X-Git-Url: http://git.cyclocoop.org/%28?a=blobdiff_plain;f=includes%2FOutputPage.php;h=564641aa3805d47537f2d05c6c3244e5fd259c91;hb=e3e6be734f8cac8bce7cff7cde86a920b7ca0fb1;hp=fbc7b604390c5432e2a08dfb1c4b73746e6ae0b9;hpb=db9d761d82aae6d64e1e8e6f897c8c58936bffdf;p=lhc%2Fweb%2Fwiklou.git

diff --git a/includes/OutputPage.php b/includes/OutputPage.php
index fbc7b60439..564641aa38 100644
--- a/includes/OutputPage.php
+++ b/includes/OutputPage.php
@@ -304,6 +304,11 @@ class OutputPage extends ContextSource {
 	 */
 	private $mLinkHeader = [];
 
+	/**
+	 * @var string The nonce for Content-Security-Policy
+	 */
+	private $CSPNonce;
+
 	/**
 	 * Constructor for OutputPage. This should not be called directly.
 	 * Instead a new RequestContext should be created and it will implicitly create
@@ -458,24 +463,22 @@ class OutputPage extends ContextSource {
 	}
 
 	/**
-	 * Add a JavaScript file out of skins/common, or a given relative path.
+	 * Add a JavaScript file to be loaded as `<script>` on this page.
+	 *
 	 * Internal use only. Use OutputPage::addModules() if possible.
 	 *
-	 * @param string $file Filename in skins/common or complete on-server path
-	 *              (/foo/bar.js)
-	 * @param string $version Style version of the file. Defaults to $wgStyleVersion
+	 * @param string $file URL to file (absolute path, protocol-relative, or full url)
+	 * @param string $unused Previously used to change the cache-busting query parameter
 	 */
-	public function addScriptFile( $file, $version = null ) {
-		// See if $file parameter is an absolute URL or begins with a slash
-		if ( substr( $file, 0, 1 ) == '/' || preg_match( '#^[a-z]*://#i', $file ) ) {
-			$path = $file;
-		} else {
-			$path = $this->getConfig()->get( 'StylePath' ) . "/common/{$file}";
-		}
-		if ( is_null( $version ) ) {
-			$version = $this->getConfig()->get( 'StyleVersion' );
+	public function addScriptFile( $file, $unused = null ) {
+		if ( substr( $file, 0, 1 ) !== '/' && !preg_match( '#^[a-z]*://#i', $file ) ) {
+			// This is not an absolute path, protocol-relative url, or full scheme url,
+			// presumed to be an old call intended to include a file from /w/skins/common,
+			// which doesn't exist anymore as of MediaWiki 1.24 per T71277. Ignore.
+			wfDeprecated( __METHOD__, '1.24' );
+			return;
 		}
-		$this->addScript( Html::linkedScript( wfAppendQuery( $path, $version ) ) );
+		$this->addScript( Html::linkedScript( $file, $this->getCSPNonce() ) );
 	}
 
 	/**
@@ -485,7 +488,7 @@ class OutputPage extends ContextSource {
 	 * @param string $script JavaScript text, no script tags
 	 */
 	public function addInlineScript( $script ) {
-		$this->mScripts .= Html::inlineScript( $script );
+		$this->mScripts .= Html::inlineScript( "\n$script\n", $this->getCSPNonce() ) . "\n";
 	}
 
 	/**
@@ -2410,10 +2413,6 @@ class OutputPage extends ContextSource {
 		$response->header( 'Content-type: ' . $config->get( 'MimeType' ) . '; charset=UTF-8' );
 		$response->header( 'Content-language: ' . $wgContLang->getHtmlCode() );
 
-		// Avoid Internet Explorer "compatibility view" in IE 8-10, so that
-		// jQuery etc. can work correctly.
-		$response->header( 'X-UA-Compatible: IE=Edge' );
-
 		if ( !$this->mArticleBodyOnly ) {
 			$sk = $this->getSkin();
 
@@ -2433,10 +2432,12 @@ class OutputPage extends ContextSource {
 			$response->header( "X-Frame-Options: $frameOptions" );
 		}
 
+		ContentSecurityPolicy::sendHeaders( $this );
+
 		if ( $this->mArticleBodyOnly ) {
 			echo $this->mBodytext;
 		} else {
-			// Enable safe mode if requested
+			// Enable safe mode if requested (T152169)
 			if ( $this->getRequest()->getBool( 'safemode' ) ) {
 				$this->disallowUserJs();
 			}
@@ -2854,6 +2855,17 @@ class OutputPage extends ContextSource {
 
 			$rlClient = new ResourceLoaderClientHtml( $context, [
 				'target' => $this->getTarget(),
+				'nonce' => $this->getCSPNonce(),
+				// When 'safemode', disallowUserJs(), or reduceAllowedModules() is used
+				// to only restrict modules to ORIGIN_CORE (ie. disallow ORIGIN_USER), the list of
+				// modules enqueud for loading on this page is filtered to just those.
+				// However, to make sure we also apply the restriction to dynamic dependencies and
+				// lazy-loaded modules at run-time on the client-side, pass 'safemode' down to the
+				// StartupModule so that the client-side registry will not contain any restricted
+				// modules either. (T152169, T185303)
+				'safemode' => ( $this->getAllowedModules( ResourceLoaderModule::TYPE_COMBINED )
+					<= ResourceLoaderModule::ORIGIN_CORE_INDIVIDUAL
+				) ? '1' : null,
 			] );
 			$rlClient->setConfig( $this->getJSVars() );
 			$rlClient->setModules( $this->getModules( /*filter*/ true ) );
@@ -2911,7 +2923,8 @@ class OutputPage extends ContextSource {
 				ResourceLoaderContext::newDummyContext(),
 				[ 'html5shiv' ],
 				ResourceLoaderModule::TYPE_SCRIPTS,
-				[ 'sync' => true ]
+				[ 'sync' => true ],
+				$this->getCSPNonce()
 			) .
 			'<![endif]-->';
 
@@ -2992,7 +3005,8 @@ class OutputPage extends ContextSource {
 			$this->getRlClientContext(),
 			$modules,
 			$only,
-			$extraQuery
+			$extraQuery,
+			$this->getCSPNonce()
 		);
 	}
 
@@ -3025,7 +3039,8 @@ class OutputPage extends ContextSource {
 			$chunks[] = ResourceLoader::makeInlineScript(
 				ResourceLoader::makeConfigSetScript(
 					[ 'wgPageParseReport' => $this->limitReportJSData ]
-				)
+				),
+				$this->getCSPNonce()
 			);
 		}
 
@@ -3643,8 +3658,11 @@ class OutputPage extends ContextSource {
 			$url = $style;
 		} else {
 			$config = $this->getConfig();
-			$url = $config->get( 'StylePath' ) . '/' . $style . '?' .
-				$config->get( 'StyleVersion' );
+			// Append file hash as query parameter
+			$url = self::transformResourcePath(
+				$config,
+				$config->get( 'StylePath' ) . '/' . $style
+			);
 		}
 
 		$link = Html::linkedStyle( $url, $media );
@@ -3992,4 +4010,26 @@ class OutputPage extends ContextSource {
 			);
 		}
 	}
+
+	/**
+	 * Get (and set if not yet set) the CSP nonce.
+	 *
+	 * This value needs to be included in any <script> tags on the
+	 * page.
+	 *
+	 * @return string|bool Nonce or false to mean don't output nonce
+	 * @since 1.32
+	 */
+	public function getCSPNonce() {
+		if ( !ContentSecurityPolicy::isEnabled( $this->getConfig() ) ) {
+			return false;
+		}
+		if ( $this->CSPNonce === null ) {
+			// XXX It might be expensive to generate randomness
+			// on every request, on windows.
+			$rand = MWCryptRand::generate( 15 );
+			$this->CSPNonce = base64_encode( $rand );
+		}
+		return $this->CSPNonce;
+	}
 }