Restrict map tile url to https protocol

Signed-off-by: Maximilian Krög <maxi_kroeg@web.de>

Author: MoonE

src/Header.php

@@ -419,7 +419,7 @@ public function getPageTitle(): string
     /** Get the Content-Security-Policy header */
     private function getCspHeader(): string
     {
-        $mapTileUrl = ' tile.openstreetmap.org';
+        $mapTileUrl = ' https://tile.openstreetmap.org';
         $cspAllow = $this->config->config->CSPAllow === '' ? '' : ' ' . $this->config->config->CSPAllow;
         $captchaUrl =
             $this->config->config->CaptchaLoginPrivateKey === '' ||

tests/unit/HeaderTest.php

@@ -226,7 +226,7 @@ public static function providerForTestGetHttpHeaders(): array
                 '',
                 '',
                 "default-src 'self';"
-                    . " img-src 'self' data: tile.openstreetmap.org;"
+                    . " img-src 'self' data: https://tile.openstreetmap.org;"
                     . " object-src 'none';"
                     . " script-src 'self' 'unsafe-inline' 'unsafe-eval';"
                     . " style-src 'self' 'unsafe-inline';"
@@ -239,7 +239,7 @@ public static function providerForTestGetHttpHeaders(): array
                 'PublicKey',
                 'captcha.tld csp.tld',
                 "default-src 'self' captcha.tld csp.tld example.com example.net;"
-                    . " img-src 'self' data: captcha.tld csp.tld example.com example.net tile.openstreetmap.org;"
+                    . " img-src 'self' data: captcha.tld csp.tld example.com example.net https://tile.openstreetmap.org;"
                     . " object-src 'none';"
                     . " script-src 'self' 'unsafe-inline' 'unsafe-eval' captcha.tld csp.tld example.com example.net;"
                     . " style-src 'self' 'unsafe-inline' captcha.tld csp.tld example.com example.net;"
@@ -252,7 +252,7 @@ public static function providerForTestGetHttpHeaders(): array
                 'PublicKey',
                 'captcha.tld csp.tld',
                 "default-src 'self' captcha.tld csp.tld;"
-                    . " img-src 'self' data: captcha.tld csp.tld tile.openstreetmap.org;"
+                    . " img-src 'self' data: captcha.tld csp.tld https://tile.openstreetmap.org;"
                     . " object-src 'none';"
                     . " script-src 'self' 'unsafe-inline' 'unsafe-eval' captcha.tld csp.tld;"
                     . " style-src 'self' 'unsafe-inline' captcha.tld csp.tld;",