github-mirror/BookStack
2
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-06-04 08:54:33 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

Started application of CSP headers

Browse Source
This commit is contained in:
Dan Brown
2021-09-03 23:32:42 +01:00
parent 040997fdc4
commit fd44e4ba74
6 changed files with 124 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/Util/HtmlContentFilter.php
View File

@ -10,7 +10,7 @@ use DOMXPath;
class HtmlContentFilter
{
/**
* Remove all of the script elements from the given HTML.
* Remove all the script elements from the given HTML.
*/
public static function removeScripts(string $html): string
{

52
app/Util/HtmlNonceApplicator.php Normal file
View File

@ -0,0 +1,52 @@
<?php
namespace BookStack\Util;
use DOMDocument;
use DOMElement;
use DOMNodeList;
use DOMXPath;
class HtmlNonceApplicator
{
/**
* Apply the given nonce to all scripts and styles in the given html.
*/
public static function apply(string $html, string $nonce): string
{
if (empty($html)) {
return $html;
}
$html = '<body>' . $html . '</body>';
libxml_use_internal_errors(true);
$doc = new DOMDocument();
$doc->loadHTML(mb_convert_encoding($html, 'HTML-ENTITIES', 'UTF-8'));
$xPath = new DOMXPath($doc);
// Apply to scripts
$scriptElems = $xPath->query('//script');
static::addNonceAttributes($scriptElems, $nonce);
// Apply to styles
$styleElems = $xPath->query('//style');
static::addNonceAttributes($styleElems, $nonce);
$returnHtml = '';
$topElems = $doc->documentElement->childNodes->item(0)->childNodes;
foreach ($topElems as $child) {
$returnHtml .= $doc->saveHTML($child);
}
return $returnHtml;
}
protected static function addNonceAttributes(DOMNodeList $nodes, string $nonce): void
{
/** @var DOMElement $node */
foreach ($nodes as $node) {
$node->setAttribute('nonce', $nonce);
}
}
}