upstream/nextcloud
1
0
Fork 0
mirror of https://github.com/nextcloud/server.git synced 2026-06-08 16:26:59 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions 11

fix: Make sure CSP nonce is not double base64 encoded

Browse source 
Signed-off-by: Ferdinand Thiessen <opensource@fthiessen.de>
This commit is contained in:
Ferdinand Thiessen 2024-08-01 23:06:23 +02:00
parent 73397cd759
commit 86f01a3358
No known key found for this signature in database
GPG key ID: 45FAE7268762B400
2 changed files with 6 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php
View file

@ -30,7 +30,10 @@ class ContentSecurityPolicyNonceManager {
public function getNonce(): string {
if ($this->nonce === '') {
if (empty($this->request->server['CSP_NONCE'])) {
$this->nonce = base64_encode($this->csrfTokenManager->getToken()->getEncryptedValue());
// Get the token from the CSRF token, we only use the "shared secret" part
// as the first part does not add any security / entropy to the token
// so it can be ignored to keep the nonce short while keeping the same randomness
$this->nonce = end(explode(':', ($this->csrfTokenManager->getToken()->getEncryptedValue())));
} else {
$this->nonce = $this->request->server['CSP_NONCE'];
}

4
lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php
View file

@ -89,7 +89,7 @@ class EmptyContentSecurityPolicy {
}
/**
* Use the according JS nonce
* Use the according base64 encoded JS nonce
* This method is only for CSPMiddleware, custom values are ignored in mergePolicies of ContentSecurityPolicyManager
*
* @param string $nonce
@ -448,7 +448,7 @@ class EmptyContentSecurityPolicy {
if ($this->strictDynamicAllowed) {
$scriptSrc .= '\'strict-dynamic\' ';
}
$scriptSrc .= '\'nonce-'.base64_encode($this->jsNonce).'\'';
$scriptSrc .= '\'nonce-'.$this->jsNonce.'\'';
$allowedScriptDomains = array_flip($this->allowedScriptDomains);
unset($allowedScriptDomains['\'self\'']);
$this->allowedScriptDomains = array_flip($allowedScriptDomains);