From 37d626f9121ac67ba7342309d37fc2a91cbed03e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alexander=20Rie=C3=9F?= <alexander.riess@icinga.com>
Date: Thu, 2 Apr 2026 10:29:31 +0200
Subject: [PATCH] Add Csp hook

Register a `CspHook` implementation that allows the browser to load feed
images by adding each configured feed's scheme and host to the `img-src`
content security policy directive.

Access is gated behind the `feeds/view` permission: users without it
receive no additional CSP directives.
---
 library/Feeds/ProvidedHook/Csp.php | 41 ++++++++++++++++++++++++++++++
 run.php                            |  4 +++
 2 files changed, 45 insertions(+)
 create mode 100644 library/Feeds/ProvidedHook/Csp.php

diff --git a/library/Feeds/ProvidedHook/Csp.php b/library/Feeds/ProvidedHook/Csp.php
new file mode 100644
index 0000000..b93d81d
--- /dev/null
+++ b/library/Feeds/ProvidedHook/Csp.php
@@ -0,0 +1,41 @@
+<?php
+
+namespace Icinga\Module\Feeds\ProvidedHook;
+
+use Icinga\Application\Hook\CspHook;
+use Icinga\Authentication\Auth;
+use Icinga\Module\Feeds\Storage\StorageFactory;
+use Icinga\User;
+use ipl\Web\Common\Csp as CspInstance;
+use ipl\Web\Url;
+
+/**
+ * Csp hook to add the feed images to the content security policy
+ *
+ * All users with the permission 'feeds/view' will get the CSP for all feeds.
+ * This hook assumes that images are sourced from the same domain as the feed.
+ */
+class Csp extends CspHook
+{
+    public function getCspForAllUsers(): CspInstance
+    {
+        $csp = new CspInstance();
+
+        $storage = StorageFactory::getStorage();
+        foreach ($storage->getFeeds() as $feed) {
+            $url = Url::fromPath($feed->url);
+            $csp->add('img-src', $url->getScheme() . '://' . $url->getHost());
+        }
+
+        return $csp;
+    }
+
+    public function getCspForUser(User $user): CspInstance
+    {
+        if (Auth::getInstance()->hasPermission('feeds/view')) {
+            return $this->getCspForAllUsers();
+        }
+
+        return new CspInstance();
+    }
+}
diff --git a/run.php b/run.php
index b3d9bbc..04b49f3 100644
--- a/run.php
+++ b/run.php
@@ -1 +1,5 @@
 <?php
+
+use Icinga\Module\Feeds\ProvidedHook\Csp;
+
+Csp::register();