diogo/symfony
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[WebProfilerBundle] Handle Content-Security-Policy-Report-Only header correctly

Browse Source
This commit is contained in:
Romain Neutron 2017-03-17 17:52:43 +01:00
parent d50885cc16
commit b0ba698111
No known key found for this signature in database
GPG Key ID: 201FC7CF9F0CA3ED
2 changed files with 13 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/Symfony/Bundle/WebProfilerBundle/Csp/ContentSecurityPolicyHandler.php
View File

@ -108,6 +108,7 @@ class ContentSecurityPolicyHandler
{
$response->headers->remove('X-Content-Security-Policy');
$response->headers->remove('Content-Security-Policy');
$response->headers->remove('Content-Security-Policy-Report-Only');
}
/**
@ -257,6 +258,10 @@ class ContentSecurityPolicyHandler
$headers['Content-Security-Policy'] = $this->parseDirectives($response->headers->get('Content-Security-Policy'));
}
if ($response->headers->has('Content-Security-Policy-Report-Only')) {
$headers['Content-Security-Policy-Report-Only'] = $this->parseDirectives($response->headers->get('Content-Security-Policy-Report-Only'));
}
if ($response->headers->has('X-Content-Security-Policy')) {
$headers['X-Content-Security-Policy'] = $this->parseDirectives($response->headers->get('X-Content-Security-Policy'));
}

16
src/Symfony/Bundle/WebProfilerBundle/Tests/Csp/ContentSecurityPolicyHandlerTest.php
View File

@ -97,41 +97,41 @@ class ContentSecurityPolicyHandlerTest extends TestCase
array('csp_script_nonce' => $nonce, 'csp_style_nonce' => $nonce),
$this->createRequest(),
$this->createResponse(),
array('Content-Security-Policy' => null, 'X-Content-Security-Policy' => null),
array('Content-Security-Policy' => null, 'Content-Security-Policy-Report-Only' => null, 'X-Content-Security-Policy' => null),
),
array(
$nonce, array('csp_script_nonce' => $requestScriptNonce, 'csp_style_nonce' => $requestStyleNonce),
$this->createRequest($requestNonceHeaders),
$this->createResponse($responseNonceHeaders),
array('Content-Security-Policy' => null, 'X-Content-Security-Policy' => null),
array('Content-Security-Policy' => null, 'Content-Security-Policy-Report-Only' => null, 'X-Content-Security-Policy' => null),
),
array(
$nonce,
array('csp_script_nonce' => $requestScriptNonce, 'csp_style_nonce' => $requestStyleNonce),
$this->createRequest($requestNonceHeaders),
$this->createResponse(),
array('Content-Security-Policy' => null, 'X-Content-Security-Policy' => null),
array('Content-Security-Policy' => null, 'Content-Security-Policy-Report-Only' => null, 'X-Content-Security-Policy' => null),
),
array(
$nonce,
array('csp_script_nonce' => $responseScriptNonce, 'csp_style_nonce' => $responseStyleNonce),
$this->createRequest(),
$this->createResponse($responseNonceHeaders),
array('Content-Security-Policy' => null, 'X-Content-Security-Policy' => null),
array('Content-Security-Policy' => null, 'Content-Security-Policy-Report-Only' => null, 'X-Content-Security-Policy' => null),
),
array(
$nonce,
array('csp_script_nonce' => $nonce, 'csp_style_nonce' => $nonce),
$this->createRequest(),
$this->createResponse(array('Content-Security-Policy' => 'frame-ancestors https: ; form-action: https:')),
array('Content-Security-Policy' => 'frame-ancestors https: ; form-action: https:', 'X-Content-Security-Policy' => null),
$this->createResponse(array('Content-Security-Policy' => 'frame-ancestors https: ; form-action: https:', 'Content-Security-Policy-Report-Only' => 'frame-ancestors http: ; form-action: http:')),
array('Content-Security-Policy' => 'frame-ancestors https: ; form-action: https:', 'Content-Security-Policy-Report-Only' => 'frame-ancestors http: ; form-action: http:', 'X-Content-Security-Policy' => null),
),
array(
$nonce,
array('csp_script_nonce' => $nonce, 'csp_style_nonce' => $nonce),
$this->createRequest(),
$this->createResponse(array('Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'')),
array('Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'; style-src \'self\' domain.com \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'X-Content-Security-Policy' => null),
$this->createResponse(array('Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'', 'Content-Security-Policy-Report-Only' => 'default-src \'self\' domain-report-only.com; script-src \'self\' \'unsafe-inline\'')),
array('Content-Security-Policy' => 'default-src \'self\' domain.com; script-src \'self\' \'unsafe-inline\'; style-src \'self\' domain.com \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'Content-Security-Policy-Report-Only' => 'default-src \'self\' domain-report-only.com; script-src \'self\' \'unsafe-inline\'; style-src \'self\' domain-report-only.com \'unsafe-inline\' \'nonce-'.$nonce.'\'', 'X-Content-Security-Policy' => null),
),
array(
$nonce,