From 8cfe83edee1e6bf28a12ad553bc9a459e592bdfc Mon Sep 17 00:00:00 2001
From: Salih <salihozkara00@gmail.com>
Date: Mon, 29 May 2023 12:38:49 +0300
Subject: [PATCH] Prevent breaking change

---
 .../Security/AbpSecurityHeadersMiddleware.cs  | 27 +++++++------------
 .../Security/AbpSecurityHeadersOptions.cs     |  5 ++--
 2 files changed, 12 insertions(+), 20 deletions(-)

diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
index 5e20edff17..c9b0738619 100644
--- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersMiddleware.cs
@@ -101,35 +101,28 @@ public class AbpSecurityHeadersMiddleware : IMiddleware, ITransientDependency
 
     protected virtual string BuildContentSecurityPolicyValue(HttpContext context)
     {
+        var cspValue = Options.Value.ContentSecurityPolicyValue.IsNullOrWhiteSpace() ? DefaultValue : Options.Value.ContentSecurityPolicyValue;
         if (!(Options.Value.UseContentSecurityPolicyScriptNonce &&
               context.Items.TryGetValue(AbpAspNetCoreConsts.ScriptNonceKey, out var nonce) &&
               nonce is string nonceValue && !string.IsNullOrEmpty(nonceValue)))
         {
-            return ContentSecurityPolicyValuesToCSPString();
+            return cspValue;
         }
 
-        var scriptSrcValue = "";
-        if (Options.Value.ContentSecurityPolicyValues.TryGetValue(ScriptSrcKey, out var scriptSrc))
-        {
-            scriptSrcValue = string.Join(" ", scriptSrc);
-        }
-
-        scriptSrcValue += $" 'nonce-{nonceValue}'";
+        var nonceStr = $" 'nonce-{nonceValue}'";
 
-        return ContentSecurityPolicyValuesToCSPString(true) + $"; {ScriptSrcKey} {scriptSrcValue}";
-    }
+        var scriptSrcValue = Options.Value.ContentSecurityPolicyValue.Split(';')
+            .FirstOrDefault(x => x.Trim().StartsWith(ScriptSrcKey))?.Trim();
 
-    protected virtual string ContentSecurityPolicyValuesToCSPString(bool ignoreScriptSrc = false)
-    {
-        if (Options.Value.ContentSecurityPolicyValues.Any())
+        if (scriptSrcValue.IsNullOrWhiteSpace())
         {
-            return string.Join("; ",
-                Options.Value.ContentSecurityPolicyValues.WhereIf(ignoreScriptSrc, x => x.Key != ScriptSrcKey)
-                    .Select(x => $"{x.Key} {string.Join(" ", x.Value)}"));
+            return cspValue.EnsureEndsWith(';') + $" {ScriptSrcKey}{nonceStr};";
         }
 
-        return DefaultValue;
+        var newScriptSrcValue = scriptSrcValue + nonceStr;
+        return Options.Value.ContentSecurityPolicyValue.Replace(scriptSrcValue, newScriptSrcValue);
     }
+    
 
     protected virtual void AddHeader(HttpContext context, string key, string value, bool overrideIfExists = false)
     {
diff --git a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
index 427aa9ad9a..9a0bb5cd82 100644
--- a/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
+++ b/framework/src/Volo.Abp.AspNetCore/Volo/Abp/AspNetCore/Security/AbpSecurityHeadersOptions.cs
@@ -10,8 +10,8 @@ public class AbpSecurityHeadersOptions
     public bool UseContentSecurityPolicyHeader { get; set; }
     
     public bool UseContentSecurityPolicyScriptNonce { get; set; }
-
-    public Dictionary<string, IEnumerable<string>> ContentSecurityPolicyValues { get; }
+    
+    public string ContentSecurityPolicyValue { get; set; }
 
     public Dictionary<string, string> Headers { get; }
     
@@ -22,7 +22,6 @@ public class AbpSecurityHeadersOptions
     public AbpSecurityHeadersOptions()
     {
         Headers = new Dictionary<string, string>();
-        ContentSecurityPolicyValues = new Dictionary<string, IEnumerable<string>>();
         IgnoredScriptNonceSelectors = new List<Func<HttpContext, Task<bool>>>();
         IgnoredScriptNoncePaths = new List<string>();
     }