158 Commits (09b14ceffcb5a552bb87fca38c307d2634411581)

Author	SHA1	Message	Date
Joas Schilling	2a0cda74d4	Use IQueryBuilder::PARAM_* instead of \PDO::PARAM_*	10 years ago
v1r0x	ec6e8c1ab6	fix unit test	10 years ago
Joas Schilling	599eb141b4	Make sure tests don't leave a stray directory behind	10 years ago
Lukas Reschke	809ff5ac95	Add public API to give developers the possibility to adjust the global CSP defaults ... Allows to inject something into the default content policy. This is for example useful when you're injecting Javascript code into a view belonging to another controller and cannot modify its Content-Security-Policy itself. Note that the adjustment is only applied to applications that use AppFramework controllers. To use this from your `app.php` use `\OC::$server->getContentSecurityPolicyManager()->addDefaultPolicy($policy)`, $policy has to be of type `\OCP\AppFramework\Http\ContentSecurityPolicy`. To test this add something like the following into an `app.php` of any enabled app: ``` $manager = \OC::$server->getContentSecurityPolicyManager(); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('asdf'); $policy->addAllowedScriptDomain('yolo.com'); $policy->allowInlineScript(false); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFontDomain('yolo.com'); $manager->addDefaultPolicy($policy); $policy = new \OCP\AppFramework\Http\ContentSecurityPolicy(false); $policy->addAllowedFrameDomain('banana.com'); $manager->addDefaultPolicy($policy); ``` If you now open the files app the policy should be: ``` Content-Security-Policy:default-src 'none';script-src yolo.com 'self' 'unsafe-eval';style-src 'self' 'unsafe-inline';img-src 'self' data: blob:;font-src yolo.com 'self';connect-src 'self';media-src 'self';frame-src asdf banana.com 'self' ```	10 years ago
Lukas Reschke	a977465af5	Add new CSRF manager for unit testing purposes ... This adds a new CSRF manager for unit testing purposes, it's interface is based upon https://github.com/symfony/security-csrf. Due to some of our required custom changes it is however not possible to use the Symfony component directly.	10 years ago
Roeland Jago Douma	07fd3889b1	Fix unit tests	10 years ago
Roeland Jago Douma	b2df7b6b8a	Fix unit test	10 years ago
Bernhard Posselt	23c754aed3	prefer scalar type hints over phpdoc annotation ... use method exists lookup to be safe and not break on old hhvm versions add test that checks if type hint is preferred over annotation	10 years ago
Scrutinizer Auto-Fixer	453e1bf66e	Scrutinizer Auto-Fixes ... This commit consists of patches automatically generated for this project on https://scrutinizer-ci.com	10 years ago
Lukas Reschke	f4eb15d340	Show error template ... Otherwise this leads to an endless redirection in case of a CSRF exception. Also sets user expectation right.	10 years ago
Thomas Müller	7e71d8231e	Mock DIContainer to not hit the database	10 years ago
Thomas Müller	3bb6dcea64	Apply DB group annotation ...	10 years ago
Robin Appelman	aa822f76e2	fix tests	10 years ago
Mitar	e0e51fd79f	Added tests.	10 years ago
Thomas Müller	358858c9e3	Fix undefined HTTP_USER_AGENT	10 years ago
Lukas Reschke	8133d46620	Remove dependency on ICrypto + use XOR	10 years ago
Lukas Reschke	80a232da6a	Add \OCP\IRequest::getHttpProtocol ... Only allow valid HTTP protocols. Ref https://github.com/owncloud/core/pull/19537#discussion_r41252333 + https://github.com/owncloud/security-tracker/issues/119	10 years ago
Lukas Reschke	e735a9915c	Add blob: scheme to default CSP policy ... Fixes https://github.com/owncloud/core/issues/19438	10 years ago
Robin McCorkell	ebe9bea709	Unit test for preventing warning decoding content	10 years ago
Jörn Friedrich Dreyer	ca8d589f27	use assertSame, add failing case	10 years ago
Lukas Reschke	0943781ccf	Rename data provider to avoid risky test warning ... ``` 06:49:56 There was 1 risky test: 06:49:56 06:49:56 1) OC\AppFramework\Http\JSONResponseTest::testRenderProvider 06:49:56 This test did not perform any assertions ```	10 years ago
Lukas Reschke	f9e90e92d4	Encode HTML tags in JSON ... While not encoding the HTML tags in the JSON response is perfectly fine since we set the proper mimetype as well as disable content sniffing a lot of automated code scanner do report this as security bug. Encoding them leads to less discussions and a lot of saved time.	10 years ago
Roeland Jago Douma	f12caf930e	Properly return 304 ... The ETag set in the IF_NONE_MODIFIED header is wraped in quotes ("). However the ETag that is set in response is not (yet). Also we need to cast the ETag to a string. * Added unit test	10 years ago
Lukas Reschke	8313a3fcb3	Add mitigation against BREACH ... While BREACH requires the following three factors to be effectively exploitable we should add another mitigation: 1. Application must support HTTP compression 2. Response most reflect user-controlled input 3. Response should contain sensitive data Especially part 2 is with ownCloud not really given since user-input is usually only echoed if a CSRF token has been passed. To reduce the risk even further it is however sensible to encrypt the CSRF token with a shared secret. Since this will change on every request an attack such as BREACH is not feasible anymore against the CSRF token at least.	11 years ago
sualko	5590d64612	add more unit tests for data: as allowed image domain	11 years ago
sualko	930841b67a	add unit test for data: as allowed image domain	11 years ago
Lukas Reschke	4efa7c09b1	Use StringUtils::equals on CSRF token and add unit tests	11 years ago
Thomas Müller	3ecf7fce79	Fix unit test within OCSController	11 years ago
Thomas Müller	649cc2fa89	Remove duplicate and unused code	11 years ago
Robin McCorkell	182bc17aeb	Sanitize class names before registerService/query ... Leading backslashes are removed, so a `registerService('\\OC\\Foo')` can still be resolved with `query('OC\\Foo')`.	11 years ago
Robin McCorkell	0223221a64	Fix incorrect test naming ... `tesOverrideService()` was incorrect and wasn't getting called by PHPUnit. Also, the unit test itself was wrong, but went unnoticed because of point 1.	11 years ago
Bernhard Posselt	d8673dabe3	add test for factories ... use ref for factory test use a factory for registerAlias Ensure we construct SimpleContainer Use single instance of DIContainer in routing tests	11 years ago
Lukas Reschke	7dda86f371	Return proper status code in case of a CORS exception ... When returning a 500 statuscode external applications may interpret this as an error instead of handling this more gracefully. This will now make return a 401 thus. Fixes https://github.com/owncloud/core/issues/17742	11 years ago
Bernhard Posselt	a4e3939204	add registerAlias method to shorcut interface registration ... remove unused import add since tag fix typo	11 years ago
Thomas Müller	bd71540c8a	Fixing 'Undefined index: REMOTE_ADDR' - fixes #17460	11 years ago
Lukas Reschke	62e3de1bdb	Check if response could get generated ... `json_encode` fails hard on PHP >= 5.5 if a non UTF-8 value is specified by returning false. Older PHP versions just nullify the value which makes it at least somewhat usable. This leads to very confusing errors which are very hard to debug since developers are usually not aware of this. In this case I'd consider throwing a fatal exception – since it arguably is an error situation – is a fair solution since this makes developers and administrators aware of any occurence of the problem so that these bugs can get fixed. Fixes https://github.com/owncloud/core/issues/17265	11 years ago
Lukas Reschke	4d23e06097	Fix undefined offset ... There are cases where no trusted host is specified such as when installing the instance, this lead to an undefined offset warning in the log right after installing. (when another domain than localhost or 127.0.0.1 was used)	11 years ago
Robin McCorkell	f1e3e25158	AppFramework annotation whitespace unit test	11 years ago
Lukas Reschke	34f5541088	Add `no-store` to AppFramework	11 years ago
Bernhard Posselt	21ce5d034b	fix #16713	11 years ago
Joas Schilling	d3e3a84cae	Move the helpful method to the TestCase class	11 years ago
Bernhard Posselt	c8e3599cad	disallow cookie auth for cors requests ... testing ... fixes fix test add php doc fix small mistake add another phpdoc remove not working cors annotations from files app	11 years ago
Lukas Reschke	a62190a72d	Add support for disallowing domains to the ContentSecurityPolicy ... For enhanced security it is important that there is also a way to disallow domains, including the default ones. With this commit every method gets added a new "disallow" function.	11 years ago
Bernhard Posselt	df24a014b8	If the execute method on the mapper receives an assoc array, it binds by value instead of index	11 years ago
Lukas Reschke	b29940d956	Add support for 'child-src' directive ... This is required when working with stuff such as PDF.js in the files_pdfviewer application. Opt-in only. Master change only because the stable CSP policies has a failback that allows nearly anything 🙈	11 years ago
Bernhard Posselt	95239ad21e	AppFramework StreamResponse ... First stab at the StreamResponse, see #12988 The idea is to use an interface ICallbackResponse (I'm not 100% happy with the name yet, suggestions?) that allow the response to output things in its own way, for instance stream the file using readfile Unittests are atm lacking, plan is to check if a mock of ICallbackResponse will be used by calling its callback (also unhappy with this name) method Usage is: $response = new StreamResponse('path/to/file'); rename io to output, add additional methods and handle error and not modified cases when using StreamResponse fix indention and uppercasing, also handle forbidden cases fix indention fix indention no forbidden, figuring out if a file is really readable is too complicated to get to work across OSes and streams remove useless import remove useless import fix intendation	11 years ago
Bernhard Posselt	f993ed823e	fix tabs and spaces	11 years ago
Bernhard Posselt	aaf753bc9a	fix mappertestutility	11 years ago
Bernhard Posselt	7b2fdbfb0b	use IDBConnection and close cursors after insert/update/delete	11 years ago
Lukas Reschke	1c6eae9017	Get the real protocol behind several proxies ... X-Forwarded-Proto contains a list of protocols if ownCloud is behind multiple reverse proxies. This is a revival of https://github.com/owncloud/core/pull/11157 using the new IRequest public API.	11 years ago