View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/Koha/ContentSecurityPolicy.pm (+209 lines)
Line 0 Link Here
1
package Koha::ContentSecurityPolicy;
2
3
# Copyright 2025 Hypernova Oy, Koha Development Team
4
#
5
# This file is part of Koha.
6
#
7
# Koha is free software; you can redistribute it and/or modify it
8
# under the terms of the GNU General Public License as published by
9
# the Free Software Foundation; either version 3 of the License, or
10
# (at your option) any later version.
11
#
12
# Koha is distributed in the hope that it will be useful, but
13
# WITHOUT ANY WARRANTY; without even the implied warranty of
14
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15
# GNU General Public License for more details.
16
#
17
# You should have received a copy of the GNU General Public License
18
# along with Koha; if not, see <https://www.gnu.org/licenses>.
19
20
use Modern::Perl;
21
22
use C4::Context;
23
use Koha::Cache::Memory::Lite;
24
use Koha::Token;
25
26
use Koha::Exceptions::Config;
27
28
=head1 NAME
29
30
Koha::ContentSecurityPolicy - Object for handling Content-Security-Policy header
31
32
=head1 SYNOPSIS
33
34
    use Koha::ContentSecurityPolicy;
35
36
    my $csp = Koha::ContentSecurityPolicy->new;
37
38
    if ($csp->is_enabled) {
39
        $options->{$csp->header_name} = $csp->header_value;
40
    }
41
42
    print $cgi->header($options), $data;
43
44
=head1 DESCRIPTION
45
46
TODO
47
48
=head1 METHODS
49
50
=head2 new
51
52
    my $csp = Koha::ContentSecurityPolicy->new;
53
54
=cut
55
56
sub new {
57
    my ( $class, $params ) = @_;
58
    my $self = bless $params // {}, $class;
59
60
    $self->nonce( $params->{nonce} );
61
    $self->{config} = Koha::Config->get_instance;
62
    return $self;
63
}
64
65
=head2 header_name
66
67
    $csp->header_name($args);
68
69
    Given C<$args>, returns the name of the CSP header.
70
71
    C<$args> can contain the following keys (and values)
72
73
    - interface:
74
        - defaults to L<C4::Context>->interface.
75
        - can be one of: C<opac>, C<intranet>
76
77
    Returns 'Content-Security-Policy' if CSP is in "enabled" csp_mode
78
    Returns 'Content-Security-Policy-Report-Only' if CSP in "report-only" csp_mode
79
80
    Throws Koha::Exceptions::Config::MissingEntry is CSP csp_mode is disabled in KOHA_CONF
81
82
=cut
83
84
sub header_name {
85
    my ( $self, $args ) = @_;
86
87
    my $interface //= $args->{interface} || C4::Context->interface;
88
89
    my $conf_csp = $self->{config}->get('content_security_policy');
90
91
    Koha::Exceptions::Config::MissingEntry->throw( error => 'Missing request content_security_policy csp_header_value' )
92
        unless exists $conf_csp->{$interface}->{csp_mode};
93
94
    return 'Content-Security-Policy-Report-Only' if $conf_csp->{$interface}->{csp_mode} eq 'report-only';
95
    return 'Content-Security-Policy'             if $conf_csp->{$interface}->{csp_mode} eq 'enabled';
96
97
    Koha::Exceptions::Config::MissingEntry->throw(
98
        error => 'Content Security Policy is disabled. Header name should only be retrieved when CSP is enabled.' );
99
}
100
101
=head2 header_value
102
103
    $csp->header_value($args);
104
105
    Given C<$args>, returns the value of the CSP header.
106
107
    C<$args> can contain the following keys (and values)
108
109
    - interface:
110
        - defaults to L<C4::Context>->interface.
111
        - can be one of: C<opac>, C<intranet>
112
113
    Returns content_security_policy.[opac|staff].csp_header_value
114
115
    Throws Koha::Exceptions::Config::MissingEntry is CSP property "csp_header_value" is missing in KOHA_CONF
116
117
=cut
118
119
sub header_value {
120
    my ( $self, $args ) = @_;
121
122
    my $interface //= $args->{interface} || C4::Context->interface;
123
124
    my $conf_csp = $self->{config}->get('content_security_policy');
125
126
    Koha::Exceptions::Config::MissingEntry->throw( error => 'Missing request content_security_policy csp_header_value' )
127
        unless exists $conf_csp->{$interface}->{csp_header_value};
128
129
    my $csp_header_value = $conf_csp->{$interface}->{csp_header_value};
130
    my $csp_nonce        = $self->nonce;
131
132
    $csp_header_value =~ s/_CSP_NONCE_/$csp_nonce/g;
133
134
    return $csp_header_value;
135
}
136
137
=head2 is_enabled
138
139
    $csp->is_enabled($args);
140
141
    Given C<$args>, checks if CSP is enabled
142
143
    C<$args> can contain the following keys (and values)
144
145
    - interface:
146
        - defaults to L<C4::Context>->interface.
147
        - can be one of: C<opac>, C<intranet>
148
149
    Returns 0 if CSP is disabled for given C<$args>
150
    Returns 1 if CSP is enabled for given C<$args>
151
152
=cut
153
154
sub is_enabled {
155
    my ( $self, $args ) = @_;
156
    my $interface //= $args->{interface} || C4::Context->interface;
157
158
    my $conf_csp = $self->{config}->get('content_security_policy');
159
160
    return 0 if $interface ne 'opac' && $interface ne 'intranet';
161
162
    return 0 unless exists $conf_csp->{$interface}->{csp_mode};
163
    return 1
164
        if $conf_csp->{$interface}->{csp_mode} eq 'report-only'
165
        or $conf_csp->{$interface}->{csp_mode} eq 'enabled';
166
    return 0;
167
}
168
169
=head2 nonce
170
171
    $csp->nonce();
172
173
    Generates and returns the nonce.
174
175
    $csp->nonce($nonce);
176
177
    Sets and returns the nonce.
178
179
    A CSP nonce is a random token that is used both in the inline scripts
180
    and the Content-Security-Policy[-Report-Only] response header.
181
182
=cut
183
184
sub nonce {
185
    my ( $self, $nonce ) = @_;
186
    my $cache = Koha::Cache::Memory::Lite->new;
187
188
    if ($nonce) {
189
        $cache->set_in_cache( 'CSP-NONCE', $nonce );
190
        $self->{nonce} = $nonce;
191
        return $self->{nonce};
192
    }
193
194
    if ( $nonce = $cache->get_from_cache('CSP-NONCE') ) {
195
        $self->{nonce} = $nonce;
196
        return $self->{nonce};
197
    }
198
199
    unless ( $self->{nonce} ) {
200
        $nonce = Koha::Token->new()->generate( { pattern => '\w{10}' } );
201
        $self->{nonce} = $nonce;
202
    }
203
204
    $cache->set_in_cache( 'CSP-NONCE', $self->{nonce} );
205
206
    return $self->{nonce};
207
}
208
209
1;
(-)a/t/Koha/ContentSecurityPolicy.t (-1 / +178 lines)
Line 0 Link Here
0
- 
1
#!/usr/bin/perl
2
3
# This file is part of Koha.
4
#
5
# Koha is free software; you can redistribute it and/or modify it
6
# under the terms of the GNU General Public License as published by
7
# the Free Software Foundation; either version 3 of the License, or
8
# (at your option) any later version.
9
#
10
# Koha is distributed in the hope that it will be useful, but
11
# WITHOUT ANY WARRANTY; without even the implied warranty of
12
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13
# GNU General Public License for more details.
14
#
15
# You should have received a copy of the GNU General Public License
16
# along with Koha; if not, see <https://www.gnu.org/licenses>.
17
18
use Modern::Perl;
19
20
use Test::NoWarnings;
21
use Test::MockModule;
22
use Test::More tests => 6;
23
use Test::Exception;
24
25
BEGIN { use_ok('Koha::ContentSecurityPolicy') }
26
27
use C4::Context;
28
use Koha::Cache::Memory::Lite;
29
30
use t::lib::Mocks;
31
32
my $conf_csp_section = 'content_security_policy';
33
34
subtest 'is_enabled() tests' => sub {
35
36
    plan tests => 4;
37
38
    foreach my $interface ( 'opac', 'intranet' ) {
39
        subtest "interface $interface" => sub {
40
            t::lib::Mocks::mock_config( $conf_csp_section, {} );
41
            C4::Context->interface($interface);
42
43
            my $csp = Koha::ContentSecurityPolicy->new;
44
45
            is( $csp->is_enabled, 0, 'CSP is not enabled when koha-conf.xml has not set the entire section' );
46
47
            t::lib::Mocks::mock_config(
48
                $conf_csp_section,
49
                { $interface => { csp_mode => '', csp_header_value => 'test' } }
50
            );
51
            is( $csp->is_enabled, 0, 'CSP is not enabled when csp_mode is empty' );
52
53
            t::lib::Mocks::mock_config(
54
                $conf_csp_section,
55
                { $interface => { csp_mode => 'wrong', csp_header_value => 'test' } }
56
            );
57
            is( $csp->is_enabled, 0, 'CSP is not enabled when csp_mode has not got a valid csp_header_value' );
58
59
            t::lib::Mocks::mock_config(
60
                $conf_csp_section,
61
                { $interface => { csp_mode => 'report-only', csp_header_value => 'test' } }
62
            );
63
            is( $csp->is_enabled, 1, 'CSP is enabled when csp_mode is report-only' );
64
65
            t::lib::Mocks::mock_config(
66
                $conf_csp_section,
67
                { $interface => { csp_mode => 'enabled', csp_header_value => 'test' } }
68
            );
69
            is( $csp->is_enabled, 1, 'CSP is enabled when csp_mode is enabled' );
70
71
            t::lib::Mocks::mock_config(
72
                $conf_csp_section,
73
                {
74
                    $interface => {
75
                        csp_mode => 'enabled', csp_header_value => 'test',
76
                    }
77
                }
78
            );
79
        };
80
    }
81
82
    t::lib::Mocks::mock_config(
83
        $conf_csp_section, { opac => { csp_mode => 'enabled', csp_header_value => 'test' } },
84
        intranet => { csp_mode => '', csp_header_value => 'test' }
85
    );
86
    C4::Context->interface('intranet');
87
    my $csp = Koha::ContentSecurityPolicy->new;
88
    is( $csp->is_enabled, 0, 'CSP is disabled when other interface is enabled, but not this one' );
89
    is( $csp->is_enabled( { interface => 'opac' } ), 1, 'CSP is enabled when explicitly defining interface' );
90
};
91
92
subtest 'header_name tests' => sub {
93
    plan tests => 6;
94
95
    t::lib::Mocks::mock_config( $conf_csp_section, {} );
96
    C4::Context->interface('opac');
97
98
    my $csp = Koha::ContentSecurityPolicy->new;
99
100
    throws_ok { $csp->header_name } 'Koha::Exceptions::Config::MissingEntry', 'Exception thrown when missing csp_mode';
101
102
    t::lib::Mocks::mock_config( $conf_csp_section, { opac => {} } );
103
    throws_ok { $csp->header_name } 'Koha::Exceptions::Config::MissingEntry', 'Exception thrown when missing csp_mode';
104
105
    t::lib::Mocks::mock_config( $conf_csp_section, { opac => { csp_mode => '' } } );
106
    throws_ok { $csp->header_name } 'Koha::Exceptions::Config::MissingEntry', 'Exception thrown when missing csp_mode';
107
    t::lib::Mocks::mock_config( $conf_csp_section, { opac => { csp_mode => 'invalid' } } );
108
    throws_ok { $csp->header_name } 'Koha::Exceptions::Config::MissingEntry', 'Exception thrown when invalid csp_mode';
109
110
    t::lib::Mocks::mock_config( $conf_csp_section, { opac => { csp_mode => 'report-only' } } );
111
    is(
112
        $csp->header_name, 'Content-Security-Policy-Report-Only',
113
        'report-only => Content-Security-Policy-Report-Only'
114
    );
115
    t::lib::Mocks::mock_config( $conf_csp_section, { opac => { csp_mode => 'enabled' } } );
116
    is( $csp->header_name, 'Content-Security-Policy', 'enabled => Content-Security-Policy' );
117
};
118
119
subtest 'header_value tests' => sub {
120
    plan tests => 6;
121
122
    t::lib::Mocks::mock_config( $conf_csp_section, {} );
123
    C4::Context->interface('opac');
124
125
    my $csp = Koha::ContentSecurityPolicy->new;
126
127
    throws_ok { $csp->header_value } 'Koha::Exceptions::Config::MissingEntry',
128
        'Exception thrown when missing csp_header_value';
129
130
    t::lib::Mocks::mock_config( $conf_csp_section, { opac => {} } );
131
    throws_ok { $csp->header_value } 'Koha::Exceptions::Config::MissingEntry',
132
        'Exception thrown when missing csp_header_value';
133
134
    t::lib::Mocks::mock_config( $conf_csp_section, { opac => { csp_header_value => '' } } );
135
    is( $csp->header_value, '', 'Even an empty csp_header_value is retrieved form koha-conf.xml' );
136
    t::lib::Mocks::mock_config( $conf_csp_section, { opac => { csp_header_value => 'some value' } } );
137
    is( $csp->header_value, 'some value', 'csp_header_value is retrieved from koha-conf.xml' );
138
139
    t::lib::Mocks::mock_config(
140
        $conf_csp_section,
141
        { opac => { csp_header_value => 'begin nonce-_CSP_NONCE_ end' } }
142
    );
143
    my $cache = Koha::Cache::Memory::Lite->get_instance();
144
    $cache->set_in_cache( 'CSP-NONCE', 'cached value' );
145
    is( $csp->header_value, 'begin nonce-cached value end', 'Cached csp_header_value' );
146
    $cache->flush;
147
148
    $csp = Koha::ContentSecurityPolicy->new( { nonce => 'forced value' } );
149
    is( $csp->header_value, 'begin nonce-forced value end', 'Forced csp_header_value' );
150
};
151
152
subtest 'nonce tests' => sub {
153
    plan tests => 5;
154
155
    t::lib::Mocks::mock_config( $conf_csp_section, {} );
156
    C4::Context->interface('opac');
157
158
    my $csp = Koha::ContentSecurityPolicy->new;
159
160
    $csp = Koha::ContentSecurityPolicy->new( { nonce => 'forced value' } );
161
    is( $csp->nonce, 'forced value', 'nonce is not re-generated as it was passed to new()' );
162
163
    $csp = Koha::ContentSecurityPolicy->new( { nonce => 'forced value' } );
164
    is( $csp->nonce, 'forced value', 'nonce is not re-generated as was cached in memory' );
165
166
    my $cache = Koha::Cache::Memory::Lite->get_instance();
167
    $cache->flush;
168
169
    $csp = Koha::ContentSecurityPolicy->new();
170
    my $nonce = $csp->nonce;
171
    like( $nonce, qr/\w{10}/, 'nonce is a random string of 10 characters' );
172
    is( $nonce, $csp->nonce, 're-calling nonce() returns the same randomly generated cached value' );
173
174
    $cache->set_in_cache( 'CSP-NONCE', 'cached value' );
175
    is( $csp->nonce, 'cached value', 'nonce is not re-generated as it was previously cached' );
176
};
177
178
1;

Return to bug 38365