[WebProfiler] Remove 'none' when appending CSP tokens
This commit is contained in:
parent
6541ac2d03
commit
967bc4a860
@ -133,6 +133,12 @@ class ContentSecurityPolicyHandler
|
||||
continue;
|
||||
}
|
||||
|
||||
if (['\'none\''] === $fallback) {
|
||||
// Fallback came from "default-src: 'none'"
|
||||
// 'none' is invalid if it's not the only expression in the source list, so we leave it out
|
||||
$fallback = [];
|
||||
}
|
||||
|
||||
$headers[$header][$type] = $fallback;
|
||||
}
|
||||
$ruleIsSet = true;
|
||||
|
@ -140,6 +140,13 @@ class ContentSecurityPolicyHandlerTest extends TestCase
|
||||
$this->createResponse(['Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\'; style-src \'self\' \'unsafe-inline\'; style-src-elem \'self\'', 'Content-Security-Policy-Report-Only' => 'default-src \'self\' domain-report-only.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\'; style-src \'self\' \'unsafe-inline\'; style-src-elem \'self\'']),
|
||||
['Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\' \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'self\' \'unsafe-inline\'; style-src-elem \'self\' \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'Content-Security-Policy-Report-Only' => 'default-src \'self\' domain-report-only.com; script-src \'self\' \'unsafe-inline\'; script-src-elem \'self\' \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'self\' \'unsafe-inline\'; style-src-elem \'self\' \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'X-Content-Security-Policy' => null],
|
||||
],
|
||||
[
|
||||
$nonce,
|
||||
['csp_script_nonce' => $nonce, 'csp_style_nonce' => $nonce],
|
||||
$this->createRequest(),
|
||||
$this->createResponse(['Content-Security-Policy' => 'default-src \'none\'', 'Content-Security-Policy-Report-Only' => 'default-src \'none\'']),
|
||||
['Content-Security-Policy' => 'default-src \'none\'; script-src \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'Content-Security-Policy-Report-Only' => 'default-src \'none\'; script-src \'unsafe-inline\' \'nonce-'.$nonce.'\'; style-src \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'X-Content-Security-Policy' => null],
|
||||
],
|
||||
[
|
||||
$nonce,
|
||||
['csp_script_nonce' => $nonce, 'csp_style_nonce' => $nonce],
|
||||
|
Reference in New Issue
Block a user