84 lines
2.4 KiB
Perl
84 lines
2.4 KiB
Perl
package Koha::Middleware::ContentSecurityPolicy;
|
|
|
|
# This file is part of Koha.
|
|
#
|
|
# Koha is free software; you can redistribute it and/or modify it
|
|
# under the terms of the GNU General Public License as published by
|
|
# the Free Software Foundation; either version 3 of the License, or
|
|
# (at your option) any later version.
|
|
#
|
|
# Koha is distributed in the hope that it will be useful, but
|
|
# WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
# GNU General Public License for more details.
|
|
#
|
|
# You should have received a copy of the GNU General Public License
|
|
# along with Koha; if not, see <https://www.gnu.org/licenses>.
|
|
|
|
use Modern::Perl;
|
|
|
|
use parent qw(Plack::Middleware);
|
|
use Plack::Request;
|
|
use Plack::Response;
|
|
|
|
use Koha::ContentSecurityPolicy;
|
|
|
|
=head1 METHODS
|
|
|
|
=head2 call
|
|
|
|
This method is called for each request, and adds the Content-Security-Policy or
|
|
the Content-Security-Policy-Report-Only header based on your CSP configuration in
|
|
koha-conf.xml.
|
|
|
|
=cut
|
|
|
|
sub call {
|
|
my ( $self, $env ) = @_;
|
|
|
|
my $req = Plack::Request->new($env);
|
|
|
|
my $csp = Koha::ContentSecurityPolicy->new;
|
|
$csp->set_nonce();
|
|
|
|
my $res = $self->app->($env);
|
|
return $res unless $csp->is_enabled;
|
|
|
|
return Plack::Util::response_cb(
|
|
$res,
|
|
sub {
|
|
my $res = shift;
|
|
my $headers = $res->[1];
|
|
my $add_reporting_endpoints = 1;
|
|
for ( my $i = 0 ; $i < @$headers ; $i++ ) {
|
|
|
|
# if reporting-endpoints already exists, append it
|
|
if ( lc( $headers->[$i] ) eq 'reporting-endpoints' ) {
|
|
$headers->[ $i + 1 ] = _add_csp_to_reporting_endpoints( $headers->[ $i + 1 ] );
|
|
$add_reporting_endpoints = 0;
|
|
last;
|
|
}
|
|
}
|
|
|
|
# reporting-endpoints is not yet defined, so let's define it
|
|
if ($add_reporting_endpoints) {
|
|
push @$headers, ( 'Reporting-Endpoints' => _add_csp_to_reporting_endpoints() );
|
|
}
|
|
push @$headers, ( $csp->header_name => $csp->header_value );
|
|
}
|
|
);
|
|
}
|
|
|
|
sub _add_csp_to_reporting_endpoints {
|
|
my ($value) = @_;
|
|
if ( $value && $value =~ /^\w+/ ) {
|
|
$value = $value . ', ';
|
|
} else {
|
|
$value = '';
|
|
}
|
|
$value = $value . 'csp-violations="/api/v1/public/csp-reports"';
|
|
|
|
return $value;
|
|
}
|
|
1;
|