d7csp.module

<?php

/**
 * @file
 * Implement hooks and callbacks for the d7csp module.
 */

/**
 * Generate a nonce for the current page load.
 */
function d7csp_nonce(): string {
  $nonce = &drupal_static(__FUNCTION__);
  if (!$nonce) {
    $nonce = drupal_random_key(16);
  }
  return $nonce;
}

/**
 * Implements hook_element_info_alter().
 */
function d7csp_element_info_alter(&$type) {
  $type['scripts']['#pre_render'][] = 'd7csp_pre_render_scripts';
}

/**
 * Callback for #pre_render on scripts.
 *
 * Add a nonce attribute to the script tag.
 */
function d7csp_pre_render_scripts(array $elements) {
  if (current_path() == 'system/ajax') {
    return $elements;
  }
  $nonce = d7csp_nonce();
  foreach (['scripts', 'settings'] as $type) {
    foreach (element_children($elements[$type]) as $key) {
      $elements[$type][$key]['#attributes']['nonce'] = $nonce;
    }
  }
  return $elements;
}

/**
 * Collect all hosts configured by modules and themes.
 *
 * @return array
 */
function d7csp_hosts(){
  $hosts = &drupal_static(__FUNCTION__);
  if (is_null($hosts )) {
    $hosts = module_invoke_all('d7csp_hosts');
    drupal_alter('d7csp_hosts', $hosts);
  }
  return $hosts;
}

/**
 * Implements hook_d7csp_hosts().
 */
function d7csp_d7csp_hosts(): array {
  $hosts['script-src'][] = "'nonce-" . d7csp_nonce() . "'";
  return $hosts;
}

/**
 * Implements hook_seckit_options_alter().
 */
function d7csp_seckit_options_alter(array &$options) {
  $csp = &$options['seckit_xss']['csp'];
  $hosts = d7csp_hosts();
  // Merge all configured src-directives with the hook-defined hosts.
  foreach ($csp as $directive => $config) {
    if (substr($directive, -4) != '-src') {
      continue;
    }
    $seckit_hosts = array_filter(explode(' ', $config));
    $hosts[$directive] = array_merge($seckit_hosts, $hosts[$directive] ?? []);
  }
  // Merge default-src into all other src-directives.
  foreach ($hosts as $directive => $host_list) {
    if ($directive != 'default-src') {
      $hosts[$directive] = array_merge($hosts['default-src'], $host_list);
    }
  }
  // Put everything back together.
  foreach ($hosts as $directive => $host_list) {
    $csp[$directive] = ' ' . implode(' ', array_unique($host_list));
  }
}

/**
 * Implements hook_html_head_alter().
 */
function d7csp_html_head_alter(array &$head_elements) {
  $nonce = d7csp_nonce();
  foreach ($head_elements as &$element) {
    if (($element['#tag'] ?? '') == 'script') {
      $element['#attributes']['nonce'] = $nonce;
    }
  }
}

/**
 * Implements hook_filter_info().
 */
function d7csp_filter_info() {
  $filters = [];
  $filters['d7csp_add_nonce'] = [
    'title' => t('Add CSP nonces'),
    'description' => t('Add a nonce to all script tags.'),
    'process callback' => 'd7csp_filter_add_nonce',
    'tips callback' => 'd7csp_filter_tips',
  ];
  return $filters;
}

/**
 * Callback for d7csp_add_nonce filter.
 */
function d7csp_filter_tips($filter, $format, $long = FALSE) {
  return t('Put this at the end after markup has been generated.');
}

/**
 * Add nonces to all script tags.
 *
 * Callback for d7csp_add_nonce filter.
 */
function d7csp_filter_add_nonce($text) {
  $nonce = d7csp_nonce();
  return preg_replace('/<script/', '<script nonce="' . $nonce . '"', $text);
}

if (module_exists('wysiwyg')) {
  require_once 'modules/wysiwyg.php';
}