TYPO3 v15 dev-main snapshot ()

2026-08-10 22:31:31 +02:00
commit 3e43c11539
407 changed files with 51272 additions and 0 deletions
@@ -0,0 +1,77 @@
+<?php
+
+declare(strict_types=1);
+
+/*
+ * This file is part of the TYPO3 CMS project.
+ *
+ * It is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU General Public License, either version 2
+ * of the License, or any later version.
+ *
+ * For the full copyright and license information, please read the
+ * LICENSE.txt file that was distributed with this source code.
+ *
+ * The TYPO3 project - inspiring people to share!
+ */
+
+namespace TYPO3\CMS\Install\SystemEnvironment\ServerResponse;
+
+/**
+ * Evaluates a Content-Security-Policy HTTP header.
+ *
+ * @internal should only be used from within TYPO3 Core
+ */
+class ContentSecurityPolicyHeader
+{
+    protected const HEADER_PATTERN = '#(?<directive>default-src|script-src|style-src|object-src)\h+(?<rule>[^;]+)(?:\s*;\s*|$)#';
+
+    /**
+     * @var ContentSecurityPolicyDirective[]
+     */
+    protected $directives = [];
+
+    public function __construct(string $header)
+    {
+        if (preg_match_all(self::HEADER_PATTERN, $header, $matches)) {
+            foreach ($matches['directive'] as $index => $name) {
+                $this->directives[$name] = new ContentSecurityPolicyDirective(
+                    $name,
+                    $matches['rule'][$index]
+                );
+            }
+        }
+    }
+
+    public function isEmpty(): bool
+    {
+        return empty($this->directives);
+    }
+
+    public function mitigatesCrossSiteScripting(?string $fileName = null): bool
+    {
+        $isSvg = str_ends_with($fileName ?? '', '.svg');
+        $defaultSrc = isset($this->directives['default-src'])
+            ? $this->directiveMitigatesCrossSiteScripting($this->directives['default-src'])
+            : null;
+        $scriptSrc = isset($this->directives['script-src'])
+            ? $this->directiveMitigatesCrossSiteScripting($this->directives['script-src'])
+            : null;
+        $styleSrc = isset($this->directives['style-src'])
+            ? $this->directiveMitigatesCrossSiteScripting($this->directives['style-src'])
+                || ($isSvg && $this->directives['style-src']->hasInstructions('unsafe-inline'))
+            : null;
+        $objectSrc = isset($this->directives['object-src'])
+            ? $this->directiveMitigatesCrossSiteScripting($this->directives['object-src'])
+            : null;
+        return ($scriptSrc ?? $defaultSrc ?? false)
+            && ($styleSrc ?? $defaultSrc ?? false)
+            && ($objectSrc ?? $defaultSrc ?? false);
+    }
+
+    protected function directiveMitigatesCrossSiteScripting(ContentSecurityPolicyDirective $directive): bool
+    {
+        return $directive->hasInstructions('none')
+            && !$directive->hasInstructions('unsafe-eval', 'unsafe-inline');
+    }
+}