feat: Add CSP registry for unsafe inline scripts

This provides a registry for registering unsafe inline scripts.
Their hashes will be added to the "script-src" part of the
Content-Security-Policy header.

Author: paxuclus

…ware/ContentSecurityPolicyMiddleware.php …licy/ContentSecurityPolicyMiddleware.phpClasses/Http/Middleware/ContentSecurityPolicyMiddleware.php renamed to Classes/ContentSecurityPolicy/ContentSecurityPolicyMiddleware.php Classes/Http/Middleware/ContentSecurityPolicyMiddleware.php renamed to Classes/ContentSecurityPolicy/ContentSecurityPolicyMiddleware.php

@@ -2,7 +2,7 @@
 
 declare(strict_types=1);
 
-namespace Netlogix\Sentry\Http\Middleware;
+namespace Netlogix\Sentry\ContentSecurityPolicy;
 
 use GuzzleHttp\Psr7\Uri;
 use Neos\Flow\Annotations as Flow;
@@ -26,6 +26,9 @@ class ContentSecurityPolicyMiddleware implements MiddlewareInterface
     #[Flow\InjectConfiguration(path: 'csp.headers.parts')]
     protected array $parts = [];
 
+    #[Flow\Inject]
+    protected Registry $registry;
+
     public function process(ServerRequestInterface $request, RequestHandlerInterface $handler): ResponseInterface
     {
         $response = $handler->handle($request);
@@ -53,13 +56,27 @@ protected function addContentSecurityPolicy(
             $headerName = 'Content-Security-Policy';
         }
 
+        $parts = $this->parts;
+        if ($this->registry->getSafeInlineScriptHashes() !== []) {
+            $safeInlineScripts = join(
+                ' ',
+                array_map(fn (string $hash) => sprintf("'%s'", $hash), $this->registry->getSafeInlineScriptHashes())
+            );
+            $existingScriptSrc = array_find_key($parts, fn (string $part) => str_starts_with($part, 'script-src'));
+
+            if ($existingScriptSrc !== null) {
+                $parts[$existingScriptSrc] = $parts[$existingScriptSrc] . ' ' . $safeInlineScripts;
+            } else {
+                $parts[] = 'script-src ' . $safeInlineScripts;
+            }
+        }
+
         $defaultParts = [
             'report-uri ' . $this->reportingEndpoint($request),
             'report-to csp-endpoint'
         ];
 
-        // TODO: Add support for nonces
-        $parts = array_merge($this->parts, $defaultParts);
+        $parts = array_merge($parts, $defaultParts);
 
         return $response
             ->withHeader($headerName, trim(join('; ', $parts), "; \n\r\t\v\0"));

Classes/ContentSecurityPolicy/Registry.php

@@ -0,0 +1,42 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Netlogix\Sentry\ContentSecurityPolicy;
+
+use Neos\Eel\ProtectedContextAwareInterface;
+use Neos\Flow\Annotations as Flow;
+
+/**
+ * @Flow\Scope("singleton")
+ */
+#[Flow\Scope('singleton')]
+class Registry implements ProtectedContextAwareInterface
+{
+    protected static array $safeInlineScriptHashes = [];
+
+    /**
+     * Registers a safe inline script from the provided source.
+     *
+     * @param string $script The script content that needs to be registered as a safe inline script.
+     * @param string $algorithm The algorithm to use for hashing the script content (default: sha256)
+     * @return string The trimmed script content is returned
+     */
+    public function registerSafeInlineScriptFromSource(string $script, string $algorithm = 'sha256'): string
+    {
+        $hash = base64_encode(hash($algorithm, $script, true));
+        self::$safeInlineScriptHashes[] = sprintf('%s-%s', $algorithm, $hash);
+
+        return $script;
+    }
+
+    public function getSafeInlineScriptHashes(): array
+    {
+        return self::$safeInlineScriptHashes;
+    }
+
+    public function allowsCallOfMethod($methodName): bool
+    {
+        return true;
+    }
+}

Configuration/Settings.Eel.yaml

@@ -0,0 +1,5 @@
+Neos:
+  # Fusion might not be installed, but adding the Registry to the defaultContext won't hurt
+  Fusion:
+    defaultContext:
+      'Netlogix.CspRegistry': 'Netlogix\Sentry\ContentSecurityPolicy\Registry'

Configuration/Settings.Middleware.yaml

@@ -4,4 +4,4 @@ Neos:
       middlewares:
         'nlxSentryContentSecurityPolicy':
           position: 'before dispatch'
-          middleware: 'Netlogix\Sentry\Http\Middleware\ContentSecurityPolicyMiddleware'
+          middleware: 'Netlogix\Sentry\ContentSecurityPolicy\ContentSecurityPolicyMiddleware'