CVE-2022-1351: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Stored XSS in Tooltip in GitHub repository pimcore/pimcore prior to 10.4.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2022-04-14T10:15Z
Repository: https://github.com/pimcore/pimcore
Language: PHP
Files changed: bundles/AdminBundle/DependencyInjection/Configuration.php, bundles/AdminBundle/EventListener/AdminSecurityListener.php, bundles/AdminBundle/Security/ContentSecurityPolicyHandler.php
Commit date: 2022-04-14 10:43:36 +0200
Commit message: [Security] ContentSecurityPolicyHandler - Add exclude paths property to disable csp for specific paths

Signed-off-by: dpahuja <divesh.pahuja@gmail.com>

Diff: diff --git a/bundles/AdminBundle/DependencyInjection/Configuration.php b/bundles/AdminBundle/DependencyInjection/Configuration.php
index 121c6c6eb220..c667773b5c7d 100644
--- a/bundles/AdminBundle/DependencyInjection/Configuration.php
+++ b/bundles/AdminBundle/DependencyInjection/Configuration.php
@@ -57,10 +57,14 @@ final class Configuration implements ConfigurationInterface
             ->end()
             ->arrayNode('admin_csp_header')
                 ->canBeEnabled()
                 ->info('Can be used to enable or disable the Content Security Policy headers.')
                 ->children()
+                    ->arrayNode('exclude_paths')
+                        ->scalarPrototype()->end()
+                        ->info('Regular Expressions like: /^\/path\/toexclude/')
+                    ->end()
                     ->arrayNode('additional_urls')
                         ->addDefaultsIfNotSet()
                         ->normalizeKeys(false)
                         ->children()
                             ->arrayNode(ContentSecurityPolicyHandler::DEFAULT_OPT)
diff --git a/bundles/AdminBundle/EventListener/AdminSecurityListener.php b/bundles/AdminBundle/EventListener/AdminSecurityListener.php
index 588323dac49e..ab3890c23160 100644
--- a/bundles/AdminBundle/EventListener/AdminSecurityListener.php
+++ b/bundles/AdminBundle/EventListener/AdminSecurityListener.php
@@ -69,10 +69,20 @@ class AdminSecurityListener implements EventSubscriberInterface
 
         if ($this->requestHelper->isFrontendRequestByAdmin($request)) {
             return;
         }
 
+
+        if (!empty($this->config['admin_csp_header']['exclude_paths'])) {
+            $requestUri = $request->getRequestUri();
+            foreach ($this->config['admin_csp_header']['exclude_paths'] as $path) {
+                if (@preg_match($path, $requestUri)) {
+                    return;
+                }
+            }
+        }
+
         $response = $event->getResponse();
 
         // set CSP header with random nonce string to the response
         $response->headers->set('Content-Security-Policy', $this->contentSecurityPolicyHandler->getCspHeader());
     }
diff --git a/bundles/AdminBundle/Security/ContentSecurityPolicyHandler.php b/bundles/AdminBundle/Security/ContentSecurityPolicyHandler.php
index 3002e72d509c..2c0c965e0d39 100644
--- a/bundles/AdminBundle/Security/ContentSecurityPolicyHandler.php
+++ b/bundles/AdminBundle/Security/ContentSecurityPolicyHandler.php
@@ -51,14 +51,10 @@ class ContentSecurityPolicyHandler implements LoggerAwareInterface
      */
     private array $allowedUrls = [
         self::CONNECT_OPT => [
             'https://liveupdate.pimcore.org/', //AdminBundle statistics & update-check service
             'https://nominatim.openstreetmap.org/', //CoreBundle geocoding_url_template
-
-        ],
-        self::SCRIPT_OPT => [
-            'http://unpkg.com/', // For the OPCache
         ],
     ];
 
     public function __construct(protected Config $config, protected array $cspHeaderOptions = [])
     {

Vulnerable code: 
        ],
        self::SCRIPT_OPT => [
            'http://unpkg.com/', // For the OPCache
Fixed code:                     ->arrayNode('exclude_paths')
                        ->scalarPrototype()->end()
                        ->info('Regular Expressions like: /^\/path\/toexclude/')
                    ->end()

        if (!empty($this->config['admin_csp_header']['exclude_paths'])) {
            $requestUri = $request->getRequestUri();
            foreach ($this->config['admin_csp_header']['exclude_paths'] as $path) {
                if (@preg_match($path, $requestUri)) {
                    return;
                }
            }
        }