Bugzilla – Attachment 193306 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: Add support for both CSP report syntaxes
Bug-38365-Add-support-for-both-CSP-report-syntaxes.patch (text/plain), 7.94 KB, created by
David Cook
on 2026-02-17 05:53:42 UTC
(
hide
)
Description:
Bug 38365: Add support for both CSP report syntaxes
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-17 05:53:42 UTC
Size:
7.94 KB
patch
obsolete
>From 24c0b04e2b54b9b043cb63f9f0d7c27c0fdc8059 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 10 Feb 2026 02:04:54 +0000 >Subject: [PATCH] Bug 38365: Add support for both CSP report syntaxes > >--- > Koha/REST/V1/CSPReports.pm | 76 +++++++++++-------- > .../swagger/definitions/csp_report_body.yaml | 56 ++++++++++++++ > .../definitions/csp_report_uri_to.yaml | 22 +++--- > t/db_dependent/api/v1/public/csp_reports.t | 2 +- > 4 files changed, 111 insertions(+), 45 deletions(-) > create mode 100644 api/v1/swagger/definitions/csp_report_body.yaml > >diff --git a/Koha/REST/V1/CSPReports.pm b/Koha/REST/V1/CSPReports.pm >index 38ae99ed913..20568affe1f 100644 >--- a/Koha/REST/V1/CSPReports.pm >+++ b/Koha/REST/V1/CSPReports.pm >@@ -46,43 +46,53 @@ is violated. This endpoint logs those reports for administrator review. > sub add { > my $c = shift->openapi->valid_input or return; > >- my $report = $c->req->json; >- >- # CSP reports come wrapped in a 'csp-report' key >- my $csp_report = $report->{'csp-report'} // $report->{'body'} // $report; >- > my $logger = Koha::Logger->get( { interface => 'csp' } ); > >- # Extract key fields for logging >- my $document_uri = $csp_report->{'document-uri'} // 'unknown'; >- my $violated_dir = $csp_report->{'violated-directive'} // 'unknown'; >- my $blocked_uri = $csp_report->{'blocked-uri'} // 'unknown'; >- my $source_file = $csp_report->{'source-file'} // ''; >- my $line_number = $csp_report->{'line-number'} // ''; >- my $column_number = $csp_report->{'column-number'} // ''; >- >- # Build location string if available >- my $location = ''; >- if ($source_file) { >- $location = " at $source_file"; >- $location .= ":$line_number" if $line_number; >- $location .= ":$column_number" if $column_number; >- } >+ my @reports = (); >+ my $reports_from_json = $c->req->json; >+ if ( ref $reports_from_json eq 'ARRAY' ) { > >- $logger->warn( >- sprintf( >- "CSP violation: '%s' blocked '%s' on page '%s'%s", >- $violated_dir, >- $blocked_uri, >- $document_uri, >- $location >- ) >- ); >+ #FIXME: We could just take the top X number of reports... >+ push( @reports, @$reports_from_json ); >+ } elsif ( ref $reports_from_json eq 'HASH' ) { >+ push( @reports, $reports_from_json ); >+ } > >- # Log full report at debug level for detailed analysis >- if ( $logger->is_debug ) { >- require JSON; >- $logger->debug( "CSP report details: " . JSON::encode_json($csp_report) ); >+ # CSP reports come wrapped in a 'csp-report' key >+ foreach my $report (@reports) { >+ my $csp_report = $report->{'csp-report'} // $report->{body}; >+ >+ # Extract key fields for logging >+ my $document_uri = $csp_report->{'documentURL'} // $csp_report->{'document-uri'} // 'unknown'; >+ my $violated_dir = $csp_report->{'effectiveDirective'} // $csp_report->{'effective-directive'} // 'unknown'; >+ my $blocked_uri = $csp_report->{'blockedURL'} // $csp_report->{'blocked-uri'} // 'unknown'; >+ my $source_file = $csp_report->{'sourceFile'} // $csp_report->{'source-file'} // ''; >+ my $line_number = $csp_report->{'lineNumber'} // $csp_report->{'line-number'} // ''; >+ my $column_number = $csp_report->{'columnNumber'} // $csp_report->{'column-number'} // ''; >+ >+ # Build location string if available >+ my $location = ''; >+ if ($source_file) { >+ $location = " at $source_file"; >+ $location .= ":$line_number" if $line_number; >+ $location .= ":$column_number" if $column_number; >+ } >+ >+ $logger->warn( >+ sprintf( >+ "CSP violation: '%s' blocked '%s' on page '%s'%s", >+ $violated_dir, >+ $blocked_uri, >+ $document_uri, >+ $location >+ ) >+ ); >+ >+ # Log full report at debug level for detailed analysis >+ if ( $logger->is_debug ) { >+ require JSON; >+ $logger->debug( "CSP report details: " . JSON::encode_json($csp_report) ); >+ } > } > > return $c->render( >diff --git a/api/v1/swagger/definitions/csp_report_body.yaml b/api/v1/swagger/definitions/csp_report_body.yaml >new file mode 100644 >index 00000000000..82fda7f446f >--- /dev/null >+++ b/api/v1/swagger/definitions/csp_report_body.yaml >@@ -0,0 +1,56 @@ >+--- >+type: object >+description: | >+ A Content-Security-Policy violation report as sent by browsers. >+ See https://www.w3.org/TR/CSP3/#violation-reports for specification. >+properties: >+ documentURL: >+ type: string >+ description: The URI of the document where the violation occurred >+ maxLength: 200 >+ referrer: >+ type: string >+ description: The referrer of the document where the violation occurred >+ maxLength: 200 >+ effectiveDirective: >+ type: string >+ description: The effective directive that was violated >+ maxLength: 100 >+ originalPolicy: >+ type: string >+ description: The original CSP policy as specified in the header >+ maxLength: 400 >+ disposition: >+ type: string >+ description: Either "enforce" or "report" depending on CSP mode >+ enum: >+ - enforce >+ - report >+ blockedURL: >+ type: string >+ description: The URI of the resource that was blocked >+ maxLength: 200 >+ lineNumber: >+ type: integer >+ description: Line number in the document where the violation occurred >+ minimum: 0 >+ maximum: 999999 >+ columnNumber: >+ type: integer >+ description: Column number where the violation occurred >+ maximum: 999999 >+ minimum: 0 >+ sample: >+ type: string >+ description: First 40 characters of the inline script that caused the violation >+ maxLength: 41 >+ sourceFile: >+ type: string >+ description: The URI of the script where the violation occurred >+ maxLength: 200 >+ statusCode: >+ type: integer >+ description: HTTP status code of the document >+ minimum: 0 >+ maximum: 999 >+additionalProperties: true >diff --git a/api/v1/swagger/definitions/csp_report_uri_to.yaml b/api/v1/swagger/definitions/csp_report_uri_to.yaml >index 4fb7f01779a..513f915b41a 100644 >--- a/api/v1/swagger/definitions/csp_report_uri_to.yaml >+++ b/api/v1/swagger/definitions/csp_report_uri_to.yaml >@@ -1,27 +1,27 @@ > --- >-type: object >+type: >+ - array >+ - object > description: | > A Content-Security-Policy violation report as sent by browsers. > See https://www.w3.org/TR/CSP3/#violation-reports for specification. > properties: > csp-report: > $ref: "csp_report.yaml" >+ age: >+ type: integer >+ minimum: 0 >+ maximum: 9999999999 > body: >- $ref: "csp_report.yaml" >+ $ref: "csp_report_body.yaml" > user_agent: > type: string > maxLength: 300 >- destination: >- type: string >- maxLength: 200 > url: > type: string > maxLength: 200 >- timestamp: >+ type: > type: string >- maxLength: 50 >- attempts: >- type: integer >- minimum: 0 >- maximum: 99 >+ enum: >+ - "csp-violation" > additionalProperties: true >diff --git a/t/db_dependent/api/v1/public/csp_reports.t b/t/db_dependent/api/v1/public/csp_reports.t >index 951322daf08..8cbfac4a88e 100755 >--- a/t/db_dependent/api/v1/public/csp_reports.t >+++ b/t/db_dependent/api/v1/public/csp_reports.t >@@ -50,7 +50,7 @@ subtest 'add() tests' => sub { > 'csp-report' => { > 'document-uri' => 'https://library.example.org/cgi-bin/koha/opac-main.pl', > 'referrer' => '', >- 'violated-directive' => "script-src 'self' 'nonce-abc123'", >+ 'violated-directive' => "script-src", > 'effective-directive' => 'script-src', > 'original-policy' => "default-src 'self'; script-src 'self' 'nonce-abc123'", > 'disposition' => 'enforce', >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968