Bugzilla – Attachment 193311 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: Move default Content-Security-Policy value into Perl module
Bug-38365-Move-default-Content-Security-Policy-val.patch (text/plain), 10.93 KB, created by
David Cook
on 2026-02-17 05:54:09 UTC
(
hide
)
Description:
Bug 38365: Move default Content-Security-Policy value into Perl module
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-17 05:54:09 UTC
Size:
10.93 KB
patch
obsolete
>From 90e6cd48ba3390994e76850f3f1c47e641f0fd83 Mon Sep 17 00:00:00 2001 >From: David Cook <dcook@prosentient.com.au> >Date: Tue, 17 Feb 2026 05:31:35 +0000 >Subject: [PATCH] Bug 38365: Move default Content-Security-Policy value into > Perl module > >By defining a default policy in the Perl module, we can easily update >it over time. Using koha-conf.xml will just be for overrides, so people >can manage their own there. >--- > Koha/ContentSecurityPolicy.pm | 33 ++++++++++++++------- > debian/templates/koha-conf-site.xml.in | 40 +++++++++++++++++++------- > etc/koha-conf.xml | 40 +++++++++++++++++++------- > t/Koha/ContentSecurityPolicy.t | 11 +------ > 4 files changed, 81 insertions(+), 43 deletions(-) > >diff --git a/Koha/ContentSecurityPolicy.pm b/Koha/ContentSecurityPolicy.pm >index d112b586154..306af6f4fb4 100644 >--- a/Koha/ContentSecurityPolicy.pm >+++ b/Koha/ContentSecurityPolicy.pm >@@ -88,11 +88,10 @@ sub header_name { > > my $conf_csp = $self->{config}->get('content_security_policy'); > >- Koha::Exceptions::Config::MissingEntry->throw( error => 'Missing request content_security_policy csp_header_value' ) >- unless exists $conf_csp->{$interface}->{csp_mode}; >- >- return 'Content-Security-Policy-Report-Only' if $conf_csp->{$interface}->{csp_mode} eq 'report-only'; >- return 'Content-Security-Policy' if $conf_csp->{$interface}->{csp_mode} eq 'enabled'; >+ if ( $conf_csp && $conf_csp->{$interface} && $conf_csp->{$interface}->{csp_mode} ) { >+ return 'Content-Security-Policy-Report-Only' if $conf_csp->{$interface}->{csp_mode} eq 'report-only'; >+ return 'Content-Security-Policy' if $conf_csp->{$interface}->{csp_mode} eq 'enabled'; >+ } > > Koha::Exceptions::Config::MissingEntry->throw( > error => 'Content Security Policy is disabled. Header name should only be retrieved when CSP is enabled.' ); >@@ -112,8 +111,6 @@ sub header_name { > > Returns content_security_policy.[opac|staff].csp_header_value > >- Throws Koha::Exceptions::Config::MissingEntry is CSP property "csp_header_value" is missing in KOHA_CONF >- > =cut > > sub header_value { >@@ -121,15 +118,29 @@ sub header_value { > > my $interface = $args->{interface} || C4::Context->interface; > >+ my @default_policy_lines = ( >+ q#default-src 'self'#, >+ q# script-src 'self' 'nonce-_CSP_NONCE_'#, >+ q# style-src 'self' 'nonce-_CSP_NONCE_'#, >+ q# style-src-attr 'unsafe-inline'#, >+ q# img-src 'self' data:#, >+ q# font-src 'self'#, >+ q# object-src 'none'#, >+ ); >+ my $default_policy = join( ';', @default_policy_lines ); >+ > my $conf_csp = $self->{config}->get('content_security_policy'); > >- Koha::Exceptions::Config::MissingEntry->throw( error => 'Missing request content_security_policy csp_header_value' ) >- unless exists $conf_csp->{$interface}->{csp_header_value}; >+ my $user_policy = $conf_csp->{$interface}->{csp_header_value}; >+ >+ my $csp_policy = ($user_policy) ? $user_policy : $default_policy; > >- my $csp_header_value = $conf_csp->{$interface}->{csp_header_value}; >+ my $csp_header_value = $csp_policy; > my $csp_nonce = $self->get_nonce; > >- $csp_header_value =~ s/_CSP_NONCE_/$csp_nonce/g; >+ if ($csp_nonce) { >+ $csp_header_value =~ s/_CSP_NONCE_/$csp_nonce/g; >+ } > > return $csp_header_value; > } >diff --git a/debian/templates/koha-conf-site.xml.in b/debian/templates/koha-conf-site.xml.in >index 9b09b89ecf2..88845b246d7 100644 >--- a/debian/templates/koha-conf-site.xml.in >+++ b/debian/templates/koha-conf-site.xml.in >@@ -514,21 +514,39 @@ __END_SRU_PUBLICSERVER__ > csp_header_value: The CSP policy directives. Special placeholders: > - _CSP_NONCE_: Replaced with a unique nonce for each request > >- Recommended workflow: >- 1. Start with report-only mode to identify violations >- 2. Review logs and fix any legitimate violations >- 3. Switch to enabled mode once violations are resolved >+ NOTE: Koha comes with a hard-coded csp_header_value. You only need to define your own >+ csp_header_value if you want or need a different Content-Security-Policy value. >+ >+ To enable violation reporting, create your own csp_header_value including >+ 'report-to' pointing to csp-violations and add 'report-uri'. >+ >+ NOTE: You must be using HTTPS to receive violation reports. > >- To enable violation reporting, add report-to to your policy pointing to csp-violations. > Example with reporting: >- <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> >+ <content_security_policy> >+ <opac> >+ <csp_mode>report-only</csp_mode> >+ <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> >+ </opac> >+ <intranet> >+ <csp_mode>report-only</csp_mode> >+ <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> >+ </intranet> >+ </content_security_policy> > > Reports are logged via Koha's logging system. Configure log4perl to capture them: >- log4perl.logger.api.csp = WARN, CSP >- log4perl.appender.CSP = Log::Log4perl::Appender::File >- log4perl.appender.CSP.filename = /var/log/koha/__KOHASITE__/csp-violations.log >- log4perl.appender.CSP.layout = PatternLayout >- log4perl.appender.CSP.layout.ConversionPattern = [%d] %m%n >+ log4perl.logger.plack-csp = WARN, PLACKCSP >+ log4perl.appender.PLACKCSP=Log::Log4perl::Appender::File >+ log4perl.appender.PLACKCSP.filename=/var/log/koha/<kohasite>/plack-csp-violations.log >+ log4perl.appender.PLACKCSP.mode=append >+ log4perl.appender.PLACKCSP.layout=PatternLayout >+ log4perl.appender.PLACKCSP.layout.ConversionPattern=[%d] %m%n >+ log4perl.appender.PLACKCSP.utf8=1 >+ >+ Recommended workflow: >+ 1. Start with report-only mode to identify violations >+ 2. Review logs and fix any legitimate violations (by fixing the code or by modifying your csp_header_value) >+ 3. Switch to enabled mode once violations are resolved > --> > <content_security_policy> > <opac> >diff --git a/etc/koha-conf.xml b/etc/koha-conf.xml >index 97108498fd9..5ef7295b566 100644 >--- a/etc/koha-conf.xml >+++ b/etc/koha-conf.xml >@@ -325,21 +325,39 @@ > csp_header_value: The CSP policy directives. Special placeholders: > - _CSP_NONCE_: Replaced with a unique nonce for each request > >- Recommended workflow: >- 1. Start with report-only mode to identify violations >- 2. Review logs and fix any legitimate violations >- 3. Switch to enabled mode once violations are resolved >+ NOTE: Koha comes with a hard-coded csp_header_value. You only need to define your own >+ csp_header_value if you want or need a different Content-Security-Policy value. >+ >+ To enable violation reporting, create your own csp_header_value including >+ 'report-to' pointing to csp-violations and add 'report-uri'. >+ >+ NOTE: You must be using HTTPS to receive violation reports. > >- To enable violation reporting, add report-to to your policy pointing csp-violations. > Example with reporting: >- <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> >+ <content_security_policy> >+ <opac> >+ <csp_mode>report-only</csp_mode> >+ <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> >+ </opac> >+ <intranet> >+ <csp_mode>report-only</csp_mode> >+ <csp_header_value>default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'; report-uri /api/v1/public/csp-reports; report-to csp-violations</csp_header_value> >+ </intranet> >+ </content_security_policy> > > Reports are logged via Koha's logging system. Configure log4perl to capture them: >- log4perl.logger.api.csp = WARN, CSP >- log4perl.appender.CSP = Log::Log4perl::Appender::File >- log4perl.appender.CSP.filename = /var/log/koha/csp-violations.log >- log4perl.appender.CSP.layout = PatternLayout >- log4perl.appender.CSP.layout.ConversionPattern = [%d] %m%n >+ log4perl.logger.plack-csp = WARN, PLACKCSP >+ log4perl.appender.PLACKCSP=Log::Log4perl::Appender::File >+ log4perl.appender.PLACKCSP.filename=/var/log/koha/<kohasite>/plack-csp-violations.log >+ log4perl.appender.PLACKCSP.mode=append >+ log4perl.appender.PLACKCSP.layout=PatternLayout >+ log4perl.appender.PLACKCSP.layout.ConversionPattern=[%d] %m%n >+ log4perl.appender.PLACKCSP.utf8=1 >+ >+ Recommended workflow: >+ 1. Start with report-only mode to identify violations >+ 2. Review logs and fix any legitimate violations (by fixing the code or by modifying your csp_header_value) >+ 3. Switch to enabled mode once violations are resolved > --> > <content_security_policy> > <opac> >diff --git a/t/Koha/ContentSecurityPolicy.t b/t/Koha/ContentSecurityPolicy.t >index b24f26e9acf..ef7ce71589a 100755 >--- a/t/Koha/ContentSecurityPolicy.t >+++ b/t/Koha/ContentSecurityPolicy.t >@@ -117,22 +117,13 @@ subtest 'header_name tests' => sub { > }; > > subtest 'header_value tests' => sub { >- plan tests => 6; >+ plan tests => 3; > > t::lib::Mocks::mock_config( $conf_csp_section, {} ); > C4::Context->interface('opac'); > > my $csp = Koha::ContentSecurityPolicy->new; > >- throws_ok { $csp->header_value } 'Koha::Exceptions::Config::MissingEntry', >- 'Exception thrown when missing csp_header_value'; >- >- t::lib::Mocks::mock_config( $conf_csp_section, { opac => {} } ); >- throws_ok { $csp->header_value } 'Koha::Exceptions::Config::MissingEntry', >- 'Exception thrown when missing csp_header_value'; >- >- t::lib::Mocks::mock_config( $conf_csp_section, { opac => { csp_header_value => '' } } ); >- is( $csp->header_value, '', 'Even an empty csp_header_value is retrieved form koha-conf.xml' ); > t::lib::Mocks::mock_config( $conf_csp_section, { opac => { csp_header_value => 'some value' } } ); > is( $csp->header_value, 'some value', 'csp_header_value is retrieved from koha-conf.xml' ); > >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968