Send a configurable CSP in every HTML response

.ci/compose.yaml

@@ -0,0 +1,77 @@
+services:
+  mailhost:
+    image: docker.io/greenmail/standalone
+    environment:
+      GREENMAIL_OPTS: '-Dgreenmail.setup.test.all -Dgreenmail.hostname=0.0.0.0 -Dgreenmail.auth.disabled -Dgreenmail.preload.dir=/emails'
+    volumes:
+      - "../tests/MessageRendering/data/greenmail:/emails"
+  browserhost:
+    image: docker.io/selenium/standalone-chromium
+    ports:
+      # Allow to watch the remote controlled browser (comment out the
+      # `--headless` argument in TestCase::driver() before).
+      - '127.0.0.1:7900:7900'
+    volumes:
+      - '/dev/shm:/dev/shm'
+      - '../tests/Browser/downloads:/downloads'
+
+  browser_tests:
+    depends_on:
+      - mailhost
+      - browserhost
+    hostname: 'testrunner'
+    image: ghcr.io/roundcube/roundcubemail-testrunner:php8.3
+    volumes:
+      - '..:/app'
+      - '../tests/Browser/downloads:/downloads'
+    environment:
+      WEBDRIVER_CONNECT_URL: 'http://browserhost:4444'
+      SERVER_URL: 'http://testrunner:8000'
+      SERVER_BIND: '0.0.0.0:8000'
+      BROWSER_DOWNLOADS_DIR: '/downloads'
+      TESTRUNNER_DOWNLOADS_DIR: '../tests/Browser/downloads'
+      RC_CONFIG_IMAP_HOST: 'tls://mailhost:3143'
+      RC_CONFIG_SMTP_HOST: 'mailhost:3025'
+    command: 
+      - .ci/run_browser_tests.sh
+
+  tests:
+    depends_on:
+      - mailhost
+    image: ghcr.io/roundcube/roundcubemail-testrunner:php8.3
+    volumes:
+      - '..:/app'
+    command:
+      - .ci/run_tests.sh
+
+  test_message_rendering:
+    depends_on:
+      - mailhost
+    image: ghcr.io/roundcube/roundcubemail-testrunner:php8.3
+    environment:
+      RC_CONFIG_IMAP_HOST: 'tls://mailhost:3143'
+    volumes:
+      - '..:/app'
+    command:
+      - .ci/run_test_message_rendering.sh
+
+  codespell:
+    image: ghcr.io/roundcube/roundcubemail-testrunner:php8.3
+    volumes:
+      - '..:/app'
+    command:
+      - vendor/bin/php-cs-fixer
+      - fix
+      - --dry-run
+      - --using-cache=no
+      - --diff
+      - --verbose
+
+  codestyle:
+    image: ghcr.io/roundcube/roundcubemail-testrunner:php8.3
+    volumes:
+      - '..:/app'
+    command:
+      - npx
+      - eslint
+      - .

.ci/config-test.inc.php

@@ -0,0 +1,43 @@
+<?php
+
+$config = [];
+
+// Database configuration
+$config['db_dsnw'] = 'sqlite:///' . sys_get_temp_dir() . '/roundcube-test-sqlite.db?mode=0646';
+
+// Test user credentials
+$config['tests_username'] = 'admin@example.net';
+$config['tests_password'] = 'admin';
+
+$config['imap_host'] = getenv('RC_CONFIG_IMAP_HOST') ?: 'localhost:143';
+$config['imap_auth_type'] = 'IMAP';
+$config['imap_conn_options'] = [
+   'ssl' => [
+       'verify_peer' => false,
+       'verify_peer_name' => false,
+    ],
+];
+// $config['managesieve_host'] = 'localhost:4190';
+
+// GreenMail
+$config['smtp_host'] = getenv('RC_CONFIG_SMTP_HOST') ?: 'localhost:25';
+
+// Settings required by the tests
+
+$config['create_default_folders'] = true;
+$config['skin'] = 'elastic';
+$config['support_url'] = 'http://support.url';
+
+// Plugins with tests
+
+$config['plugins'] = [
+    'archive',
+    'attachment_reminder',
+    'markasjunk',
+    'zipdownload',
+];
+
+$config['archive_mbox'] = 'Archive';
+
+$config['enable_spellcheck'] = true;
+$config['spellcheck_engine'] = 'pspell';

.ci/docker-images/Dockerfile

@@ -0,0 +1,53 @@
+ARG PHPVERSION=8.3
+FROM php:${PHPVERSION}-cli
+LABEL org.opencontainers.image.source="https://github.com/roundcube/roundcubemail"
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update \
+ && apt-get install -y --no-install-recommends \
+		libfreetype6-dev \
+		libicu-dev \
+		libjpeg62-turbo-dev \
+		libldap2-dev \
+		libpng-dev \
+		libpq-dev \
+		libsqlite3-dev \
+		libzip-dev \
+		libpspell-dev \
+		libonig-dev \
+		libldap-common \
+		libenchant-2-dev \
+		nodejs \
+		npm \
+		aspell \
+		aspell-en \
+		aspell-de \
+		hunspell-en-us \
+		git \
+		locales \
+ && apt-get clean
+
+# Some tests require en_US.UTF-8 as locale.
+RUN sed -i 's/^# en_US.UTF-8 /en_US.UTF-8 /' /etc/locale.gen && locale-gen
+
+# TODO: Do we need the multiarch-args? What for?
+#RUN debMultiarch="$(dpkg-architecture --query DEB_BUILD_MULTIARCH)" \
+RUN docker-php-ext-configure gd --with-jpeg --with-freetype \
+ #&& docker-php-ext-configure ldap --with-libdir="lib/$debMultiarch" \
+ && docker-php-ext-configure ldap \
+ && docker-php-ext-install \
+	zip \
+	pcntl \
+	gd \
+	ldap \
+	intl \
+	pspell \
+	enchant
+
+COPY --from=composer:2 /usr/bin/composer /usr/bin/composer
+
+# Create working directory
+WORKDIR /app
+
+VOLUME /app

.ci/docker-images/build.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+
+case "$1" in
+	8.1|8.3)
+		phpversion="$1"
+		;;
+	*)
+		echo "Error: first and only argument must be the wanted PHP version."
+		echo "Usage: $(basename $0) 8.1|8.3"
+		exit 1
+		;;
+esac
+
+exec docker build --build-arg "PHPVERSION=$phpversion" -f "$(realpath $(dirname $0)/Dockerfile)" -t "ghcr.io/pabzm/roundcubemail-testrunner:php$phpversion" "$(realpath $(dirname $0)/../../..)"

.ci/run_browser_tests.sh

@@ -0,0 +1,57 @@
+#!/bin/bash -ex
+
+# The script is intended for use locally, as well as in the CI.
+# It runs the browser-tests ("E2E" in the CI).
+# It expects a running IMAP server (connection configured in
+# `config-test.inc.php`, and a running Chrome/Chromium browser (connection
+# hard-coded in code, overrideable via environment variables).
+
+# Make temp and logs writeable to everyone.
+chmod 777 temp logs
+
+# Create downloads dir and ensure permissions (if it's set, the variable might
+# be blank if tests are not run using containers).
+if test -n "$TESTRUNNER_DOWNLOADS_DIR"; then
+	# Use sudo because in the Github action we apparently can't use a
+	# directory in $HOME or /tmp but another one for which we need
+	# superuser-rights.
+	install -m 777 -d "$TESTRUNNER_DOWNLOADS_DIR"
+fi
+
+if ! test -f config/config-test.inc.php; then
+	cp -v .ci/config-test.inc.php config/config-test.inc.php
+fi
+
+# Install dependencies for to remote control the browser.
+composer require -n "nesbot/carbon:^2.62.1" --no-update
+composer require -n "laravel/dusk:^7.9" --no-update
+
+if $(echo $PHP_VERSION | grep -q '^8.3'); then
+	# Downgrade dependencies (for PHP 8.3 only)
+	composer update --prefer-dist --prefer-stable --prefer-lowest --no-interaction --no-progress --optimize-autoloader
+else
+	composer update --prefer-dist --no-interaction --no-progress
+fi
+
+# Install development tools.
+npm install
+
+# Install javascript dependencies
+bin/install-jsdeps.sh
+
+# Compile Elastic's styles
+make css-elastic
+
+# Use minified javascript files
+bin/jsshrink.sh
+
+# Run tests
+echo "TESTS_MODE: DESKTOP"
+TESTS_MODE=desktop vendor/bin/phpunit -c tests/Browser/phpunit.xml --fail-on-warning --fail-on-risky --exclude-group=failsonga
+
+echo "TESTS_MODE: TABLET"
+TESTS_MODE=tablet vendor/bin/phpunit -c tests/Browser/phpunit.xml --fail-on-warning --fail-on-risky --exclude-group=failsonga-tablet
+
+# Mobile mode tests are unreliable on Github Actions
+# echo "TESTS_MODE: PHONE"
+# TESTS_MODE=phone vendor/bin/phpunit -c tests/Browser/phpunit.xml --fail-on-warning --fail-on-risky --exclude-group=failsonga-phone

.ci/run_test_message_rendering.sh

@@ -0,0 +1,11 @@
+#!/bin/bash -ex
+
+if ! test -f config/config-test.inc.php; then
+	cp -v .ci/config-test.inc.php config/config-test.inc.php
+fi
+
+# Install dependencies, prefer highest.
+composer update --prefer-dist --no-interaction --no-progress
+
+# Execute tests.
+vendor/bin/phpunit -c ./tests/MessageRendering/phpunit.xml --fail-on-warning --fail-on-risky

.ci/run_tests.sh

@@ -0,0 +1,19 @@
+#!/bin/bash -ex
+
+if ! test -f config/config-test.inc.php; then
+	cp -v .ci/config-test.inc.php config/config-test.inc.php
+fi
+
+composer require "kolab/net_ldap3:~1.1.4" --no-update
+
+# Install dependencies, prefer highest.
+composer update --prefer-dist --no-interaction --no-progress
+
+# Execute tests.
+vendor/bin/phpunit -c tests/phpunit.xml --fail-on-warning --fail-on-risky
+
+# Downgrade dependencies to the lowest versions.
+composer update --prefer-dist --prefer-stable --prefer-lowest --no-interaction --no-progress --optimize-autoloader
+
+# Execute tests again.
+vendor/bin/phpunit -c tests/phpunit.xml --fail-on-warning --fail-on-risky

.editorconfig

@@ -0,0 +1,13 @@
+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+insert_final_newline = true
+
+[*.{json, php, sh}]
+charset = utf-8
+indent_style = space
+indent_size = 4
+trim_trailing_whitespace = true