Bugzilla – Attachment 192706 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: Use report-to with Reporting-Endpoints
Bug-38365-Use-report-to-with-Reporting-Endpoints.patch (text/plain), 7.13 KB, created by
David Cook
on 2026-02-09 02:27:14 UTC
(
hide
)
Description:
Bug 38365: Use report-to with Reporting-Endpoints
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-09 02:27:14 UTC
Size:
7.13 KB
patch
obsolete
>From 3a08b6b252467c930874bc86b9fa955d89c234b7 Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@hypernova.fi> >Date: Wed, 4 Feb 2026 16:42:34 +0200 >Subject: [PATCH] Bug 38365: Use report-to with Reporting-Endpoints > >report-uri is deprecated, replaced by report-to and Reporting-Endpoints. > >To test: >1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >--- > Koha/Middleware/ContentSecurityPolicy.pm | 30 +++++++++++- > debian/templates/koha-conf-site.xml.in | 6 +-- > etc/koha-conf.xml | 6 +-- > .../Koha/Middleware/ContentSecurityPolicy.t | 49 ++++++++++++++++++- > 4 files changed, 82 insertions(+), 9 deletions(-) > >diff --git a/Koha/Middleware/ContentSecurityPolicy.pm b/Koha/Middleware/ContentSecurityPolicy.pm >index 816922a9986..49fe6379926 100644 >--- a/Koha/Middleware/ContentSecurityPolicy.pm >+++ b/Koha/Middleware/ContentSecurityPolicy.pm >@@ -47,11 +47,37 @@ sub call { > return Plack::Util::response_cb( > $res, > sub { >- my $res = shift; >- my $headers = $res->[1]; >+ my $res = shift; >+ my $headers = $res->[1]; >+ my $add_reporting_endpoints = 1; >+ for ( my $i = 0 ; $i < @$headers ; $i++ ) { >+ >+ # if reporting-endpoints already exists, append it >+ if ( lc( $headers->[$i] ) eq 'reporting-endpoints' ) { >+ $headers->[ $i + 1 ] = _add_csp_to_reporting_endpoints( $headers->[ $i + 1 ] ); >+ $add_reporting_endpoints = 0; >+ last; >+ } >+ } >+ >+ # reporting-endpoints is not yet defined, so let's define it >+ if ($add_reporting_endpoints) { >+ push @$headers, ( 'Reporting-Endpoints' => _add_csp_to_reporting_endpoints() ); >+ } > push @$headers, ( $csp->header_name => $csp->header_value ); > } > ); > } > >+sub _add_csp_to_reporting_endpoints { >+ my ($value) = @_; >+ if ( $value && $value =~ /^\w+/ ) { >+ $value = $value . ', '; >+ } else { >+ $value = ''; >+ } >+ $value = $value . 'csp-violations="/api/v1/public/csp-reports"'; >+ >+ return $value; >+} > 1; >diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in >index e90b7784b73..9b09b89ecf2 100644 >--- a/debian/templates/koha-conf-site.xml.in >+++ b/debian/templates/koha-conf-site.xml.in >@@ -519,9 +519,9 @@ __END_SRU_PUBLICSERVER__ > 2. Review logs and fix any legitimate violations > 3. Switch to enabled mode once violations are resolved > >- To enable violation reporting, add report-uri to your policy pointing to Koha's >- built-in CSP report endpoint. Example with reporting: >- <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports</csp_header_value> >+ To enable violation reporting, add report-to to your policy pointing to csp-violations. >+ Example with reporting: >+ <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> > > Reports are logged via Koha's logging system. Configure log4perl to capture them: > log4perl.logger.api.csp = WARN, CSP >diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml >index 991d9318b86..97108498fd9 100644 >--- a/etc/koha-conf.xml >+++ b/etc/koha-conf.xml >@@ -330,9 +330,9 @@ > 2. Review logs and fix any legitimate violations > 3. Switch to enabled mode once violations are resolved > >- To enable violation reporting, add report-uri to your policy pointing to Koha's >- built-in CSP report endpoint. Example with reporting: >- <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports</csp_header_value> >+ To enable violation reporting, add report-to to your policy pointing csp-violations. >+ Example with reporting: >+ <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> > > Reports are logged via Koha's logging system. Configure log4perl to capture them: > log4perl.logger.api.csp = WARN, CSP >diff --git a/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t b/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >index 6095169ca11..7d12f3cd9c4 100755 >--- a/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >+++ b/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >@@ -21,19 +21,23 @@ > use strict; > use warnings; > use Test::NoWarnings; >-use Test::More tests => 4; >+use Test::More tests => 5; > > use HTTP::Request::Common; > use Plack::App::CGIBin; > use Plack::Builder; > use Plack::Test; > >+use Koha::Database; >+ > use t::lib::Mocks; > > use_ok("Koha::Middleware::ContentSecurityPolicy"); > > my $conf_csp_section = 'content_security_policy'; > >+my $schema = Koha::Database->schema; >+ > subtest 'test CSP in OPAC' => sub { > plan tests => 5; > >@@ -159,3 +163,46 @@ subtest 'test CSP in staff client' => sub { > > like( $res->content, qr/<body id="main_auth"/, 'mainpage.pl looks okay' ); > }; >+ >+subtest 'test Reporting-Endpoints for CSP violation reports' => sub { >+ plan tests => 1; >+ >+ my $test_nonce = 'TEST_NONCE'; >+ my $csp_header_value = >+ "default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; >+ >+ t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' ); >+ >+ $schema->storage->txn_begin; >+ >+ t::lib::Mocks::mock_preference( 'OpacPublic', 1 ); >+ t::lib::Mocks::mock_config( >+ $conf_csp_section, >+ { opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } >+ ); >+ >+ # Set nonce >+ Koha::ContentSecurityPolicy->new->set_nonce($test_nonce); >+ >+ my $env = {}; >+ my $home = $ENV{KOHA_HOME}; >+ my $app = Plack::App::CGIBin->new( root => $ENV{GIT_INSTALL} ? "$home/opac" : "$home/opac/cgi-bin/opac" )->to_app; >+ >+ $app = builder { >+ mount '/opac' => builder { >+ enable "+Koha::Middleware::ContentSecurityPolicy"; >+ $app; >+ }; >+ }; >+ >+ my $test = Plack::Test->create($app); >+ my $res = $test->request( GET "/opac/opac-main.pl" ); >+ my $expected_csp_header_value = $csp_header_value; >+ $expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; >+ like( >+ $res->header('reporting-endpoints'), qr/^csp-violations="\/api\/v1\/public\/csp-reports"$/, >+ "Response contains Reporting-Endpoints header with the expected value" >+ ); >+ >+ $schema->storage->txn_rollback; >+}; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968