From 7265f73abfa8e231f159afd684053e7805b37182 Mon Sep 17 00:00:00 2001 From: Salih Date: Thu, 4 May 2023 16:42:55 +0300 Subject: [PATCH 001/127] Added script nonce --- .../TagHelpers/AbpTagHelperScriptService.cs | 5 +++- .../Abp/AspNetCore/AbpAspNetCoreConsts.cs | 1 + .../Security/AbpSecurityHeadersMiddleware.cs | 25 ++++++++++++++++--- .../Security/AbpSecurityHeadersOptions.cs | 5 +++- 4 files changed, 31 insertions(+), 5 deletions(-) diff --git a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpTagHelperScriptService.cs b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpTagHelperScriptService.cs index 8715dd2f29..260f28f812 100644 --- a/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpTagHelperScriptService.cs +++ b/framework/src/Volo.Abp.AspNetCore.Mvc.UI.Bundling/Volo/Abp/AspNetCore/Mvc/UI/Bundling/TagHelpers/AbpTagHelperScriptService.cs @@ -49,6 +49,9 @@ public class AbpTagHelperScriptService : AbpTagHelperResourceService var deferText = (defer || Options.DeferScriptsByDefault || Options.DeferScripts.Any(x => file.StartsWith(x, StringComparison.OrdinalIgnoreCase))) ? "defer" : string.Empty; - output.Content.AppendHtml($"{Environment.NewLine}"); + var nonceText = (viewContext.HttpContext.Items.TryGetValue(AbpAspNetCoreConsts.ScriptNonceKey, out var nonce) && nonce is string nonceString && !string.IsNullOrEmpty(nonceString)) + ? $"nonce=\"{nonceString}\"" + : string.Empty; + output.Content.AppendHtml($"{Environment.NewLine}"); } } diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/AbpAspNetCoreConsts.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/AbpAspNetCoreConsts.cs index dff987b6b3..134889324e 100644 --- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/AbpAspNetCoreConsts.cs +++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/AbpAspNetCoreConsts.cs @@ -4,4 +4,5 @@ public static class AbpAspNetCoreConsts { public const string DefaultApiPrefix = "api"; public const string DefaultIntegrationServiceApiPrefix = "integration-api"; + public const string ScriptNonceKey = "ScriptNonce"; } \ No newline at end of file diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs index 29e05b9bdc..c24d412fd0 100644 --- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs +++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs @@ -1,5 +1,6 @@ using System; using System.Collections.Generic; +using System.Linq; using System.Threading.Tasks; using Microsoft.AspNetCore.Http; using Microsoft.Extensions.Options; @@ -27,13 +28,31 @@ public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency /*The X-Frame-Options HTTP response header can be used to indicate whether or not a browser should be allowed to render a page in a ,