How to correctly set CSP?

anon30676603 · September 16, 2016, 10:53am

Hi,

if you grep through the code of ownCloud you will find the location where this is set:

lib/private/legacy/response.php

v9.1.0


      
          	/**
          	 * This function adds some security related headers to all requests served via base.php
          	 * The implementation of this function has to happen here to ensure that all third-party
          	 * components (e.g. SabreDAV) also benefit from this headers.
          	 */
          	public static function addSecurityHeaders() {
          		/**
          		 * FIXME: Content Security Policy for legacy ownCloud components. This
          		 * can be removed once \OCP\AppFramework\Http\Response from the AppFramework
          		 * is used everywhere.
          		 * @see \OCP\AppFramework\Http\Response::getHeaders
          		 */
          		$policy = 'default-src \'self\'; '
          			. 'script-src \'self\' \'unsafe-eval\'; '
          			. 'style-src \'self\' \'unsafe-inline\'; '
          			. 'frame-src *; '
          			. 'img-src * data: blob:; '
          			. 'font-src \'self\' data:; '
          			. 'media-src *; ' 
          			. 'connect-src *';
          		header('Content-Security-Policy:' . $policy);