diff --git a/app/Http/Middleware/ApplyCspRules.php b/app/Http/Middleware/ApplyCspRules.php index a65d12a05..6c9d14e7b 100644 --- a/app/Http/Middleware/ApplyCspRules.php +++ b/app/Http/Middleware/ApplyCspRules.php @@ -8,7 +8,6 @@ use Illuminate\Http\Request; class ApplyCspRules { - /** * @var CspService */ @@ -43,5 +42,4 @@ class ApplyCspRules return $response; } - } diff --git a/app/Providers/AppServiceProvider.php b/app/Providers/AppServiceProvider.php index 1119d87df..59704f4a1 100644 --- a/app/Providers/AppServiceProvider.php +++ b/app/Providers/AppServiceProvider.php @@ -73,7 +73,7 @@ class AppServiceProvider extends ServiceProvider return new SocialAuthService($app->make(SocialiteFactory::class), $app->make(LoginService::class)); }); - $this->app->singleton(CspService::class, function($app) { + $this->app->singleton(CspService::class, function ($app) { return new CspService(); }); } diff --git a/app/Theming/CustomHtmlHeadContentProvider.php b/app/Theming/CustomHtmlHeadContentProvider.php index 6110d5a60..041e5d025 100644 --- a/app/Theming/CustomHtmlHeadContentProvider.php +++ b/app/Theming/CustomHtmlHeadContentProvider.php @@ -33,9 +33,10 @@ class CustomHtmlHeadContentProvider { $content = $this->getSourceContent(); $hash = md5($content); - $html = $this->cache->remember('custom-head-web:' . $hash, 86400, function() use ($content) { + $html = $this->cache->remember('custom-head-web:' . $hash, 86400, function () use ($content) { return HtmlNonceApplicator::prepare($content); }); + return HtmlNonceApplicator::apply($html, $this->cspService->getNonce()); } @@ -47,8 +48,9 @@ class CustomHtmlHeadContentProvider { $content = $this->getSourceContent(); $hash = md5($content); - return $this->cache->remember('custom-head-export:' . $hash, 86400, function() use ($content) { - return HtmlContentFilter::removeScripts($content); + + return $this->cache->remember('custom-head-export:' . $hash, 86400, function () use ($content) { + return HtmlContentFilter::removeScripts($content); }); } @@ -59,5 +61,4 @@ class CustomHtmlHeadContentProvider { return setting('app-custom-head', ''); } - -} \ No newline at end of file +} diff --git a/app/Util/CspService.php b/app/Util/CspService.php index 2979ebc3e..ec5021371 100644 --- a/app/Util/CspService.php +++ b/app/Util/CspService.php @@ -90,7 +90,7 @@ class CspService protected function getAllowedIframeHosts(): array { $hosts = config('app.iframe_hosts', ''); + return array_filter(explode(' ', $hosts)); } - -} \ No newline at end of file +} diff --git a/app/Util/HtmlContentFilter.php b/app/Util/HtmlContentFilter.php index aa395cc45..1943aa780 100644 --- a/app/Util/HtmlContentFilter.php +++ b/app/Util/HtmlContentFilter.php @@ -70,6 +70,7 @@ class HtmlContentFilter { $value = strtolower($value); $upperVal = strtoupper($value); + return 'contains(translate(' . $property . ', \'' . $upperVal . '\', \'' . $value . '\'), \'' . $value . '\')'; } diff --git a/app/Util/HtmlNonceApplicator.php b/app/Util/HtmlNonceApplicator.php index 52f334394..2653b7075 100644 --- a/app/Util/HtmlNonceApplicator.php +++ b/app/Util/HtmlNonceApplicator.php @@ -38,7 +38,7 @@ class HtmlNonceApplicator $returnHtml = ''; $topElems = $doc->documentElement->childNodes->item(0)->childNodes; foreach ($topElems as $child) { - $content = $doc->saveHTML($child); + $content = $doc->saveHTML($child); $returnHtml .= $content; } @@ -60,5 +60,4 @@ class HtmlNonceApplicator $node->setAttribute('nonce', $attrValue); } } - } diff --git a/tests/Entity/PageContentTest.php b/tests/Entity/PageContentTest.php index 1b2ce2db2..45c27c9f9 100644 --- a/tests/Entity/PageContentTest.php +++ b/tests/Entity/PageContentTest.php @@ -309,7 +309,7 @@ class PageContentTest extends TestCase { $checks = [ '', - '' + '', ]; $this->asEditor(); diff --git a/tests/SecurityHeaderTest.php b/tests/SecurityHeaderTest.php index fe25ef3f0..2bde890ad 100644 --- a/tests/SecurityHeaderTest.php +++ b/tests/SecurityHeaderTest.php @@ -125,6 +125,7 @@ class SecurityHeaderTest extends TestCase protected function getCspHeader(TestResponse $resp, string $type): string { $cspHeaders = collect($resp->headers->all('Content-Security-Policy')); + return $cspHeaders->filter(function ($val) use ($type) { return strpos($val, $type) === 0; })->first() ?? ''; diff --git a/tests/Settings/CustomHeadContentTest.php b/tests/Settings/CustomHeadContentTest.php index 0e44e3ed3..59d5fc06c 100644 --- a/tests/Settings/CustomHeadContentTest.php +++ b/tests/Settings/CustomHeadContentTest.php @@ -6,7 +6,6 @@ use Tests\TestCase; class CustomHeadContentTest extends TestCase { - public function test_configured_content_shows_on_pages() { $this->setSettings(['app-custom-head' => '']); @@ -27,4 +26,4 @@ class CustomHeadContentTest extends TestCase $resp = $this->get('/login'); $resp->assertSee('