Bugzilla – Attachment 192684 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: Set limitations on endpoint input
Bug-38365-Set-limitations-on-endpoint-input.patch (text/plain), 5.38 KB, created by
Lari Taskula
on 2026-02-08 09:25:32 UTC
(
hide
)
Description:
Bug 38365: Set limitations on endpoint input
Filename:
MIME Type:
Creator:
Lari Taskula
Created:
2026-02-08 09:25:32 UTC
Size:
5.38 KB
patch
obsolete
>From 66b5d5b6a12842dc99d599fc882acbc50500290c Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@hypernova.fi> >Date: Thu, 5 Feb 2026 16:31:11 +0200 >Subject: [PATCH] Bug 38365: Set limitations on endpoint input > >This patch attempts to set some sane input limits to the CSP violation report. > >To test: >1. Rebuild API >redocly bundle --ext json api/v1/swagger/swagger.yaml --output api/v1/swagger/swagger_bundle.json >2. t/db_dependent/api/v1/public/csp_reports.t >--- > api/v1/swagger/definitions/csp_report.yaml | 17 ++++++++++++ > t/db_dependent/api/v1/public/csp_reports.t | 32 ++++++++++++++++++++-- > 2 files changed, 47 insertions(+), 2 deletions(-) > >diff --git a/api/v1/swagger/definitions/csp_report.yaml b/api/v1/swagger/definitions/csp_report.yaml >index e175c911f2f..82bf9176ce8 100644 >--- a/api/v1/swagger/definitions/csp_report.yaml >+++ b/api/v1/swagger/definitions/csp_report.yaml >@@ -11,37 +11,54 @@ properties: > document-uri: > type: string > description: The URI of the document where the violation occurred >+ maxLength: 200 > referrer: > type: string > description: The referrer of the document where the violation occurred >+ maxLength: 200 > violated-directive: > type: string > description: The directive that was violated (e.g., "script-src 'self'") >+ maxLength: 100 > effective-directive: > type: string > description: The effective directive that was violated >+ maxLength: 100 > original-policy: > type: string > description: The original CSP policy as specified in the header >+ maxLength: 400 > disposition: > type: string > description: Either "enforce" or "report" depending on CSP mode >+ enum: >+ - enforce >+ - report > blocked-uri: > type: string > description: The URI of the resource that was blocked >+ maxLength: 200 > line-number: > type: integer > description: Line number in the document where the violation occurred >+ minimum: 0 >+ maximum: 999999 > column-number: > type: integer > description: Column number where the violation occurred >+ minimum: 0 >+ maximum: 999999 > source-file: > type: string > description: The URI of the script where the violation occurred >+ maxLength: 200 > status-code: > type: integer > description: HTTP status code of the document >+ minimum: 0 >+ maximum: 999 > script-sample: > type: string > description: First 40 characters of the inline script that caused the violation >+ maxLength: 41 > additionalProperties: true >diff --git a/t/db_dependent/api/v1/public/csp_reports.t b/t/db_dependent/api/v1/public/csp_reports.t >index 40da813de6a..35862f107e8 100755 >--- a/t/db_dependent/api/v1/public/csp_reports.t >+++ b/t/db_dependent/api/v1/public/csp_reports.t >@@ -36,7 +36,7 @@ t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 ); > > subtest 'add() tests' => sub { > >- plan tests => 7; >+ plan tests => 15; > > $schema->storage->txn_begin; > >@@ -52,11 +52,39 @@ subtest 'add() tests' => sub { > 'blocked-uri' => 'inline', > 'line-number' => 42, > 'column-number' => 10, >- 'source-file' => 'https://library.example.org/cgi-bin/koha/opac-main.pl', >+ 'source-file' => 'https://library.example.org/cgi-bin/koah/opac-main.pl', > 'status-code' => 200, > } > }; > >+ $csp_report->{'csp-report'}->{'line-number'} = 99999999999999999; >+ >+ # Too large integers should be rejected >+ $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) >+ ->status_is( 400, 'CSP report rejected (400) because of line-number exceeding maximum value' ); >+ >+ $csp_report->{'csp-report'}->{'line-number'} = -1; >+ >+ # Too small integers should be rejected >+ $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) >+ ->status_is( 400, 'CSP report rejected (400) because of line-number not reaching minimum value' ); >+ $csp_report->{'csp-report'}->{'line-number'} = 42; >+ >+ $csp_report->{'csp-report'}->{'disposition'} = 'this is not okay'; >+ >+ # Enum values should be confirmed >+ $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) >+ ->status_is( 400, 'CSP report rejected (400) because of disposition is not either "enforce" nor "report"' ); >+ $csp_report->{'csp-report'}->{'disposition'} = 'enforce'; >+ >+ $csp_report->{'csp-report'}->{'script-sample'} = >+ 'this is way too long script sample. a maximum of only 40 characters is allowed'; >+ >+ # Too long strings should be rejected >+ $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) >+ ->status_is( 400, 'CSP report rejected (400) because of script-sample exceeding maximum length' ); >+ $csp_report->{'csp-report'}->{'script-sample'} = 'console.log("hi");'; >+ > # Anonymous request should work (browsers send these without auth) > $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) > ->status_is( 204, 'CSP report accepted' ); >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968