', 'Images\ImageController@showImage')
->where('path', '.*$');
+ // API docs routes
+ Route::get('/api/docs', 'Api\ApiDocsController@display');
+
Route::get('/pages/recently-updated', 'PageController@showRecentlyUpdated');
// Shelves
namespace Tests\Api;
-use BookStack\Auth\User;
use Tests\TestCase;
class ApiDocsTest extends TestCase
protected $endpoint = '/api/docs';
- public function test_docs_page_not_visible_to_normal_viewers()
- {
- $viewer = $this->getViewer();
- $resp = $this->actingAs($viewer)->get($this->endpoint);
- $resp->assertStatus(403);
-
- $resp = $this->actingAsApiEditor()->get($this->endpoint);
- $resp->assertStatus(200);
- }
-
public function test_docs_page_returns_view_with_docs_content()
{
$resp = $this->actingAsApiEditor()->get($this->endpoint);
]],
]);
}
-
- public function test_docs_page_visible_by_public_user_if_given_permission()
- {
- $this->setSettings(['app-public' => true]);
- $guest = User::getDefault();
-
- $this->startSession();
- $resp = $this->get('/api/docs');
- $resp->assertStatus(403);
-
- $this->giveUserPermissions($guest, ['access-api']);
-
- $resp = $this->get('/api/docs');
- $resp->assertStatus(200);
- }
}
namespace Tests;
-use Illuminate\Support\Str;
+use BookStack\Util\CspService;
class SecurityHeaderTest extends TestCase
{
public function test_iframe_csp_self_only_by_default()
{
$resp = $this->get('/');
- $cspHeaders = collect($resp->headers->get('Content-Security-Policy'));
- $frameHeaders = $cspHeaders->filter(function ($val) {
- return Str::startsWith($val, 'frame-ancestors');
- });
+ $frameHeader = $this->getCspHeader($resp, 'frame-ancestors');
- $this->assertTrue($frameHeaders->count() === 1);
- $this->assertEquals('frame-ancestors \'self\'', $frameHeaders->first());
+ $this->assertEquals('frame-ancestors \'self\'', $frameHeader);
}
public function test_iframe_csp_includes_extra_hosts_if_configured()
{
$this->runWithEnv('ALLOWED_IFRAME_HOSTS', 'https://a.example.com https://b.example.com', function () {
$resp = $this->get('/');
- $cspHeaders = collect($resp->headers->get('Content-Security-Policy'));
- $frameHeaders = $cspHeaders->filter(function ($val) {
- return Str::startsWith($val, 'frame-ancestors');
- });
+ $frameHeader = $this->getCspHeader($resp, 'frame-ancestors');
- $this->assertTrue($frameHeaders->count() === 1);
- $this->assertEquals('frame-ancestors \'self\' https://a.example.com https://b.example.com', $frameHeaders->first());
+ $this->assertNotEmpty($frameHeader);
+ $this->assertEquals('frame-ancestors \'self\' https://a.example.com https://b.example.com', $frameHeader);
});
}
+
+ public function test_script_csp_set_on_responses()
+ {
+ $resp = $this->get('/');
+ $scriptHeader = $this->getCspHeader($resp, 'script-src');
+ $this->assertStringContainsString('\'strict-dynamic\'', $scriptHeader);
+ $this->assertStringContainsString('\'nonce-', $scriptHeader);
+ }
+
+ public function test_script_csp_nonce_matches_nonce_used_in_custom_head()
+ {
+ $this->setSettings(['app-custom-head' => '<script>console.log("cat");</script>']);
+ $resp = $this->get('/login');
+ $scriptHeader = $this->getCspHeader($resp, 'script-src');
+
+ $nonce = app()->make(CspService::class)->getNonce();
+ $this->assertStringContainsString('nonce-' . $nonce, $scriptHeader);
+ $resp->assertSee('<script nonce="' . $nonce . '">console.log("cat");</script>');
+ }
+
+ public function test_script_csp_nonce_changes_per_request()
+ {
+ $resp = $this->get('/');
+ $firstHeader = $this->getCspHeader($resp, 'script-src');
+
+ $this->refreshApplication();
+
+ $resp = $this->get('/');
+ $secondHeader = $this->getCspHeader($resp, 'script-src');
+
+ $this->assertNotEquals($firstHeader, $secondHeader);
+ }
+
+ public function test_allow_content_scripts_settings_controls_csp_script_headers()
+ {
+ config()->set('app.allow_content_scripts', true);
+ $resp = $this->get('/');
+ $scriptHeader = $this->getCspHeader($resp, 'script-src');
+ $this->assertEmpty($scriptHeader);
+
+ config()->set('app.allow_content_scripts', false);
+ $resp = $this->get('/');
+ $scriptHeader = $this->getCspHeader($resp, 'script-src');
+ $this->assertNotEmpty($scriptHeader);
+ }
+
+ /**
+ * Get the value of the first CSP header of the given type.
+ */
+ protected function getCspHeader(TestResponse $resp, string $type): string
+ {
+ $cspHeaders = collect($resp->headers->all('Content-Security-Policy'));
+ return $cspHeaders->filter(function ($val) use ($type) {
+ return strpos($val, $type) === 0;
+ })->first() ?? '';
+ }
}
projects / bookstack / commitdiff