3 * Handle sending Content-Security-Policy headers
5 * @see https://www.w3.org/TR/CSP2/
7 * Copyright © 2015–2018 Brian Wolff
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, write to the Free Software Foundation, Inc.,
21 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
22 * http://www.gnu.org/copyleft/gpl.html
27 class ContentSecurityPolicy
{
28 const REPORT_ONLY_MODE
= 1;
31 /** @var string The nonce to use for inline scripts (from OutputPage) */
33 /** @var Config The site configuration object */
35 /** @var WebResponse */
39 * @param string $nonce
40 * @param WebResponse $response
41 * @param Config $mwConfig
43 public function __construct( $nonce, WebResponse
$response, Config
$mwConfig ) {
44 $this->nonce
= $nonce;
45 $this->response
= $response;
46 $this->mwConfig
= $mwConfig;
50 * Send a single CSP header based on a given policy config.
52 * @note Most callers will probably want ContentSecurityPolicy::sendHeaders() instead.
53 * @param array $csp ContentSecurityPolicy configuration
54 * @param int $reportOnly self::*_MODE constant
56 public function sendCSPHeader( $csp, $reportOnly ) {
57 $policy = $this->makeCSPDirectives( $csp, $reportOnly );
58 $headerName = $this->getHeaderName( $reportOnly );
60 $this->response
->header(
61 "$headerName: $policy"
67 * Send CSP headers based on wiki config
69 * Main method that callers are expected to use
70 * @param IContextSource $context A context object, the associated OutputPage
71 * object must be the one that the page in question was generated with.
73 public static function sendHeaders( IContextSource
$context ) {
74 $out = $context->getOutput();
75 $csp = new ContentSecurityPolicy(
77 $context->getRequest()->response(),
81 $cspConfig = $context->getConfig()->get( 'CSPHeader' );
82 $cspConfigReportOnly = $context->getConfig()->get( 'CSPReportOnlyHeader' );
84 $csp->sendCSPHeader( $cspConfig, self
::FULL_MODE
);
85 $csp->sendCSPHeader( $cspConfigReportOnly, self
::REPORT_ONLY_MODE
);
87 // This used to insert a <meta> tag here, per advice at
88 // https://blogs.dropbox.com/tech/2015/09/unsafe-inline-and-nonce-deployment/
89 // The goal was to prevent nonce from working after the page hit onready,
90 // This would help in old browsers that didn't support nonces, and
91 // also assist for varnish-cached pages which repeat nonces.
92 // However, this is incompatible with how resource loader storage works
93 // via mw.domEval() so it was removed.
97 * Get the name of the HTTP header to use.
99 * @param int $reportOnly Either self::REPORT_ONLY_MODE or self::FULL_MODE
100 * @return string Name of http header
101 * @throws UnexpectedValueException
103 private function getHeaderName( $reportOnly ) {
104 if ( $reportOnly === self
::REPORT_ONLY_MODE
) {
105 return 'Content-Security-Policy-Report-Only';
108 if ( $reportOnly === self
::FULL_MODE
) {
109 return 'Content-Security-Policy';
111 throw new UnexpectedValueException( $reportOnly );
115 * Determine what CSP policies to set for this page
117 * @param array|bool $policyConfig Policy configuration
118 * (Either $wgCSPHeader or $wgCSPReportOnlyHeader)
119 * @param int $mode self::REPORT_ONLY_MODE, self::FULL_MODE
120 * @return string Policy directives, or empty string for no policy.
122 private function makeCSPDirectives( $policyConfig, $mode ) {
123 if ( $policyConfig === false ) {
127 if ( $policyConfig === true ) {
131 $mwConfig = $this->mwConfig
;
133 $additionalSelfUrls = $this->getAdditionalSelfUrls();
134 $additionalSelfUrlsScript = $this->getAdditionalSelfUrlsScript();
136 // If no default-src is sent at all, it
137 // seems browsers (or at least some), interpret
138 // that as allow anything, but the spec seems
139 // to imply that data: and blob: should be
141 $defaultSrc = [ '*', 'data:', 'blob:' ];
145 $scriptSrc = [ "'unsafe-eval'", "'self'" ];
146 if ( !isset( $policyConfig['useNonces'] ) ||
$policyConfig['useNonces'] ) {
147 $scriptSrc[] = "'nonce-" . $this->nonce
. "'";
150 $scriptSrc = array_merge( $scriptSrc, $additionalSelfUrlsScript );
151 if ( isset( $policyConfig['script-src'] )
152 && is_array( $policyConfig['script-src'] )
154 foreach ( $policyConfig['script-src'] as $src ) {
155 $scriptSrc[] = $this->escapeUrlForCSP( $src );
158 // Note: default on if unspecified.
159 if ( !isset( $policyConfig['unsafeFallback'] )
160 ||
$policyConfig['unsafeFallback']
162 // unsafe-inline should be ignored on browsers
163 // that support 'nonce-foo' sources.
164 // Some older versions of firefox don't follow this
165 // rule, but new browsers do. (Should be for at least
167 $scriptSrc[] = "'unsafe-inline'";
169 // If default source option set to true or
170 // an array of urls, set a restrictive default-src.
171 // If set to false, we send a lenient default-src,
172 // see the code above where $defaultSrc is set initially.
173 if ( isset( $policyConfig['default-src'] )
174 && $policyConfig['default-src'] !== false
176 $defaultSrc = array_merge(
177 [ "'self'", 'data:', 'blob:' ],
180 if ( is_array( $policyConfig['default-src'] ) ) {
181 foreach ( $policyConfig['default-src'] as $src ) {
182 $defaultSrc[] = $this->escapeUrlForCSP( $src );
187 if ( !isset( $policyConfig['includeCORS'] ) ||
$policyConfig['includeCORS'] ) {
188 $CORSUrls = $this->getCORSSources();
189 if ( !in_array( '*', $defaultSrc ) ) {
190 $defaultSrc = array_merge( $defaultSrc, $CORSUrls );
192 // Unlikely to have * in scriptSrc, but doesn't
194 if ( !in_array( '*', $scriptSrc ) ) {
195 $scriptSrc = array_merge( $scriptSrc, $CORSUrls );
199 Hooks
::run( 'ContentSecurityPolicyDefaultSource', [ &$defaultSrc, $policyConfig, $mode ] );
200 Hooks
::run( 'ContentSecurityPolicyScriptSource', [ &$scriptSrc, $policyConfig, $mode ] );
202 // Check if array just in case the hook made it false
203 if ( is_array( $defaultSrc ) ) {
204 $cssSrc = array_merge( $defaultSrc, [ "'unsafe-inline'" ] );
207 if ( isset( $policyConfig['report-uri'] ) && $policyConfig['report-uri'] !== true ) {
208 if ( $policyConfig['report-uri'] === false ) {
211 $reportUri = $this->escapeUrlForCSP( $policyConfig['report-uri'] );
214 $reportUri = $this->getReportUri( $mode );
217 // Only send an img-src, if we're sending a restricitve default.
218 if ( !is_array( $defaultSrc )
219 ||
!in_array( '*', $defaultSrc )
220 ||
!in_array( 'data:', $defaultSrc )
221 ||
!in_array( 'blob:', $defaultSrc )
223 // A future todo might be to make the whitelist options only
224 // add all the whitelisted sites to the header, instead of
225 // allowing all (Assuming there is a small number of sites).
226 // For now, the external image feature disables the limits
227 // CSP puts on external images.
228 if ( $mwConfig->get( 'AllowExternalImages' )
229 ||
$mwConfig->get( 'AllowExternalImagesFrom' )
230 ||
$mwConfig->get( 'AllowImageTag' )
232 $imgSrc = [ '*', 'data:', 'blob:' ];
233 } elseif ( $mwConfig->get( 'EnableImageWhitelist' ) ) {
234 $whitelist = wfMessage( 'external_image_whitelist' )
235 ->inContentLanguage()
237 if ( preg_match( '/^\s*[^\s#]/m', $whitelist ) ) {
238 $imgSrc = [ '*', 'data:', 'blob:' ];
245 $directives[] = 'script-src ' . implode( ' ', $scriptSrc );
248 $directives[] = 'default-src ' . implode( ' ', $defaultSrc );
251 $directives[] = 'style-src ' . implode( ' ', $cssSrc );
254 $directives[] = 'img-src ' . implode( ' ', $imgSrc );
257 $directives[] = 'report-uri ' . $reportUri;
260 Hooks
::run( 'ContentSecurityPolicyDirectives', [ &$directives, $policyConfig, $mode ] );
262 return implode( '; ', $directives );
266 * Get the default report uri.
268 * @param int $mode self::*_MODE constant.
269 * @return string The URI to send reports to.
270 * @throws UnexpectedValueException if given invalid mode.
272 private function getReportUri( $mode ) {
274 'action' => 'cspreport',
277 if ( $mode === self
::REPORT_ONLY_MODE
) {
278 $apiArguments['reportonly'] = '1';
280 $reportUri = wfAppendQuery( wfScript( 'api' ), $apiArguments );
282 // Per spec, ';' and ',' must be hex-escaped in report uri
283 // Also add an & at the end of url to work around bug in hhvm
284 // with handling of POST parameters when always_decode_post_data
285 // is set to true. See https://github.com/facebook/hhvm/issues/6676
286 $reportUri = $this->escapeUrlForCSP( $reportUri ) . '&';
291 * Given a url, convert to form needed for CSP.
293 * Currently this does either scheme + host, or
294 * if protocol relative, just the host. Future versions
295 * could potentially preserve some of the path, if its determined
296 * that that would be a good idea.
298 * @note This does the extra escaping for CSP, but assumes the url
299 * has already had normal url escaping applied.
300 * @note This discards urls same as server name, as 'self' directive
301 * takes care of that.
303 * @return string|bool Converted url or false on failure
305 private function prepareUrlForCSP( $url ) {
307 if ( preg_match( '/^[a-z][a-z0-9+.-]*:$/i', $url ) ) {
308 // A schema source (e.g. blob: or data:)
311 $bits = wfParseUrl( $url );
312 if ( !$bits && strpos( $url, '/' ) === false ) {
313 // probably something like example.com.
314 // try again protocol-relative.
316 $bits = wfParseUrl( $url );
318 if ( $bits && isset( $bits['host'] )
319 && $bits['host'] !== $this->mwConfig
->get( 'ServerName' )
321 $result = $bits['host'];
322 if ( $bits['scheme'] !== '' ) {
323 $result = $bits['scheme'] . $bits['delimiter'] . $result;
325 if ( isset( $bits['port'] ) ) {
326 $result .= ':' . $bits['port'];
328 $result = $this->escapeUrlForCSP( $result );
334 * Get additional script sources
336 * @return array Additional sources for loading scripts from
338 private function getAdditionalSelfUrlsScript() {
339 $additionalUrls = [];
340 // wgExtensionAssetsPath for ?debug=true mode
341 $pathVars = [ 'LoadScript', 'ExtensionAssetsPath', 'ResourceBasePath' ];
343 foreach ( $pathVars as $path ) {
344 $url = $this->mwConfig
->get( $path );
345 $preparedUrl = $this->prepareUrlForCSP( $url );
346 if ( $preparedUrl ) {
347 $additionalUrls[] = $preparedUrl;
350 $RLSources = $this->mwConfig
->get( 'ResourceLoaderSources' );
351 foreach ( $RLSources as $wiki => $sources ) {
352 foreach ( $sources as $id => $value ) {
353 $url = $this->prepareUrlForCSP( $value );
355 $additionalUrls[] = $url;
360 return array_unique( $additionalUrls );
364 * Get additional host names for the wiki (e.g. if static content loaded elsewhere)
366 * @note These are general load sources, not script sources
367 * @return array Array of other urls for wiki (for use in default-src)
369 private function getAdditionalSelfUrls() {
370 // XXX on a foreign repo, the included description page can have anything on it,
371 // including inline scripts. But nobody sane does that.
373 // In principle, you can have even more complex configs... (e.g. The urlsByExt option)
375 $additionalSelfUrls = [];
377 // Future todo: The zone urls should never go into
378 // style-src. They should either be only in img-src, or if
379 // img-src unspecified they should be in default-src. Similarly,
380 // the DescriptionStylesheetUrl only needs to be in style-src
381 // (or default-src if style-src unspecified).
382 $callback = function ( $repo, &$urls ) {
383 $urls[] = $repo->getZoneUrl( 'public' );
384 $urls[] = $repo->getZoneUrl( 'transcoded' );
385 $urls[] = $repo->getZoneUrl( 'thumb' );
386 $urls[] = $repo->getDescriptionStylesheetUrl();
388 $localRepo = RepoGroup
::singleton()->getRepo( 'local' );
389 $callback( $localRepo, $pathUrls );
390 RepoGroup
::singleton()->forEachForeignRepo( $callback, [ &$pathUrls ] );
392 // Globals that might point to a different domain
393 $pathGlobals = [ 'LoadScript', 'ExtensionAssetsPath', 'StylePath', 'ResourceBasePath' ];
394 foreach ( $pathGlobals as $path ) {
395 $pathUrls[] = $this->mwConfig
->get( $path );
397 foreach ( $pathUrls as $path ) {
398 $preparedUrl = $this->prepareUrlForCSP( $path );
399 if ( $preparedUrl !== false ) {
400 $additionalSelfUrls[] = $preparedUrl;
403 $RLSources = $this->mwConfig
->get( 'ResourceLoaderSources' );
405 foreach ( $RLSources as $wiki => $sources ) {
406 foreach ( $sources as $id => $value ) {
407 $url = $this->prepareUrlForCSP( $value );
409 $additionalSelfUrls[] = $url;
414 return array_unique( $additionalSelfUrls );
418 * include domains that are allowed to send us CORS requests.
420 * Technically, $wgCrossSiteAJAXdomains lists things that are allowed to talk to us
421 * not things that we are allowed to talk to - but if something is allowed to talk to us,
422 * then there is a good chance that we should probably be allowed to talk to it.
424 * This is configurable with the 'includeCORS' key in the CSP config, and enabled
426 * @note CORS domains with single character ('?') wildcards, are not included.
427 * @return array Additional hosts
429 private function getCORSSources() {
430 $additionalUrls = [];
431 $CORSSources = $this->mwConfig
->get( 'CrossSiteAJAXdomains' );
432 foreach ( $CORSSources as $source ) {
433 if ( strpos( $source, '?' ) !== false ) {
434 // CSP doesn't support single char wildcard
437 $url = $this->prepareUrlForCSP( $source );
439 $additionalUrls[] = $url;
442 return $additionalUrls;
446 * CSP spec says ',' and ';' are not allowed to appear in urls.
448 * @note This assumes that normal escaping has been applied to the url
449 * @param string $url URL (or possibly just part of one)
452 private function escapeUrlForCSP( $url ) {
461 * Does this browser give false positive reports?
463 * Some versions of firefox (40-42) incorrectly report a csp
464 * violation for nonce sources, despite allowing them.
466 * @see https://bugzilla.mozilla.org/show_bug.cgi?id=1026520
467 * @param string $ua User-agent header
470 public static function falsePositiveBrowser( $ua ) {
471 return (bool)preg_match( '!Firefox/4[0-2]\.!', $ua );
475 * Should we set nonce attribute
477 * @param Config $config Configuration object
480 public static function isNonceRequired( Config
$config ) {
482 $config->get( 'CSPHeader' ),
483 $config->get( 'CSPReportOnlyHeader' )
485 foreach ( $configs as $headerConfig ) {
487 $headerConfig === true ||
488 ( is_array( $headerConfig ) &&
489 !isset( $headerConfig['useNonces'] ) ) ||
490 ( is_array( $headerConfig ) &&
491 isset( $headerConfig['useNonces'] ) &&
492 $headerConfig['useNonces'] )