Fossil

Differences From Artifact [5dc16b2eae]:

• File src/style.c — part of check-in [c515e5fd9f] at 2020-08-24 22:20:00 on branch misc-js-experiments — Moved C routines which emit fossil.XYZ JS APIs from style.c to builtin.c, and renamed appropriately. Added flag to output_text_with_line_numbers() to disable emit of JS (needed for fileedit preview, at a minimum). The experimental emitting of all fossil.XYZ APIs at once is now limited to bundled mode, as that's the only place it's potentially of benefit. (user: stephan size: 44185) [more...]

To Artifact [7cdb68cd36]:

• File src/style.c — part of check-in [e0f2283c15] at 2020-09-03 19:04:02 on branch trunk — Make sure that any newlines in the CSP are converted into simple spaces before the CSP is added to an HTTP header. This *might* fix a problem reported [forum:/info/d29e3af43c|on the forum]. (user: drh size: 44411)

524
525
526
527
528
529
530

531
532
533
534
535
536
537
538
539
540
541



542
543
544
545
546
547
548

   "default-src 'self' data:; "
   "script-src 'self' 'nonce-$nonce'; "
   "style-src 'self' 'unsafe-inline'";
  const char *zFormat = db_get("default-csp","");
  Blob csp;
  char *zNonce;
  char *zCsp;

  if( zFormat[0]==0 ){
    zFormat = zBackupCSP;
  }
  blob_init(&csp, 0, 0);
  while( zFormat[0] && (zNonce = strstr(zFormat,"$nonce"))!=0 ){
    blob_append(&csp, zFormat, (int)(zNonce - zFormat));
    blob_append(&csp, style_nonce(), -1);
    zFormat = zNonce + 6;
  }
  blob_append(&csp, zFormat, -1);
  zCsp = blob_str(&csp);



  if( toHeader ){
    cgi_printf_header("Content-Security-Policy: %s\r\n", zCsp);
  }
  return zCsp;
}

/*

>











>
>
>

524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552

   "default-src 'self' data:; "
   "script-src 'self' 'nonce-$nonce'; "
   "style-src 'self' 'unsafe-inline'";
  const char *zFormat = db_get("default-csp","");
  Blob csp;
  char *zNonce;
  char *zCsp;
  int i;
  if( zFormat[0]==0 ){
    zFormat = zBackupCSP;
  }
  blob_init(&csp, 0, 0);
  while( zFormat[0] && (zNonce = strstr(zFormat,"$nonce"))!=0 ){
    blob_append(&csp, zFormat, (int)(zNonce - zFormat));
    blob_append(&csp, style_nonce(), -1);
    zFormat = zNonce + 6;
  }
  blob_append(&csp, zFormat, -1);
  zCsp = blob_str(&csp);
  /* No whitespace other than actual space characters allowed in the CSP
  ** string.  See https://fossil-scm.org/forum/forumpost/d29e3af43c */
  for(i=0; zCsp[i]; i++){ if( fossil_isspace(zCsp[i]) ) zCsp[i] = ' '; }
  if( toHeader ){
    cgi_printf_header("Content-Security-Policy: %s\r\n", zCsp);
  }
  return zCsp;
}

/*