class ApplyCspRules
{
-
/**
* @var CspService
*/
return $response;
}
-
}
return new SocialAuthService($app->make(SocialiteFactory::class), $app->make(LoginService::class));
});
- $this->app->singleton(CspService::class, function($app) {
+ $this->app->singleton(CspService::class, function ($app) {
return new CspService();
});
}
{
$content = $this->getSourceContent();
$hash = md5($content);
- $html = $this->cache->remember('custom-head-web:' . $hash, 86400, function() use ($content) {
+ $html = $this->cache->remember('custom-head-web:' . $hash, 86400, function () use ($content) {
return HtmlNonceApplicator::prepare($content);
});
+
return HtmlNonceApplicator::apply($html, $this->cspService->getNonce());
}
{
$content = $this->getSourceContent();
$hash = md5($content);
- return $this->cache->remember('custom-head-export:' . $hash, 86400, function() use ($content) {
- return HtmlContentFilter::removeScripts($content);
+
+ return $this->cache->remember('custom-head-export:' . $hash, 86400, function () use ($content) {
+ return HtmlContentFilter::removeScripts($content);
});
}
{
return setting('app-custom-head', '');
}
-
-}
\ No newline at end of file
+}
protected function getAllowedIframeHosts(): array
{
$hosts = config('app.iframe_hosts', '');
+
return array_filter(explode(' ', $hosts));
}
-
-}
\ No newline at end of file
+}
{
$value = strtolower($value);
$upperVal = strtoupper($value);
+
return 'contains(translate(' . $property . ', \'' . $upperVal . '\', \'' . $value . '\'), \'' . $value . '\')';
}
$returnHtml = '';
$topElems = $doc->documentElement->childNodes->item(0)->childNodes;
foreach ($topElems as $child) {
- $content = $doc->saveHTML($child);
+ $content = $doc->saveHTML($child);
$returnHtml .= $content;
}
$node->setAttribute('nonce', $attrValue);
}
}
-
}
{
$checks = [
'<svg id="test" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="100" height="100"><a xlink:href="javascript:alert(document.domain)"><rect x="0" y="0" width="100" height="100" /></a></svg>',
- '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64 ,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/></svg>'
+ '<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink"><use xlink:href="data:application/xml;base64 ,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIj4KPGRlZnM+CjxjaXJjbGUgaWQ9InRlc3QiIHI9IjAiIGN4PSIwIiBjeT0iMCIgc3R5bGU9ImZpbGw6ICNGMDAiPgo8c2V0IGF0dHJpYnV0ZU5hbWU9ImZpbGwiIGF0dHJpYnV0ZVR5cGU9IkNTUyIgb25iZWdpbj0nYWxlcnQoZG9jdW1lbnQuZG9tYWluKScKb25lbmQ9J2FsZXJ0KCJvbmVuZCIpJyB0bz0iIzAwRiIgYmVnaW49IjBzIiBkdXI9Ijk5OXMiIC8+CjwvY2lyY2xlPgo8L2RlZnM+Cjx1c2UgeGxpbms6aHJlZj0iI3Rlc3QiLz4KPC9zdmc+#test"/></svg>',
];
$this->asEditor();
protected function getCspHeader(TestResponse $resp, string $type): string
{
$cspHeaders = collect($resp->headers->all('Content-Security-Policy'));
+
return $cspHeaders->filter(function ($val) use ($type) {
return strpos($val, $type) === 0;
})->first() ?? '';
class CustomHeadContentTest extends TestCase
{
-
public function test_configured_content_shows_on_pages()
{
$this->setSettings(['app-custom-head' => '<script>console.log("cat");</script>']);
$resp = $this->get('/login');
$resp->assertSee('<div id="hello">cat</div>');
}
-}
\ No newline at end of file
+}
-<?php namespace Tests\Settings;
+<?php
+
+namespace Tests\Settings;
use Tests\TestCase;