From 5a513c924fbb82cfdf360c9837ba88a73e5a66a4 Mon Sep 17 00:00:00 2001 From: Ferdinand Thiessen Date: Fri, 22 Mar 2024 16:03:29 +0100 Subject: [PATCH] fix(CSP): Add CSP nonce by default and convert `browserSupportsCspV3` to blocklist Signed-off-by: Ferdinand Thiessen --- .../CSP/ContentSecurityPolicyNonceManager.php | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php index 6dbf86e5c8818..827ceda7f9362 100644 --- a/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php +++ b/lib/private/Security/CSP/ContentSecurityPolicyNonceManager.php @@ -65,17 +65,14 @@ public function getNonce(): string { * Check if the browser supports CSP v3 */ public function browserSupportsCspV3(): bool { - $browserWhitelist = [ - Request::USER_AGENT_CHROME, - Request::USER_AGENT_FIREFOX, - Request::USER_AGENT_SAFARI, - Request::USER_AGENT_MS_EDGE, + $browserBlocklist = [ + Request::USER_AGENT_IE, ]; - if ($this->request->isUserAgent($browserWhitelist)) { - return true; + if ($this->request->isUserAgent($browserBlocklist)) { + return false; } - return false; + return true; } }