Summary of Changes

Implement a hashbased whitelist for com_csp / plg_http_httpheaders as requested by @SniperSister

Testing Instructions

• apply this patch
• System -> Manage -> Content Security Policy -> Options
• Enable the detect mode.
• navigate the frontend and backend
• System -> Manage -> Content Security Policy
• publish all rules
• System -> Manage -> Content Security Policy -> Options
• change the mode to "Automatic"
• check the header set by the app using the browser console network tab (hint check the first request you can see for the header)
• System -> Manage -> Content Security Policy -> Options
• enable the new script hashes and style hashes option
• check the header again.

Expected result

New options for script and style hashes implemented

Actual result

No options for script and style hashes implemented

Documentation Changes Required

This needs to be documented.

Known limitation

Please note that this here is indeed feature complete in order to work out of the box any inline style / script needs to be converted to a script running from a file. This is not the case with at least the current backend template so there are still some errors in the console but 90% of the features still work the other just needs to be moved to pass the required inline scripts via the joomla api. This is also true for any other template or extension.

Open points

-[ ] en-GB review of the new language strings

@brianteeman can you please take a look into the new language strings whether they makes sense or can be improved? Thanks.

Acknowledgements

Thanks @SniperSister for suggesting the implementation of hashbased whitelists in order to overcome the limitations of the nonce and the usage of unsafe-inline.