migrate therinaldos.com data

wedding-pics/lib/private/Security/CSP/ContentSecurityPolicy.php

@@ -0,0 +1,202 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Thomas Citharel <nextcloud@tcit.fr>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OC\Security\CSP;
+
+/**
+ * Class ContentSecurityPolicy extends the public class and adds getter and setters.
+ * This is necessary since we don't want to expose the setters and getters to the
+ * public API.
+ *
+ * @package OC\Security\CSP
+ */
+class ContentSecurityPolicy extends \OCP\AppFramework\Http\ContentSecurityPolicy {
+	public function isInlineScriptAllowed(): bool {
+		return $this->inlineScriptAllowed;
+	}
+
+	public function setInlineScriptAllowed(bool $inlineScriptAllowed): void {
+		$this->inlineScriptAllowed = $inlineScriptAllowed;
+	}
+
+	public function isEvalScriptAllowed(): bool {
+		return $this->evalScriptAllowed;
+	}
+
+	/**
+	 * @deprecated 17.0.0 Unsafe eval should not be used anymore.
+	 */
+	public function setEvalScriptAllowed(bool $evalScriptAllowed): void {
+		$this->evalScriptAllowed = $evalScriptAllowed;
+	}
+
+	public function isEvalWasmAllowed(): ?bool {
+		return $this->evalWasmAllowed;
+	}
+
+	public function setEvalWasmAllowed(bool $evalWasmAllowed): void {
+		$this->evalWasmAllowed = $evalWasmAllowed;
+	}
+
+	public function getAllowedScriptDomains(): array {
+		return $this->allowedScriptDomains;
+	}
+
+	public function setAllowedScriptDomains(array $allowedScriptDomains): void {
+		$this->allowedScriptDomains = $allowedScriptDomains;
+	}
+
+	public function isInlineStyleAllowed(): bool {
+		return $this->inlineStyleAllowed;
+	}
+
+	public function setInlineStyleAllowed(bool $inlineStyleAllowed): void {
+		$this->inlineStyleAllowed = $inlineStyleAllowed;
+	}
+
+	public function getAllowedStyleDomains(): array {
+		return $this->allowedStyleDomains;
+	}
+
+	public function setAllowedStyleDomains(array $allowedStyleDomains): void {
+		$this->allowedStyleDomains = $allowedStyleDomains;
+	}
+
+	public function getAllowedImageDomains(): array {
+		return $this->allowedImageDomains;
+	}
+
+	public function setAllowedImageDomains(array $allowedImageDomains): void {
+		$this->allowedImageDomains = $allowedImageDomains;
+	}
+
+	public function getAllowedConnectDomains(): array {
+		return $this->allowedConnectDomains;
+	}
+
+	public function setAllowedConnectDomains(array $allowedConnectDomains): void {
+		$this->allowedConnectDomains = $allowedConnectDomains;
+	}
+
+	public function getAllowedMediaDomains(): array {
+		return $this->allowedMediaDomains;
+	}
+
+	public function setAllowedMediaDomains(array $allowedMediaDomains): void {
+		$this->allowedMediaDomains = $allowedMediaDomains;
+	}
+
+	public function getAllowedObjectDomains(): array {
+		return $this->allowedObjectDomains;
+	}
+
+	public function setAllowedObjectDomains(array $allowedObjectDomains): void {
+		$this->allowedObjectDomains = $allowedObjectDomains;
+	}
+
+	public function getAllowedFrameDomains(): array {
+		return $this->allowedFrameDomains;
+	}
+
+	public function setAllowedFrameDomains(array $allowedFrameDomains): void {
+		$this->allowedFrameDomains = $allowedFrameDomains;
+	}
+
+	public function getAllowedFontDomains(): array {
+		return $this->allowedFontDomains;
+	}
+
+	public function setAllowedFontDomains($allowedFontDomains): void {
+		$this->allowedFontDomains = $allowedFontDomains;
+	}
+
+	/**
+	 * @deprecated 15.0.0 use FrameDomains and WorkerSrcDomains
+	 */
+	public function getAllowedChildSrcDomains(): array {
+		return $this->allowedChildSrcDomains;
+	}
+
+	/**
+	 * @param array $allowedChildSrcDomains
+	 * @deprecated 15.0.0 use FrameDomains and WorkerSrcDomains
+	 */
+	public function setAllowedChildSrcDomains($allowedChildSrcDomains): void {
+		$this->allowedChildSrcDomains = $allowedChildSrcDomains;
+	}
+
+	public function getAllowedFrameAncestors(): array {
+		return $this->allowedFrameAncestors;
+	}
+
+	/**
+	 * @param array $allowedFrameAncestors
+	 */
+	public function setAllowedFrameAncestors($allowedFrameAncestors): void {
+		$this->allowedFrameAncestors = $allowedFrameAncestors;
+	}
+
+	public function getAllowedWorkerSrcDomains(): array {
+		return $this->allowedWorkerSrcDomains;
+	}
+
+	public function setAllowedWorkerSrcDomains(array $allowedWorkerSrcDomains): void {
+		$this->allowedWorkerSrcDomains = $allowedWorkerSrcDomains;
+	}
+
+	public function getAllowedFormActionDomains(): array {
+		return $this->allowedFormActionDomains;
+	}
+
+	public function setAllowedFormActionDomains(array $allowedFormActionDomains): void {
+		$this->allowedFormActionDomains = $allowedFormActionDomains;
+	}
+
+
+	public function getReportTo(): array {
+		return $this->reportTo;
+	}
+
+	public function setReportTo(array $reportTo): void {
+		$this->reportTo = $reportTo;
+	}
+
+	public function isStrictDynamicAllowed(): bool {
+		return $this->strictDynamicAllowed;
+	}
+
+	public function setStrictDynamicAllowed(bool $strictDynamicAllowed): void {
+		$this->strictDynamicAllowed = $strictDynamicAllowed;
+	}
+
+	public function isStrictDynamicAllowedOnScripts(): bool {
+		return $this->strictDynamicAllowedOnScripts;
+	}
+
+	public function setStrictDynamicAllowedOnScripts(bool $strictDynamicAllowedOnScripts): void {
+		$this->strictDynamicAllowedOnScripts = $strictDynamicAllowedOnScripts;
+	}
+}

wedding-pics/lib/private/Security/CSP/ContentSecurityPolicyManager.php

@@ -0,0 +1,90 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2016, ownCloud, Inc.
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Morris Jobke <hey@morrisjobke.de>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ *
+ * @license AGPL-3.0
+ *
+ * This code is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License, version 3,
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License, version 3,
+ * along with this program. If not, see <http://www.gnu.org/licenses/>
+ *
+ */
+namespace OC\Security\CSP;
+
+use OCP\AppFramework\Http\ContentSecurityPolicy;
+use OCP\AppFramework\Http\EmptyContentSecurityPolicy;
+use OCP\EventDispatcher\IEventDispatcher;
+use OCP\Security\CSP\AddContentSecurityPolicyEvent;
+use OCP\Security\IContentSecurityPolicyManager;
+
+class ContentSecurityPolicyManager implements IContentSecurityPolicyManager {
+	/** @var ContentSecurityPolicy[] */
+	private array $policies = [];
+
+	public function __construct(
+		private IEventDispatcher $dispatcher,
+	) {
+	}
+
+	/** {@inheritdoc} */
+	public function addDefaultPolicy(EmptyContentSecurityPolicy $policy): void {
+		$this->policies[] = $policy;
+	}
+
+	/**
+	 * Get the configured default policy. This is not in the public namespace
+	 * as it is only supposed to be used by core itself.
+	 */
+	public function getDefaultPolicy(): ContentSecurityPolicy {
+		$event = new AddContentSecurityPolicyEvent($this);
+		$this->dispatcher->dispatchTyped($event);
+
+		$defaultPolicy = new \OC\Security\CSP\ContentSecurityPolicy();
+		foreach ($this->policies as $policy) {
+			$defaultPolicy = $this->mergePolicies($defaultPolicy, $policy);
+		}
+		return $defaultPolicy;
+	}
+
+	/**
+	 * Merges the first given policy with the second one
+	 */
+	public function mergePolicies(
+		ContentSecurityPolicy $defaultPolicy,
+		EmptyContentSecurityPolicy $originalPolicy,
+	): ContentSecurityPolicy {
+		foreach ((object)(array)$originalPolicy as $name => $value) {
+			$setter = 'set'.ucfirst($name);
+			if (\is_array($value)) {
+				$getter = 'get'.ucfirst($name);
+				$currentValues = \is_array($defaultPolicy->$getter()) ? $defaultPolicy->$getter() : [];
+				$defaultPolicy->$setter(array_values(array_unique(array_merge($currentValues, $value))));
+			} elseif (\is_bool($value)) {
+				$getter = 'is'.ucfirst($name);
+				$currentValue = $defaultPolicy->$getter();
+				// true wins over false
+				if ($value > $currentValue) {
+					$defaultPolicy->$setter($value);
+				}
+			}
+		}
+
+		return $defaultPolicy;
+	}
+}

wedding-pics/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php

@@ -0,0 +1,80 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * @copyright Copyright (c) 2016 Lukas Reschke <lukas@statuscode.ch>
+ *
+ * @author Christoph Wurst <christoph@winzerhof-wurst.at>
+ * @author Joas Schilling <coding@schilljs.com>
+ * @author Lukas Reschke <lukas@statuscode.ch>
+ * @author Pavel Krasikov <klonishe@gmail.com>
+ * @author Roeland Jago Douma <roeland@famdouma.nl>
+ * @author Sam Bull <aa6bs0@sambull.org>
+ *
+ * @license GNU AGPL version 3 or any later version
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Affero General Public License as
+ * published by the Free Software Foundation, either version 3 of the
+ * License, or (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Affero General Public License for more details.
+ *
+ * You should have received a copy of the GNU Affero General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ */
+namespace OC\Security\CSP;
+
+use OC\AppFramework\Http\Request;
+use OC\Security\CSRF\CsrfTokenManager;
+use OCP\IRequest;
+
+/**
+ * @package OC\Security\CSP
+ */
+class ContentSecurityPolicyNonceManager {
+	private string $nonce = '';
+
+	public function __construct(
+		private CsrfTokenManager $csrfTokenManager,
+		private IRequest $request,
+	) {
+	}
+
+	/**
+	 * Returns the current CSP nonce
+	 */
+	public function getNonce(): string {
+		if ($this->nonce === '') {
+			if (empty($this->request->server['CSP_NONCE'])) {
+				$this->nonce = base64_encode($this->csrfTokenManager->getToken()->getEncryptedValue());
+			} else {
+				$this->nonce = $this->request->server['CSP_NONCE'];
+			}
+		}
+
+		return $this->nonce;
+	}
+
+	/**
+	 * Check if the browser supports CSP v3
+	 */
+	public function browserSupportsCspV3(): bool {
+		$browserWhitelist = [
+			Request::USER_AGENT_CHROME,
+			Request::USER_AGENT_FIREFOX,
+			Request::USER_AGENT_SAFARI,
+		];
+
+		if ($this->request->isUserAgent($browserWhitelist)) {
+			return true;
+		}
+
+		return false;
+	}
+}