Allow unsafe-inline JS and CSS per page. USE WITH CAUTION

Author: Firesphere

src/Extensions/ControllerCSPExtension.php

@@ -105,10 +105,13 @@ public function onBeforeInit()
         $ymlConfig = CSPBackend::config()->get('csp_config');
         $this->addPolicyHeaders = ($ymlConfig['enabled'] ?? false) || static::checkCookie($owner->getRequest());
         /** @var Controller $owner */
-        $owner = $this->owner;
         if ($this->addPolicyHeaders) {
             $config = Injector::inst()->convertServiceProperty($ymlConfig);
             $legacy = $config['legacy'] ?? true;
+            $unsafeCSSInline = $config['style-src']['unsafe-inline'];
+            $config['style-src']['unsafe-inline'] = $unsafeCSSInline || $owner->dataRecord->AllowJSInline;
+            $unsafeCSSInline = $config['script-src']['unsafe-inline'];
+            $config['script-src']['unsafe-inline'] = $unsafeCSSInline || $owner->dataRecord->AllowJSInline;
 
             $policy = CSPBuilder::fromArray($config);
 

src/Extensions/PageExtension.php

@@ -6,11 +6,13 @@
 use Firesphere\CSPHeaders\Models\CSPDomain;
 use Page;
 use SilverStripe\CMS\Model\SiteTree;
+use SilverStripe\Forms\CheckboxField;
 use SilverStripe\Forms\FieldList;
 use SilverStripe\Forms\GridField\GridField;
 use SilverStripe\Forms\GridField\GridFieldConfig_RelationEditor;
 use SilverStripe\Forms\Tab;
 use SilverStripe\ORM\DataExtension;
+use SilverStripe\ORM\FieldType\DBBoolean;
 use SilverStripe\ORM\ManyManyList;
 
 /**
@@ -21,10 +23,21 @@
  */
 class PageExtension extends DataExtension
 {
+
+    private static $db = [
+        'AllowCSSInline' => DBBoolean::class,
+        'AllowJSInline'  => DBBoolean::class,
+    ];
+
     private static $many_many = [
         'CSPDomains' => CSPDomain::class
     ];
 
+    private static $defaults = [
+        'AllowCSSInline' => false,
+        'AllowJSInline'  => false,
+    ];
+
     public function updateSettingsFields(FieldList $fields)
     {
         $fields->addFieldToTab('Root', Tab::create(
@@ -39,6 +52,10 @@ public function updateSettingsFields(FieldList $fields)
             $this->owner->CSPDomains(),
             $config
         );
-        $fields->addFieldToTab('Root.CSP', $gridfield);
+        $fields->addFieldsToTab('Root.CSP', [
+            CheckboxField::create('AllowCSSInline', 'Allow CSS inline'),
+            CheckboxField::create('AllowJSInline', 'Allow JS inline'),
+            $gridfield
+        ]);
     }
 }