URLInterceptor: fix CSP header munging with script-src nonce

When a site has an existing CSP with script-src but has things in it
like 'unsafe-inline', when we prepend our nonced version of the
injected script, the browser effectively ignores all other values in
the directive and requires that all of them have nonces. Since none
of them do, all of the 'unsafe-inline' scripts on the page break.

Fixes images loading on a medium.com page which has such a CSP.

Endless Tests/URLInterceptor_Tests.m

···
 - (void)testCSPHeaderInjection
 {
 	NSString *inp = @"default-src 'self'; connect-src 'self'; font-src 'self' data:; frame-src https://twitter.com https://*.twitter.com https://*.twimg.com twitter: https://www.google.com https://5415703.fls.doubleclick.net; frame-ancestors https://*.twitter.com; img-src https://twitter.com https://*.twitter.com https://*.twimg.com https://maps.google.com https://www.google-analytics.com https://stats.g.doubleclick.net https://www.google.com https://ad.doubleclick.net data:; media-src https://*.twitter.com https://*.twimg.com https://*.cdn.vine.co; object-src 'self'; script-src 'unsafe-inline' 'unsafe-eval' https://*.twitter.com https://*.twimg.com https://www.google.com https://www.google-analytics.com https://stats.g.doubleclick.net; style-src 'unsafe-inline' https://*.twitter.com https://*.twimg.com; report-uri https://twitter.com/i/csp_report?a=O5SWEZTPOJQWY3A%3D&ro=false;";
-	
-	NSString *outp = [URLInterceptor prependDirectivesIfExisting:@{ @"frame-src": @"endless:", @"child-src": @"endless:"} inCSPHeader:inp];
-	
+	NSString *outp = [URLInterceptor prependDirectivesIfExisting:@{
+								       @"frame-src": @[ @"endless:", @"endless:" ],
+								       @"child-src": @[ @"endless:", @"endless:" ]
+								       } inCSPHeader:inp];
 	XCTAssertEqualObjects(outp, @"connect-src 'self'; default-src 'self'; font-src 'self' data:; frame-ancestors https://*.twitter.com; frame-src endless: https://twitter.com https://*.twitter.com https://*.twimg.com twitter: https://www.google.com https://5415703.fls.doubleclick.net; img-src https://twitter.com https://*.twitter.com https://*.twimg.com https://maps.google.com https://www.google-analytics.com https://stats.g.doubleclick.net https://www.google.com https://ad.doubleclick.net data:; media-src https://*.twitter.com https://*.twimg.com https://*.cdn.vine.co; object-src 'self'; report-uri https://twitter.com/i/csp_report?a=O5SWEZTPOJQWY3A%3D&ro=false; script-src 'unsafe-inline' 'unsafe-eval' https://*.twitter.com https://*.twimg.com https://www.google.com https://www.google-analytics.com https://stats.g.doubleclick.net; style-src 'unsafe-inline' https://*.twitter.com https://*.twimg.com;");
 }
 
 - (void)testCSPHeaderNoneRemoval
 {
 	/* make sure 'none' is removed and our value is used */
-	NSString *outp = [URLInterceptor prependDirectivesIfExisting:@{ @"frame-src": @"endless:" } inCSPHeader:@"blah-src 'self';frame-src 'none' ; blah2-src 'none';"];
+	NSString *outp = [URLInterceptor prependDirectivesIfExisting:@{
+								       @"frame-src": @[ @"endless:", @"endless:" ]
+								       } inCSPHeader:@"blah-src 'self';frame-src 'none' ; blah2-src 'none';"];
 	XCTAssertEqualObjects(outp, @"blah-src 'self'; blah2-src 'none'; frame-src endless:;");
 }
 
 - (void)testCSPHeaderSelectiveInclusion
 {
 	/* only change directives if they existed in the original policy */
-	NSString *outp = [URLInterceptor prependDirectivesIfExisting:@{ @"child-src": @"endlessipc:", @"frame-src": @"endlessipc:", @"script-src" : @"'none'" } inCSPHeader:@"referrer always;"];
+	NSString *outp = [URLInterceptor prependDirectivesIfExisting:@{
+								       @"child-src": @[ @"endlessipc:", @"endlessipc:" ],
+								       @"frame-src": @[ @"endlessipc:", @"endlessipc:" ],
+								       @"script-src" : @[ @"'none'", @"'none'" ]
+								       } inCSPHeader:@"referrer always;"];
 	XCTAssertEqualObjects(outp, @"referrer always;");
+}
+
+- (void)testCSPHeaderSelectiveNonce
+{
+	NSDictionary *wantedDirectives = @{
+					   @"child-src": @[ @"endlessipc:", @"endlessipc:" ],
+					   @"default-src" : @[ @"endlessipc:", @"'nonce-blah' endlessipc:" ],
+					   @"frame-src": @[ @"endlessipc:", @"endlessipc:" ],
+					   @"script-src" : @[ @"", @"'nonce-blah'" ],
+					   };
+
+	/* only prepend nonced values if the original directive contained '{sha256|sha384|sha512|nonce}-.*' */
+	NSString *inp = @"default-src 'self'; script-src https://cdn.example.com 'sha512-abcdefghijkl'; style-src 'unsafe-inline'";
+	NSString *outp = [URLInterceptor prependDirectivesIfExisting:wantedDirectives inCSPHeader:inp];
+	XCTAssertEqualObjects(outp, @"default-src endlessipc: 'self'; script-src 'nonce-blah' https://cdn.example.com 'sha512-abcdefghijkl'; style-src 'unsafe-inline';");
+
+	/* when it doesn't use nonces, use the non-nonced version */
+	NSString *inp2 = @"default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://getpocket.com https://m.signalvnoise.com https://*.m.signalvnoise.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://*.lightstep.com 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://medium2.global.ssl.fastly.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self'; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com";
+	NSString *outp2 = [URLInterceptor prependDirectivesIfExisting:wantedDirectives inCSPHeader:inp2];
+	XCTAssertEqualObjects(outp2, @"connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://getpocket.com https://m.signalvnoise.com https://*.m.signalvnoise.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://*.lightstep.com 'self'; default-src endlessipc: 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://use.typekit.net https://cdn-static-1.medium.com 'self'; frame-src endlessipc: chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://medium2.global.ssl.fastly.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self'; object-src 'self'; report-uri https://csp.medium.com; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self';");
 }
 
 @end

Endless.xcodeproj/project.pbxproj

···
 			isa = PBXGroup;
 			children = (
 				01D741291A45EDD1007B7033 /* CookieJar_Tests.m */,
-				01D42C3C1E0A4FE400566022 /* URLInterceptor_Tests.m */,
 				01F7CB4A1A526B9C00F42B73 /* HSTSCache_Tests.m */,
 				018333DB1A35727C00670CD1 /* HTTPSEverywhere_Tests.m */,
 				0141D9691E0C66F1003472BC /* LocalNetworkChecker_Tests.m */,
 				01F2AE411B827BC200D5651A /* SSLCertificate_Tests.m */,
 				01F879401A4112E500A63654 /* URLBlocker_Tests.m */,
+				01D42C3C1E0A4FE400566022 /* URLInterceptor_Tests.m */,
 				018333D91A35727C00670CD1 /* Supporting Files */,
 			);
 			path = "Endless Tests";

Endless/URLInterceptor.m

···
 	}
 	
 	for (NSString *newDir in [directives allKeys]) {
-		NSString *newval = [directives objectForKey:newDir];
+		NSArray *newvals = [directives objectForKey:newDir];
 		NSString *curval = [curDirectives objectForKey:newDir];
 		if (curval) {
+			NSString *newval = [newvals objectAtIndex:0];
+			
 			/*
-			 * CSP spec says if 'none' is encountered to ignore anything else, so if
-			 * 'none' is there, just replace it with newval rather than prepending
+			 * If none of the existing values for this directive have a nonce or hash,
+			 * then inserting our value with a nonce will cause the directive to become
+			 * strict, so "'nonce-abcd' 'self' 'unsafe-inline'" causes the browser to
+			 * ignore 'self' and 'unsafe-inline', requiring that all scripts have a
+			 * nonce or hash.  Since the site would probably only ever have nonce values
+			 * in its <script> tags if it was in the CSP policy, only include our nonce
+			 * value if the CSP policy already has them.
 			 */
-			if (![curval containsString:@"'none'"])
-				newval = [NSString stringWithFormat:@"%@ %@", newval, curval];
+			if ([curval containsString:@"'nonce-"] || [curval containsString:@"'sha"])
+				newval = [newvals objectAtIndex:1];
+			 
+			if ([curval containsString:@"'none'"]) {
+				/*
+				 * CSP spec says if 'none' is encountered to ignore anything else,
+				 * so if 'none' is there, just replace it with newval rather than
+				 * prepending.
+				 */
+			} else {
+				if ([newval isEqualToString:@""])
+					newval = curval;
+				else
+					newval = [NSString stringWithFormat:@"%@ %@", newval, curval];
+			}
 			
 			[curDirectives setObject:newval forKey:newDir];
 		}
···
 	}
 	
 	/* rewrite or inject Content-Security-Policy (and X-Webkit-CSP just in case) headers */
-	NSString *CSPheader;
+	NSString *CSPheader = nil;
 	NSString *CSPmode = [self.originHostSettings setting:HOST_SETTINGS_KEY_CSP];
 
 	if ([CSPmode isEqualToString:HOST_SETTINGS_CSP_STRICT])
 		CSPheader = @"media-src 'none'; object-src 'none'; connect-src 'none'; font-src 'none'; sandbox allow-forms allow-top-navigation; style-src 'unsafe-inline' *; report-uri;";
 	else if ([CSPmode isEqualToString:HOST_SETTINGS_CSP_BLOCK_CONNECT])
 		CSPheader = @"connect-src 'none'; media-src 'none'; object-src 'none'; report-uri;";
-	else
-		CSPheader = nil;
 	
 	NSString *curCSP = [self caseInsensitiveHeader:@"content-security-policy" inResponse:response];
 	
···
 
 	NSMutableDictionary *mHeaders = [[NSMutableDictionary alloc] initWithDictionary:[response allHeaderFields]];
 	
+	/* don't bother rewriting with the header if we don't want a restrictive one (CSPheader) and the site doesn't have one (curCSP) */
 	if (CSPheader != nil || curCSP != nil) {
 		BOOL foundCSP = false;
 		
+		/* directives and their values (normal and nonced versions) to prepend */
 		NSDictionary *wantedDirectives = @{
-			@"child-src": @"endlessipc:",
-			@"default-src" : [NSString stringWithFormat:@"'nonce-%@' endlessipc:", [self cspNonce]],
-			@"frame-src": @"endlessipc:",
-			@"script-src" : [NSString stringWithFormat:@"'nonce-%@'", [self cspNonce]],
+			@"child-src": @[ @"endlessipc:", @"endlessipc:" ],
+			@"default-src" : @[ @"endlessipc:", [NSString stringWithFormat:@"'nonce-%@' endlessipc:", [self cspNonce]] ],
+			@"frame-src": @[ @"endlessipc:", @"endlessipc:" ],
+			@"script-src" : @[ @"", [NSString stringWithFormat:@"'nonce-%@'", [self cspNonce]] ],
 		};
 
 		for (id h in [mHeaders allKeys]) {