nextcloud / server

lib/private/legacy/OC_Response.php

Indentation +71 added lines, -71 removed lines

@@ -6,78 +6,78 @@
  * SPDX-License-Identifier: AGPL-3.0-only
  */
 class OC_Response {
-	/**
-	 * Sets the content disposition header (with possible workarounds)
-	 * @param string $filename file name
-	 * @param string $type disposition type, either 'attachment' or 'inline'
-	 */
-	public static function setContentDispositionHeader($filename, $type = 'attachment') {
-		if (\OC::$server->getRequest()->isUserAgent(
-			[
-				\OC\AppFramework\Http\Request::USER_AGENT_IE,
-				\OC\AppFramework\Http\Request::USER_AGENT_ANDROID_MOBILE_CHROME,
-				\OC\AppFramework\Http\Request::USER_AGENT_FREEBOX,
-			])) {
-			header('Content-Disposition: ' . rawurlencode($type) . '; filename="' . rawurlencode($filename) . '"');
-		} else {
-			header('Content-Disposition: ' . rawurlencode($type) . '; filename*=UTF-8\'\'' . rawurlencode($filename)
-												 . '; filename="' . rawurlencode($filename) . '"');
-		}
-	}
+    /**
+     * Sets the content disposition header (with possible workarounds)
+     * @param string $filename file name
+     * @param string $type disposition type, either 'attachment' or 'inline'
+     */
+    public static function setContentDispositionHeader($filename, $type = 'attachment') {
+        if (\OC::$server->getRequest()->isUserAgent(
+            [
+                \OC\AppFramework\Http\Request::USER_AGENT_IE,
+                \OC\AppFramework\Http\Request::USER_AGENT_ANDROID_MOBILE_CHROME,
+                \OC\AppFramework\Http\Request::USER_AGENT_FREEBOX,
+            ])) {
+            header('Content-Disposition: ' . rawurlencode($type) . '; filename="' . rawurlencode($filename) . '"');
+        } else {
+            header('Content-Disposition: ' . rawurlencode($type) . '; filename*=UTF-8\'\'' . rawurlencode($filename)
+                                                    . '; filename="' . rawurlencode($filename) . '"');
+        }
+    }
 
-	/**
-	 * Sets the content length header (with possible workarounds)
-	 * @param string|int|float $length Length to be sent
-	 */
-	public static function setContentLengthHeader($length) {
-		if (PHP_INT_SIZE === 4) {
-			if ($length > PHP_INT_MAX && stripos(PHP_SAPI, 'apache') === 0) {
-				// Apache PHP SAPI casts Content-Length headers to PHP integers.
-				// This enforces a limit of PHP_INT_MAX (2147483647 on 32-bit
-				// platforms). So, if the length is greater than PHP_INT_MAX,
-				// we just do not send a Content-Length header to prevent
-				// bodies from being received incompletely.
-				return;
-			}
-			// Convert signed integer or float to unsigned base-10 string.
-			$lfh = new \OC\LargeFileHelper;
-			$length = $lfh->formatUnsignedInteger($length);
-		}
-		header('Content-Length: ' . $length);
-	}
+    /**
+     * Sets the content length header (with possible workarounds)
+     * @param string|int|float $length Length to be sent
+     */
+    public static function setContentLengthHeader($length) {
+        if (PHP_INT_SIZE === 4) {
+            if ($length > PHP_INT_MAX && stripos(PHP_SAPI, 'apache') === 0) {
+                // Apache PHP SAPI casts Content-Length headers to PHP integers.
+                // This enforces a limit of PHP_INT_MAX (2147483647 on 32-bit
+                // platforms). So, if the length is greater than PHP_INT_MAX,
+                // we just do not send a Content-Length header to prevent
+                // bodies from being received incompletely.
+                return;
+            }
+            // Convert signed integer or float to unsigned base-10 string.
+            $lfh = new \OC\LargeFileHelper;
+            $length = $lfh->formatUnsignedInteger($length);
+        }
+        header('Content-Length: ' . $length);
+    }
 
-	/**
-	 * This function adds some security related headers to all requests served via base.php
-	 * The implementation of this function has to happen here to ensure that all third-party
-	 * components (e.g. SabreDAV) also benefit from this headers.
-	 */
-	public static function addSecurityHeaders() {
-		/**
-		 * FIXME: Content Security Policy for legacy ownCloud components. This
-		 * can be removed once \OCP\AppFramework\Http\Response from the AppFramework
-		 * is used everywhere.
-		 * @see \OCP\AppFramework\Http\Response::getHeaders
-		 */
-		$policy = 'default-src \'self\'; '
-			. 'script-src \'self\' \'nonce-' . \OC::$server->getContentSecurityPolicyNonceManager()->getNonce() . '\'; '
-			. 'style-src \'self\' \'unsafe-inline\'; '
-			. 'frame-src *; '
-			. 'img-src * data: blob:; '
-			. 'font-src \'self\' data:; '
-			. 'media-src *; '
-			. 'connect-src *; '
-			. 'object-src \'none\'; '
-			. 'base-uri \'self\'; ';
-		header('Content-Security-Policy:' . $policy);
+    /**
+     * This function adds some security related headers to all requests served via base.php
+     * The implementation of this function has to happen here to ensure that all third-party
+     * components (e.g. SabreDAV) also benefit from this headers.
+     */
+    public static function addSecurityHeaders() {
+        /**
+         * FIXME: Content Security Policy for legacy ownCloud components. This
+         * can be removed once \OCP\AppFramework\Http\Response from the AppFramework
+         * is used everywhere.
+         * @see \OCP\AppFramework\Http\Response::getHeaders
+         */
+        $policy = 'default-src \'self\'; '
+            . 'script-src \'self\' \'nonce-' . \OC::$server->getContentSecurityPolicyNonceManager()->getNonce() . '\'; '
+            . 'style-src \'self\' \'unsafe-inline\'; '
+            . 'frame-src *; '
+            . 'img-src * data: blob:; '
+            . 'font-src \'self\' data:; '
+            . 'media-src *; '
+            . 'connect-src *; '
+            . 'object-src \'none\'; '
+            . 'base-uri \'self\'; ';
+        header('Content-Security-Policy:' . $policy);
 
-		// Send fallback headers for installations that don't have the possibility to send
-		// custom headers on the webserver side
-		if (getenv('modHeadersAvailable') !== 'true') {
-			header('Referrer-Policy: no-referrer'); // https://www.w3.org/TR/referrer-policy/
-			header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
-			header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains
-			header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
-			header('X-Robots-Tag: noindex, nofollow'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
-		}
-	}
+        // Send fallback headers for installations that don't have the possibility to send
+        // custom headers on the webserver side
+        if (getenv('modHeadersAvailable') !== 'true') {
+            header('Referrer-Policy: no-referrer'); // https://www.w3.org/TR/referrer-policy/
+            header('X-Content-Type-Options: nosniff'); // Disable sniffing the content type for IE
+            header('X-Frame-Options: SAMEORIGIN'); // Disallow iFraming from other domains
+            header('X-Permitted-Cross-Domain-Policies: none'); // https://www.adobe.com/devnet/adobe-media-server/articles/cross-domain-xml-for-streaming.html
+            header('X-Robots-Tag: noindex, nofollow'); // https://developers.google.com/webmasters/control-crawl-index/docs/robots_meta_tag
+        }
+    }
 }

apps/settings/lib/SetupChecks/SecurityHeaders.php

Indentation +108 added lines, -108 removed lines

@@ -20,120 +20,120 @@
 
 class SecurityHeaders implements ISetupCheck {
 
-	use CheckServerResponseTrait;
+    use CheckServerResponseTrait;
 
-	public function __construct(
-		protected IL10N $l10n,
-		protected IConfig $config,
-		protected IURLGenerator $urlGenerator,
-		protected IClientService $clientService,
-		protected LoggerInterface $logger,
-	) {
-	}
+    public function __construct(
+        protected IL10N $l10n,
+        protected IConfig $config,
+        protected IURLGenerator $urlGenerator,
+        protected IClientService $clientService,
+        protected LoggerInterface $logger,
+    ) {
+    }
 
-	public function getCategory(): string {
-		return 'security';
-	}
+    public function getCategory(): string {
+        return 'security';
+    }
 
-	public function getName(): string {
-		return $this->l10n->t('HTTP headers');
-	}
+    public function getName(): string {
+        return $this->l10n->t('HTTP headers');
+    }
 
-	public function run(): SetupResult {
-		$urls = [
-			['get', $this->urlGenerator->linkToRoute('heartbeat'), [200]],
-		];
-		$securityHeaders = [
-			'X-Content-Type-Options' => ['nosniff', null],
-			'X-Robots-Tag' => ['noindex,nofollow', null],
-			'X-Frame-Options' => ['sameorigin', 'deny'],
-			'X-Permitted-Cross-Domain-Policies' => ['none', null],
-		];
+    public function run(): SetupResult {
+        $urls = [
+            ['get', $this->urlGenerator->linkToRoute('heartbeat'), [200]],
+        ];
+        $securityHeaders = [
+            'X-Content-Type-Options' => ['nosniff', null],
+            'X-Robots-Tag' => ['noindex,nofollow', null],
+            'X-Frame-Options' => ['sameorigin', 'deny'],
+            'X-Permitted-Cross-Domain-Policies' => ['none', null],
+        ];
 
-		foreach ($urls as [$verb,$url,$validStatuses]) {
-			$works = null;
-			foreach ($this->runRequest($verb, $url, ['httpErrors' => false]) as $response) {
-				// Check that the response status matches
-				if (!in_array($response->getStatusCode(), $validStatuses)) {
-					$works = false;
-					continue;
-				}
-				$msg = '';
-				$msgParameters = [];
-				foreach ($securityHeaders as $header => [$expected, $accepted]) {
-					/* Convert to lowercase and remove spaces after comas */
-					$value = preg_replace('/,\s+/', ',', strtolower($response->getHeader($header)));
-					if ($value !== $expected) {
-						if ($accepted !== null && $value === $accepted) {
-							$msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. Some features might not work correctly, as it is recommended to adjust this setting accordingly.', [$header, $expected]) . "\n";
-						} else {
-							$msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', [$header, $expected]) . "\n";
-						}
-					}
-				}
+        foreach ($urls as [$verb,$url,$validStatuses]) {
+            $works = null;
+            foreach ($this->runRequest($verb, $url, ['httpErrors' => false]) as $response) {
+                // Check that the response status matches
+                if (!in_array($response->getStatusCode(), $validStatuses)) {
+                    $works = false;
+                    continue;
+                }
+                $msg = '';
+                $msgParameters = [];
+                foreach ($securityHeaders as $header => [$expected, $accepted]) {
+                    /* Convert to lowercase and remove spaces after comas */
+                    $value = preg_replace('/,\s+/', ',', strtolower($response->getHeader($header)));
+                    if ($value !== $expected) {
+                        if ($accepted !== null && $value === $accepted) {
+                            $msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. Some features might not work correctly, as it is recommended to adjust this setting accordingly.', [$header, $expected]) . "\n";
+                        } else {
+                            $msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', [$header, $expected]) . "\n";
+                        }
+                    }
+                }
 
-				$referrerPolicy = $response->getHeader('Referrer-Policy');
-				if (!preg_match('/(no-referrer(-when-downgrade)?|strict-origin(-when-cross-origin)?|same-origin)(,|$)/', $referrerPolicy)) {
-					$msg .= $this->l10n->t(
-						'- The `%1$s` HTTP header is not set to `%2$s`, `%3$s`, `%4$s`, `%5$s` or `%6$s`. This can leak referer information. See the {w3c-recommendation}.',
-						[
-							'Referrer-Policy',
-							'no-referrer',
-							'no-referrer-when-downgrade',
-							'strict-origin',
-							'strict-origin-when-cross-origin',
-							'same-origin',
-						]
-					) . "\n";
-					$msgParameters['w3c-recommendation'] = [
-						'type' => 'highlight',
-						'id' => 'w3c-recommendation',
-						'name' => 'W3C Recommendation',
-						'link' => 'https://www.w3.org/TR/referrer-policy/',
-					];
-				}
+                $referrerPolicy = $response->getHeader('Referrer-Policy');
+                if (!preg_match('/(no-referrer(-when-downgrade)?|strict-origin(-when-cross-origin)?|same-origin)(,|$)/', $referrerPolicy)) {
+                    $msg .= $this->l10n->t(
+                        '- The `%1$s` HTTP header is not set to `%2$s`, `%3$s`, `%4$s`, `%5$s` or `%6$s`. This can leak referer information. See the {w3c-recommendation}.',
+                        [
+                            'Referrer-Policy',
+                            'no-referrer',
+                            'no-referrer-when-downgrade',
+                            'strict-origin',
+                            'strict-origin-when-cross-origin',
+                            'same-origin',
+                        ]
+                    ) . "\n";
+                    $msgParameters['w3c-recommendation'] = [
+                        'type' => 'highlight',
+                        'id' => 'w3c-recommendation',
+                        'name' => 'W3C Recommendation',
+                        'link' => 'https://www.w3.org/TR/referrer-policy/',
+                    ];
+                }
 
-				$transportSecurityValidity = $response->getHeader('Strict-Transport-Security');
-				$minimumSeconds = 15552000;
-				if (preg_match('/^max-age=(\d+)(;.*)?$/', $transportSecurityValidity, $m)) {
-					$transportSecurityValidity = (int)$m[1];
-					if ($transportSecurityValidity < $minimumSeconds) {
-						$msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set to at least `%d` seconds (current value: `%d`). For enhanced security, it is recommended to use a long HSTS policy.', [$minimumSeconds, $transportSecurityValidity]) . "\n";
-					}
-				} elseif (!empty($transportSecurityValidity)) {
-					$msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is malformed: `%s`. For enhanced security, it is recommended to enable HSTS.', [$transportSecurityValidity]) . "\n";
-				} else {
-					$msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set (should be at least `%d` seconds). For enhanced security, it is recommended to enable HSTS.', [$minimumSeconds]) . "\n";
-				}
+                $transportSecurityValidity = $response->getHeader('Strict-Transport-Security');
+                $minimumSeconds = 15552000;
+                if (preg_match('/^max-age=(\d+)(;.*)?$/', $transportSecurityValidity, $m)) {
+                    $transportSecurityValidity = (int)$m[1];
+                    if ($transportSecurityValidity < $minimumSeconds) {
+                        $msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set to at least `%d` seconds (current value: `%d`). For enhanced security, it is recommended to use a long HSTS policy.', [$minimumSeconds, $transportSecurityValidity]) . "\n";
+                    }
+                } elseif (!empty($transportSecurityValidity)) {
+                    $msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is malformed: `%s`. For enhanced security, it is recommended to enable HSTS.', [$transportSecurityValidity]) . "\n";
+                } else {
+                    $msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set (should be at least `%d` seconds). For enhanced security, it is recommended to enable HSTS.', [$minimumSeconds]) . "\n";
+                }
 
-				if (!empty($msg)) {
-					return SetupResult::warning(
-						$this->l10n->t('Some headers are not set correctly on your instance') . "\n" . $msg,
-						$this->urlGenerator->linkToDocs('admin-security'),
-						$msgParameters,
-					);
-				}
-				// Skip the other requests if one works
-				$works = true;
-				break;
-			}
-			// If 'works' is null then we could not connect to the server
-			if ($works === null) {
-				return SetupResult::info(
-					$this->l10n->t('Could not check that your web server serves security headers correctly. Please check manually.'),
-					$this->urlGenerator->linkToDocs('admin-security'),
-				);
-			}
-			// Otherwise if we fail we can abort here
-			if ($works === false) {
-				return SetupResult::warning(
-					$this->l10n->t('Could not check that your web server serves security headers correctly, unable to query `%s`', [$url]),
-					$this->urlGenerator->linkToDocs('admin-security'),
-				);
-			}
-		}
-		return SetupResult::success(
-			$this->l10n->t('Your server is correctly configured to send security headers.')
-		);
-	}
+                if (!empty($msg)) {
+                    return SetupResult::warning(
+                        $this->l10n->t('Some headers are not set correctly on your instance') . "\n" . $msg,
+                        $this->urlGenerator->linkToDocs('admin-security'),
+                        $msgParameters,
+                    );
+                }
+                // Skip the other requests if one works
+                $works = true;
+                break;
+            }
+            // If 'works' is null then we could not connect to the server
+            if ($works === null) {
+                return SetupResult::info(
+                    $this->l10n->t('Could not check that your web server serves security headers correctly. Please check manually.'),
+                    $this->urlGenerator->linkToDocs('admin-security'),
+                );
+            }
+            // Otherwise if we fail we can abort here
+            if ($works === false) {
+                return SetupResult::warning(
+                    $this->l10n->t('Could not check that your web server serves security headers correctly, unable to query `%s`', [$url]),
+                    $this->urlGenerator->linkToDocs('admin-security'),
+                );
+            }
+        }
+        return SetupResult::success(
+            $this->l10n->t('Your server is correctly configured to send security headers.')
+        );
+    }
 }

Spacing +9 added lines, -9 removed lines

@@ -50,7 +50,7 @@ 
 			'X-Permitted-Cross-Domain-Policies' => ['none', null],
 		];
 
-		foreach ($urls as [$verb,$url,$validStatuses]) {
+		foreach ($urls as [$verb, $url, $validStatuses]) {
 			$works = null;
 			foreach ($this->runRequest($verb, $url, ['httpErrors' => false]) as $response) {
 				// Check that the response status matches
@@ -65,9 +65,9 @@ 
 					$value = preg_replace('/,\s+/', ',', strtolower($response->getHeader($header)));
 					if ($value !== $expected) {
 						if ($accepted !== null && $value === $accepted) {
-							$msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. Some features might not work correctly, as it is recommended to adjust this setting accordingly.', [$header, $expected]) . "\n";
+							$msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. Some features might not work correctly, as it is recommended to adjust this setting accordingly.', [$header, $expected])."\n";
 						} else {
-							$msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', [$header, $expected]) . "\n";
+							$msg .= $this->l10n->t('- The `%1$s` HTTP header is not set to `%2$s`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.', [$header, $expected])."\n";
 						}
 					}
 				}
@@ -84,7 +84,7 @@ 
 							'strict-origin-when-cross-origin',
 							'same-origin',
 						]
-					) . "\n";
+					)."\n";
 					$msgParameters['w3c-recommendation'] = [
 						'type' => 'highlight',
 						'id' => 'w3c-recommendation',
@@ -96,19 +96,19 @@ 
 				$transportSecurityValidity = $response->getHeader('Strict-Transport-Security');
 				$minimumSeconds = 15552000;
 				if (preg_match('/^max-age=(\d+)(;.*)?$/', $transportSecurityValidity, $m)) {
-					$transportSecurityValidity = (int)$m[1];
+					$transportSecurityValidity = (int) $m[1];
 					if ($transportSecurityValidity < $minimumSeconds) {
-						$msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set to at least `%d` seconds (current value: `%d`). For enhanced security, it is recommended to use a long HSTS policy.', [$minimumSeconds, $transportSecurityValidity]) . "\n";
+						$msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set to at least `%d` seconds (current value: `%d`). For enhanced security, it is recommended to use a long HSTS policy.', [$minimumSeconds, $transportSecurityValidity])."\n";
 					}
 				} elseif (!empty($transportSecurityValidity)) {
-					$msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is malformed: `%s`. For enhanced security, it is recommended to enable HSTS.', [$transportSecurityValidity]) . "\n";
+					$msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is malformed: `%s`. For enhanced security, it is recommended to enable HSTS.', [$transportSecurityValidity])."\n";
 				} else {
-					$msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set (should be at least `%d` seconds). For enhanced security, it is recommended to enable HSTS.', [$minimumSeconds]) . "\n";
+					$msg .= $this->l10n->t('- The `Strict-Transport-Security` HTTP header is not set (should be at least `%d` seconds). For enhanced security, it is recommended to enable HSTS.', [$minimumSeconds])."\n";
 				}
 
 				if (!empty($msg)) {
 					return SetupResult::warning(
-						$this->l10n->t('Some headers are not set correctly on your instance') . "\n" . $msg,
+						$this->l10n->t('Some headers are not set correctly on your instance')."\n".$msg,
 						$this->urlGenerator->linkToDocs('admin-security'),
 						$msgParameters,
 					);

apps/settings/tests/SetupChecks/SecurityHeadersTest.php

Indentation +177 added lines, -177 removed lines

@@ -20,181 +20,181 @@
 use Test\TestCase;
 
 class SecurityHeadersTest extends TestCase {
-	private IL10N&MockObject $l10n;
-	private IConfig&MockObject $config;
-	private IURLGenerator&MockObject $urlGenerator;
-	private IClientService&MockObject $clientService;
-	private LoggerInterface&MockObject $logger;
-	private SecurityHeaders&MockObject $setupcheck;
-
-	protected function setUp(): void {
-		parent::setUp();
-
-		$this->l10n = $this->createMock(IL10N::class);
-		$this->l10n->expects($this->any())
-			->method('t')
-			->willReturnCallback(function ($message, array $replace) {
-				return vsprintf($message, $replace);
-			});
-
-		$this->config = $this->createMock(IConfig::class);
-		$this->urlGenerator = $this->createMock(IURLGenerator::class);
-		$this->clientService = $this->createMock(IClientService::class);
-		$this->logger = $this->createMock(LoggerInterface::class);
-
-		$this->setupcheck = $this->getMockBuilder(SecurityHeaders::class)
-			->onlyMethods(['runRequest'])
-			->setConstructorArgs([
-				$this->l10n,
-				$this->config,
-				$this->urlGenerator,
-				$this->clientService,
-				$this->logger,
-			])
-			->getMock();
-	}
-
-	public function testInvalidStatusCode(): void {
-		$this->setupResponse(500, []);
-
-		$result = $this->setupcheck->run();
-		$this->assertMatchesRegularExpression('/^Could not check that your web server serves security headers correctly/', $result->getDescription());
-		$this->assertEquals(SetupResult::WARNING, $result->getSeverity());
-	}
-
-	public function testAllHeadersMissing(): void {
-		$this->setupResponse(200, []);
-
-		$result = $this->setupcheck->run();
-		$this->assertMatchesRegularExpression('/^Some headers are not set correctly on your instance/', $result->getDescription());
-		$this->assertEquals(SetupResult::WARNING, $result->getSeverity());
-	}
-
-	public function testSomeHeadersMissing(): void {
-		$this->setupResponse(
-			200,
-			[
-				'X-Robots-Tag' => 'noindex, nofollow',
-				'X-Frame-Options' => 'SAMEORIGIN',
-				'Strict-Transport-Security' => 'max-age=15768000;preload',
-				'X-Permitted-Cross-Domain-Policies' => 'none',
-				'Referrer-Policy' => 'no-referrer',
-			]
-		);
-
-		$result = $this->setupcheck->run();
-		$this->assertEquals(
-			"Some headers are not set correctly on your instance\n- The `X-Content-Type-Options` HTTP header is not set to `nosniff`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.\n",
-			$result->getDescription()
-		);
-		$this->assertEquals(SetupResult::WARNING, $result->getSeverity());
-	}
-
-	public static function dataSuccess(): array {
-		return [
-			// description => modifiedHeaders
-			'basic' => [[]],
-			'no-space-in-x-robots' => [['X-Robots-Tag' => 'noindex,nofollow']],
-			'strict-origin-when-cross-origin' => [['Referrer-Policy' => 'strict-origin-when-cross-origin']],
-			'referrer-no-referrer-when-downgrade' => [['Referrer-Policy' => 'no-referrer-when-downgrade']],
-			'referrer-strict-origin' => [['Referrer-Policy' => 'strict-origin']],
-			'referrer-strict-origin-when-cross-origin' => [['Referrer-Policy' => 'strict-origin-when-cross-origin']],
-			'referrer-same-origin' => [['Referrer-Policy' => 'same-origin']],
-			'hsts-minimum' => [['Strict-Transport-Security' => 'max-age=15552000']],
-			'hsts-include-subdomains' => [['Strict-Transport-Security' => 'max-age=99999999; includeSubDomains']],
-			'hsts-include-subdomains-preload' => [['Strict-Transport-Security' => 'max-age=99999999; preload; includeSubDomains']],
-		];
-	}
-
-	/**
-	 * @dataProvider dataSuccess
-	 */
-	public function testSuccess(array $headers): void {
-		$headers = array_merge(
-			[
-				'X-Content-Type-Options' => 'nosniff',
-				'X-Robots-Tag' => 'noindex, nofollow',
-				'X-Frame-Options' => 'SAMEORIGIN',
-				'Strict-Transport-Security' => 'max-age=15768000',
-				'X-Permitted-Cross-Domain-Policies' => 'none',
-				'Referrer-Policy' => 'no-referrer',
-			],
-			$headers
-		);
-		$this->setupResponse(
-			200,
-			$headers
-		);
-
-		$result = $this->setupcheck->run();
-		$this->assertEquals(
-			'Your server is correctly configured to send security headers.',
-			$result->getDescription()
-		);
-		$this->assertEquals(SetupResult::SUCCESS, $result->getSeverity());
-	}
-
-	public static function dataFailure(): array {
-		return [
-			// description => modifiedHeaders
-			'x-robots-none' => [['X-Robots-Tag' => 'none'], "- The `X-Robots-Tag` HTTP header is not set to `noindex,nofollow`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.\n"],
-			'referrer-origin' => [['Referrer-Policy' => 'origin'], "- The `Referrer-Policy` HTTP header is not set to `no-referrer`, `no-referrer-when-downgrade`, `strict-origin`, `strict-origin-when-cross-origin` or `same-origin`. This can leak referer information. See the {w3c-recommendation}.\n"],
-			'referrer-origin-when-cross-origin' => [['Referrer-Policy' => 'origin-when-cross-origin'], "- The `Referrer-Policy` HTTP header is not set to `no-referrer`, `no-referrer-when-downgrade`, `strict-origin`, `strict-origin-when-cross-origin` or `same-origin`. This can leak referer information. See the {w3c-recommendation}.\n"],
-			'referrer-unsafe-url' => [['Referrer-Policy' => 'unsafe-url'], "- The `Referrer-Policy` HTTP header is not set to `no-referrer`, `no-referrer-when-downgrade`, `strict-origin`, `strict-origin-when-cross-origin` or `same-origin`. This can leak referer information. See the {w3c-recommendation}.\n"],
-			'hsts-missing' => [['Strict-Transport-Security' => ''], "- The `Strict-Transport-Security` HTTP header is not set (should be at least `15552000` seconds). For enhanced security, it is recommended to enable HSTS.\n"],
-			'hsts-too-low' => [['Strict-Transport-Security' => 'max-age=15551999'], "- The `Strict-Transport-Security` HTTP header is not set to at least `15552000` seconds (current value: `15551999`). For enhanced security, it is recommended to use a long HSTS policy.\n"],
-			'hsts-malformed' => [['Strict-Transport-Security' => 'iAmABogusHeader342'], "- The `Strict-Transport-Security` HTTP header is malformed: `iAmABogusHeader342`. For enhanced security, it is recommended to enable HSTS.\n"],
-		];
-	}
-
-	/**
-	 * @dataProvider dataFailure
-	 */
-	public function testFailure(array $headers, string $msg): void {
-		$headers = array_merge(
-			[
-				'X-Content-Type-Options' => 'nosniff',
-				'X-Robots-Tag' => 'noindex, nofollow',
-				'X-Frame-Options' => 'SAMEORIGIN',
-				'Strict-Transport-Security' => 'max-age=15768000',
-				'X-Permitted-Cross-Domain-Policies' => 'none',
-				'Referrer-Policy' => 'no-referrer',
-			],
-			$headers
-		);
-		$this->setupResponse(
-			200,
-			$headers
-		);
-
-		$result = $this->setupcheck->run();
-		$this->assertEquals(
-			'Some headers are not set correctly on your instance' . "\n$msg",
-			$result->getDescription()
-		);
-		$this->assertEquals(SetupResult::WARNING, $result->getSeverity());
-	}
-
-	protected function setupResponse(int $statuscode, array $headers): void {
-		$response = $this->createMock(IResponse::class);
-		$response->expects($this->atLeastOnce())->method('getStatusCode')->willReturn($statuscode);
-		$response->expects($this->any())->method('getHeader')
-			->willReturnCallback(
-				fn (string $header): string => $headers[$header] ?? ''
-			);
-
-		$this->setupcheck
-			->expects($this->atLeastOnce())
-			->method('runRequest')
-			->willReturnOnConsecutiveCalls($this->generate([$response]));
-	}
-
-	/**
-	 * Helper function creates a nicer interface for mocking Generator behavior
-	 */
-	protected function generate(array $yield_values) {
-		return $this->returnCallback(function () use ($yield_values) {
-			yield from $yield_values;
-		});
-	}
+    private IL10N&MockObject $l10n;
+    private IConfig&MockObject $config;
+    private IURLGenerator&MockObject $urlGenerator;
+    private IClientService&MockObject $clientService;
+    private LoggerInterface&MockObject $logger;
+    private SecurityHeaders&MockObject $setupcheck;
+
+    protected function setUp(): void {
+        parent::setUp();
+
+        $this->l10n = $this->createMock(IL10N::class);
+        $this->l10n->expects($this->any())
+            ->method('t')
+            ->willReturnCallback(function ($message, array $replace) {
+                return vsprintf($message, $replace);
+            });
+
+        $this->config = $this->createMock(IConfig::class);
+        $this->urlGenerator = $this->createMock(IURLGenerator::class);
+        $this->clientService = $this->createMock(IClientService::class);
+        $this->logger = $this->createMock(LoggerInterface::class);
+
+        $this->setupcheck = $this->getMockBuilder(SecurityHeaders::class)
+            ->onlyMethods(['runRequest'])
+            ->setConstructorArgs([
+                $this->l10n,
+                $this->config,
+                $this->urlGenerator,
+                $this->clientService,
+                $this->logger,
+            ])
+            ->getMock();
+    }
+
+    public function testInvalidStatusCode(): void {
+        $this->setupResponse(500, []);
+
+        $result = $this->setupcheck->run();
+        $this->assertMatchesRegularExpression('/^Could not check that your web server serves security headers correctly/', $result->getDescription());
+        $this->assertEquals(SetupResult::WARNING, $result->getSeverity());
+    }
+
+    public function testAllHeadersMissing(): void {
+        $this->setupResponse(200, []);
+
+        $result = $this->setupcheck->run();
+        $this->assertMatchesRegularExpression('/^Some headers are not set correctly on your instance/', $result->getDescription());
+        $this->assertEquals(SetupResult::WARNING, $result->getSeverity());
+    }
+
+    public function testSomeHeadersMissing(): void {
+        $this->setupResponse(
+            200,
+            [
+                'X-Robots-Tag' => 'noindex, nofollow',
+                'X-Frame-Options' => 'SAMEORIGIN',
+                'Strict-Transport-Security' => 'max-age=15768000;preload',
+                'X-Permitted-Cross-Domain-Policies' => 'none',
+                'Referrer-Policy' => 'no-referrer',
+            ]
+        );
+
+        $result = $this->setupcheck->run();
+        $this->assertEquals(
+            "Some headers are not set correctly on your instance\n- The `X-Content-Type-Options` HTTP header is not set to `nosniff`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.\n",
+            $result->getDescription()
+        );
+        $this->assertEquals(SetupResult::WARNING, $result->getSeverity());
+    }
+
+    public static function dataSuccess(): array {
+        return [
+            // description => modifiedHeaders
+            'basic' => [[]],
+            'no-space-in-x-robots' => [['X-Robots-Tag' => 'noindex,nofollow']],
+            'strict-origin-when-cross-origin' => [['Referrer-Policy' => 'strict-origin-when-cross-origin']],
+            'referrer-no-referrer-when-downgrade' => [['Referrer-Policy' => 'no-referrer-when-downgrade']],
+            'referrer-strict-origin' => [['Referrer-Policy' => 'strict-origin']],
+            'referrer-strict-origin-when-cross-origin' => [['Referrer-Policy' => 'strict-origin-when-cross-origin']],
+            'referrer-same-origin' => [['Referrer-Policy' => 'same-origin']],
+            'hsts-minimum' => [['Strict-Transport-Security' => 'max-age=15552000']],
+            'hsts-include-subdomains' => [['Strict-Transport-Security' => 'max-age=99999999; includeSubDomains']],
+            'hsts-include-subdomains-preload' => [['Strict-Transport-Security' => 'max-age=99999999; preload; includeSubDomains']],
+        ];
+    }
+
+    /**
+     * @dataProvider dataSuccess
+     */
+    public function testSuccess(array $headers): void {
+        $headers = array_merge(
+            [
+                'X-Content-Type-Options' => 'nosniff',
+                'X-Robots-Tag' => 'noindex, nofollow',
+                'X-Frame-Options' => 'SAMEORIGIN',
+                'Strict-Transport-Security' => 'max-age=15768000',
+                'X-Permitted-Cross-Domain-Policies' => 'none',
+                'Referrer-Policy' => 'no-referrer',
+            ],
+            $headers
+        );
+        $this->setupResponse(
+            200,
+            $headers
+        );
+
+        $result = $this->setupcheck->run();
+        $this->assertEquals(
+            'Your server is correctly configured to send security headers.',
+            $result->getDescription()
+        );
+        $this->assertEquals(SetupResult::SUCCESS, $result->getSeverity());
+    }
+
+    public static function dataFailure(): array {
+        return [
+            // description => modifiedHeaders
+            'x-robots-none' => [['X-Robots-Tag' => 'none'], "- The `X-Robots-Tag` HTTP header is not set to `noindex,nofollow`. This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.\n"],
+            'referrer-origin' => [['Referrer-Policy' => 'origin'], "- The `Referrer-Policy` HTTP header is not set to `no-referrer`, `no-referrer-when-downgrade`, `strict-origin`, `strict-origin-when-cross-origin` or `same-origin`. This can leak referer information. See the {w3c-recommendation}.\n"],
+            'referrer-origin-when-cross-origin' => [['Referrer-Policy' => 'origin-when-cross-origin'], "- The `Referrer-Policy` HTTP header is not set to `no-referrer`, `no-referrer-when-downgrade`, `strict-origin`, `strict-origin-when-cross-origin` or `same-origin`. This can leak referer information. See the {w3c-recommendation}.\n"],
+            'referrer-unsafe-url' => [['Referrer-Policy' => 'unsafe-url'], "- The `Referrer-Policy` HTTP header is not set to `no-referrer`, `no-referrer-when-downgrade`, `strict-origin`, `strict-origin-when-cross-origin` or `same-origin`. This can leak referer information. See the {w3c-recommendation}.\n"],
+            'hsts-missing' => [['Strict-Transport-Security' => ''], "- The `Strict-Transport-Security` HTTP header is not set (should be at least `15552000` seconds). For enhanced security, it is recommended to enable HSTS.\n"],
+            'hsts-too-low' => [['Strict-Transport-Security' => 'max-age=15551999'], "- The `Strict-Transport-Security` HTTP header is not set to at least `15552000` seconds (current value: `15551999`). For enhanced security, it is recommended to use a long HSTS policy.\n"],
+            'hsts-malformed' => [['Strict-Transport-Security' => 'iAmABogusHeader342'], "- The `Strict-Transport-Security` HTTP header is malformed: `iAmABogusHeader342`. For enhanced security, it is recommended to enable HSTS.\n"],
+        ];
+    }
+
+    /**
+     * @dataProvider dataFailure
+     */
+    public function testFailure(array $headers, string $msg): void {
+        $headers = array_merge(
+            [
+                'X-Content-Type-Options' => 'nosniff',
+                'X-Robots-Tag' => 'noindex, nofollow',
+                'X-Frame-Options' => 'SAMEORIGIN',
+                'Strict-Transport-Security' => 'max-age=15768000',
+                'X-Permitted-Cross-Domain-Policies' => 'none',
+                'Referrer-Policy' => 'no-referrer',
+            ],
+            $headers
+        );
+        $this->setupResponse(
+            200,
+            $headers
+        );
+
+        $result = $this->setupcheck->run();
+        $this->assertEquals(
+            'Some headers are not set correctly on your instance' . "\n$msg",
+            $result->getDescription()
+        );
+        $this->assertEquals(SetupResult::WARNING, $result->getSeverity());
+    }
+
+    protected function setupResponse(int $statuscode, array $headers): void {
+        $response = $this->createMock(IResponse::class);
+        $response->expects($this->atLeastOnce())->method('getStatusCode')->willReturn($statuscode);
+        $response->expects($this->any())->method('getHeader')
+            ->willReturnCallback(
+                fn (string $header): string => $headers[$header] ?? ''
+            );
+
+        $this->setupcheck
+            ->expects($this->atLeastOnce())
+            ->method('runRequest')
+            ->willReturnOnConsecutiveCalls($this->generate([$response]));
+    }
+
+    /**
+     * Helper function creates a nicer interface for mocking Generator behavior
+     */
+    protected function generate(array $yield_values) {
+        return $this->returnCallback(function () use ($yield_values) {
+            yield from $yield_values;
+        });
+    }
 }