add csp listener to run csp->addAllowedWorkerSrcDomain('blob:')

Signed-off-by: Julien Veyssier <[email protected]>

lib/AppInfo/Application.php

@@ -14,6 +14,7 @@
 use OCA\Cospend\Capabilities;
 use OCA\Cospend\Dashboard\CospendWidget;
 use OCA\Cospend\Federation\CloudFederationProviderCospend;
+use OCA\Cospend\Listener\CSPListener;
 use OCA\Cospend\Middleware\FederationMiddleware;
 use OCA\Cospend\Middleware\PublicAuthMiddleware;
 use OCA\Cospend\Middleware\UserPermissionMiddleware;
@@ -28,6 +29,7 @@
 use OCP\Federation\ICloudFederationProvider;
 use OCP\Federation\ICloudFederationProviderManager;
 use OCP\IConfig;
+use OCP\Security\CSP\AddContentSecurityPolicyEvent;
 use OCP\Server;
 use OCP\Util;
 
@@ -117,6 +119,7 @@ public function register(IRegistrationContext $context): void {
 		$context->registerMiddleware(FederationMiddleware::class);
 
 		$context->registerCapability(Capabilities::class);
+		$context->registerEventListener(AddContentSecurityPolicyEvent::class, CSPListener::class);
 	}
 
 	public function boot(IBootContext $context): void {

lib/Listener/CSPListener.php

@@ -0,0 +1,30 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\Cospend\Listener;
+
+use OCP\AppFramework\Http\ContentSecurityPolicy;
+use OCP\EventDispatcher\Event;
+use OCP\EventDispatcher\IEventListener;
+use OCP\Security\CSP\AddContentSecurityPolicyEvent;
+
+/**
+ * @template-implements IEventListener<AddContentSecurityPolicyEvent>
+ */
+class CSPListener implements IEventListener {
+
+	public function __construct(
+	) {
+	}
+
+	public function handle(Event $event): void {
+		if (!($event instanceof AddContentSecurityPolicyEvent)) {
+			return;
+		}
+
+		$csp = new ContentSecurityPolicy();
+		$csp->addAllowedWorkerSrcDomain('blob:');
+		$event->addPolicy($csp);
+	}
+}