Move to stricter CSP by rullzer · Pull Request #11028 · nextcloud/server

rullzer · 2018-09-03T13:12:24Z

Do not allow unsafe eval by default.

🚧

Last merge for https://github.com/orgs/nextcloud/projects/18
This will be rebased several times to validate CSP behavior

TODO:

~~This will kill of OC.AddScript~~ converted by mr @ChristophWurst
- Need to look into affected apps

rullzer · 2018-09-28T14:15:46Z

Next one:

server/apps/files/js/filemultiselectmenu.js

Line 12 in 0c77b93

varTEMPLATE_MENU=

rullzer · 2018-10-04T09:03:04Z

So I think this is good to get in.

Other stuff we should fix once we run into it.
But if we merge it we can announce it for 15 so app devs can start preparing as well.

ChristophWurst

Let's do this

ChristophWurst · 2018-10-09T06:34:29Z

@@ -49,7 +49,7 @@ class ContentSecurityPolicy extends EmptyContentSecurityPolicy {
 * TODO: Disallow per default


ChristophWurst · 2018-10-09T06:36:29Z

This will kill of OC.AddScript
* Need to look into affected apps

https://github.com/search?q=%22OC.AddScript%22&type=Code have fun 🙈

ChristophWurst · 2018-10-09T06:50:46Z

💥

MorrisJobke · 2018-10-09T06:56:21Z

Need to look into affected apps

I only have found richdocuments and files_texteditor. 🤷‍♂️

ChristophWurst · 2018-10-09T07:05:56Z

I only have found richdocuments and files_texteditor. man_shrugging

I've pushed my fix that replaces the eval code with $.getScript. Could you please test if this actually works for these apps?

rullzer · 2018-10-09T08:29:53Z

@ChristophWurst richdocuments still works with this! yay!

MorrisJobke · 2018-10-10T12:31:06Z

+#### DO NOT CHANGE ANYTHING ABOVE THIS LINE ####
+
+ErrorDocument 403 /
+ErrorDocument 404 /


MorrisJobke

Tested and didn't explode 👍

MorrisJobke · 2018-10-11T07:45:42Z

JS unit fails.

PhantomJS 2.1.1 (Linux 0.0.0) OC.L10N tests plurals generates plural for default text when translation does not exist FAILED
Expected spy warn to have been called.
core/js/tests/specs/l10nSpec.js:90:41
PhantomJS 2.1.1 (Linux 0.0.0) OC.L10N tests plurals generates plural with default function when no forms specified FAILED
Expected spy warn to have been called.
core/js/tests/specs/l10nSpec.js:110:41
TypeError: undefined is not an object (evaluating 'locale.length') in core/js/l10n.js (line 9)
_getPlural@core/js/l10n.js:9:5835
translatePlural@core/js/l10n.js:9:4906
[native code]
checkPlurals@core/js/tests/specs/l10nSpec.js:73:6
core/js/tests/specs/l10nSpec.js:111:16
PhantomJS 2.1.1 (Linux 0.0.0) OC.L10N tests plurals generates plural with generated function when forms is specified FAILED
TypeError: undefined is not an object (evaluating 'locale.length') in core/js/l10n.js (line 9)
_getPlural@core/js/l10n.js:9:5835
translatePlural@core/js/l10n.js:9:4906
[native code]
checkPlurals@core/js/tests/specs/l10nSpec.js:73:6
core/js/tests/specs/l10nSpec.js:118:16
PhantomJS 2.1.1 (Linux 0.0.0) OC.L10N tests plurals generates plural with function when forms is specified as function FAILED
TypeError: undefined is not an object (evaluating 'locale.length') in core/js/l10n.js (line 9)
_getPlural@core/js/l10n.js:9:5835
translatePlural@core/js/l10n.js:9:4906
[native code]
checkPlurals@core/js/tests/specs/l10nSpec.js:73:6
core/js/tests/specs/l10nSpec.js:130:16
PhantomJS 2.1.1 (Linux 0.0.0) OC.L10N tests async loading of translations calls callback if translation already available FAILED
Expected spy warn to have been called.
core/js/tests/specs/l10nSpec.js:167:41

Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

No more weird eval to construct a plural function. We just use the plural function from symfony. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

MorrisJobke · 2018-11-09T23:04:32Z

@Arvidas mind to open a new ticket and link here?

JS unsafe-eval was removed a long time ago in #11028

rullzer added the 2. developing Work in progress label Sep 3, 2018

rullzer added this to the Nextcloud 15 milestone Sep 3, 2018

rullzer force-pushed the feature/no_eval_csp branch from efcec80 to d839df2Compare September 3, 2018 13:28

nextcloud-bot mentioned this pull request Sep 3, 2018
CSP child-src is deprecated #11035
Closed

rullzer force-pushed the feature/no_eval_csp branch from ad7e58b to 7b986d3Compare October 1, 2018 18:54

juliusknorr mentioned this pull request Oct 2, 2018
Manually instantiate jscolor to avoid csp errors #11535
Merged

MorrisJobke mentioned this pull request Oct 3, 2018
Update strengthify to be able to set a nonce #11592
Merged
1 task

rullzer force-pushed the feature/no_eval_csp branch from 7b986d3 to c9c8c60Compare October 4, 2018 09:01

rullzer requested review from ChristophWurst, MorrisJobke, danxuliu, nickvergessen and skjnldsv October 4, 2018 09:02

rullzer added 3. to review Waiting for reviews and removed 2. developing Work in progress labels Oct 4, 2018

ChristophWurst approved these changes Oct 9, 2018
View reviewed changes

ChristophWurst added 2. developing Work in progress and removed 3. to review Waiting for reviews labels Oct 9, 2018

ChristophWurst added 3. to review Waiting for reviews and removed 2. developing Work in progress labels Oct 9, 2018

ChristophWurst assigned rullzer and ChristophWurst Oct 9, 2018

rullzer force-pushed the feature/no_eval_csp branch from dd1d0ce to ea0d692Compare October 10, 2018 11:43

MorrisJobke reviewed Oct 10, 2018
View reviewed changes

MorrisJobke approved these changes Oct 10, 2018
View reviewed changes

MorrisJobke force-pushed the feature/no_eval_csp branch from ea0d692 to ca3d964Compare October 10, 2018 12:36

MorrisJobke added 4. to release Ready to be released and/or waiting for tests to finish and removed 3. to review Waiting for reviews labels Oct 10, 2018

MorrisJobke added 2. developing Work in progress and removed 4. to release Ready to be released and/or waiting for tests to finish labels Oct 11, 2018

rullzer force-pushed the feature/no_eval_csp branch from f738ae3 to 385cfffCompare October 11, 2018 18:27

rullzerand others added 3 commits October 14, 2018 20:45

Disallow unsafe-eval by default
5b61ef9
Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

Use jQuery.getScript to dynamically load script
365f683
Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>

Fix plural function to be hardcoded
056a74e
No more weird eval to construct a plural function. We just use the plural function from symfony. Signed-off-by: Roeland Jago Douma <roeland@famdouma.nl>

rullzer force-pushed the feature/no_eval_csp branch from 385cfff to 056a74eCompare October 14, 2018 18:45

rullzer merged commit 82a5833 into masterOct 14, 2018

rullzer deleted the feature/no_eval_csp branch October 14, 2018 19:17

rullzer added 4. to release Ready to be released and/or waiting for tests to finish and removed 2. developing Work in progress labels Oct 14, 2018

tcitworld mentioned this pull request Oct 18, 2018
Calendar 2.0 - Vue nextcloud/calendar#926
Merged
30 tasks

rullzer mentioned this pull request Nov 8, 2018
Critical changes for developers & admins for Nextcloud 15 #11045
Closed

This was referenced Mar 11, 2019
Chinese plural rule is broken #14627
Closed
Fix plural rule detection for languages #14628
Merged

tcitworld added a commit that referenced this pull request Dec 12, 2020
Update comment to reflect current CSP policy
71cf926
JS unsafe-eval was removed a long time ago in #11028

tcitworld mentioned this pull request Dec 12, 2020
Update comment to reflect current CSP policy #24679
Merged

		@@ -49,7 +49,7 @@ class ContentSecurityPolicy extends EmptyContentSecurityPolicy {
		* TODO: Disallow per default

Uh oh!

Uh oh!

Conversation

rullzer commented Sep 3, 2018• edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

rullzer commented Sep 28, 2018

Uh oh!

rullzer commented Oct 4, 2018

Uh oh!

ChristophWurst left a comment

Choose a reason for hiding this comment

Uh oh!

ChristophWurstOct 9, 2018

Choose a reason for hiding this comment

Uh oh!

ChristophWurst commented Oct 9, 2018

Uh oh!

ChristophWurst commented Oct 9, 2018

Uh oh!

MorrisJobke commented Oct 9, 2018

Uh oh!

ChristophWurst commented Oct 9, 2018

Uh oh!

rullzer commented Oct 9, 2018

Uh oh!

MorrisJobkeOct 10, 2018

Choose a reason for hiding this comment

Uh oh!

MorrisJobke left a comment

Choose a reason for hiding this comment

Uh oh!

MorrisJobke commented Oct 11, 2018

Uh oh!

MorrisJobke commented Nov 9, 2018

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rullzer commented Sep 3, 2018•
edited
Loading