Content: Updated tests and CSP usage of content script setting

Updates CSP to use new content_filtering option.
Splits out content filtering tests to their own class.
Updated tests where needed to adapt to changes.

Author: ssddanbrown

app/Entities/Tools/PageContent.php

@@ -339,7 +339,7 @@ protected function getContentCacheKey(string $html): string
     {
         $contentHash = md5($html);
         $contentId = $this->page->id;
-        $contentTime = $this->page->updated_at->timestamp;
+        $contentTime = $this->page->updated_at?->timestamp ?? time();
         $appVersion = AppVersion::get();
         return "page-content-cache::{$appVersion}::{$contentId}::{$contentTime}::{$contentHash}";
     }

app/Theming/CustomHtmlHeadContentProvider.php

@@ -41,7 +41,7 @@ public function forExport(): string
         $hash = md5($content);
 
         return $this->cache->remember('custom-head-export:' . $hash, 86400, function () use ($content) {
-            $config = new HtmlContentFilterConfig(filterOutNonContentElements: false);
+            $config = new HtmlContentFilterConfig(filterOutNonContentElements: false, useAllowListFilter: false);
             return (new HtmlContentFilter($config))->filterString($content);
         });
     }

app/Util/ConfiguredHtmlPurifier.php

@@ -62,7 +62,7 @@ protected function setConfig(HTMLPurifier_Config $config): void
         $config->set('Attr.EnableID', true);
         $config->set('Attr.ID.HTML5', true);
         $config->set('Output.FixInnerHTML', false);
-        $config->set('URI.SafeIframeRegexp', '%^(http://|https://)%');
+        $config->set('URI.SafeIframeRegexp', '%^(http://|https://|//)%');
         $config->set('URI.AllowedSchemes', [
             'http' => true,
             'https' => true,

app/Util/CspService.php

@@ -65,7 +65,7 @@ public function allowedIFrameHostsConfigured(): bool
      */
     protected function getScriptSrc(): string
     {
-        if (config('app.allow_content_scripts')) {
+        if ($this->scriptFilteringDisabled()) {
             return '';
         }
 
@@ -108,7 +108,7 @@ protected function getFrameSrc(): string
      */
     protected function getObjectSrc(): string
     {
-        if (config('app.allow_content_scripts')) {
+        if ($this->scriptFilteringDisabled()) {
             return '';
         }
 
@@ -124,6 +124,11 @@ protected function getBaseUri(): string
         return "base-uri 'self'";
     }
 
+    protected function scriptFilteringDisabled(): bool
+    {
+        return !HtmlContentFilterConfig::fromConfigString(config('app.content_filtering'))->filterOutJavaScript;
+    }
+
     protected function getAllowedIframeHosts(): array
     {
         $hosts = config('app.iframe_hosts') ?? '';