Skip to content

Commit 4f7c1d6

Browse files
jim-parryjim-parry
committed
Allow array options, fix sandbox
1 parent c41698f commit 4f7c1d6

4 files changed

Lines changed: 100 additions & 98 deletions

File tree

‎application/Config/ContentSecurityPolicy.php‎

Lines changed: 27 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -9,43 +9,40 @@
99
* choose to use it. The values here will be read in and set as defaults
1010
* for the site. If needed, they can be overridden on a page-by-page basis.
1111
*
12+
* Suggested reference for explanations:
13+
* https://www.html5rocks.com/en/tutorials/security/content-security-policy/
14+
*
1215
* @package Config
1316
*/
1417
class ContentSecurityPolicy extends BaseConfig
1518
{
16-
public $reportOnly = false;
17-
18-
public $defaultSrc = 'none';
19-
20-
public $scriptSrc = 'self';
21-
22-
public $styleSrc = 'self';
23-
24-
public $imageSrc = 'self';
25-
26-
public $baseURI = 'none';
27-
28-
public $childSrc = null;
29-
30-
public $connectSrc = 'self';
31-
32-
public $fontSrc = null;
33-
34-
public $formAction = null;
35-
19+
// broadbrush CSP management
20+
21+
public $reportOnly = false; // default CSP report context
22+
public $reportURI = null; // URL to send violation reports to
23+
public $upgradeInsecureRequests = false; // toggle for forcing https
24+
25+
// sources allowed; string or array of strings
26+
// Note: once you set a policy to 'none', it cannot be further restricted
27+
28+
public $defaultSrc = null;
29+
public $scriptSrc = 'self';
30+
public $styleSrc = 'self';
31+
public $imageSrc = 'self';
32+
public $baseURI = null;
33+
public $childSrc = null;
34+
public $connectSrc = 'self';
35+
public $fontSrc = null;
36+
public $formAction = null;
3637
public $frameAncestors = null;
38+
public $mediaSrc = null;
39+
public $objectSrc = null;
40+
public $manifestSrc = null;
3741

38-
public $mediaSrc = null;
39-
40-
public $objectSrc = null;
41-
42-
public $manifestSrc = null;
43-
42+
// mime types allowed; string or array of strings
4443
public $pluginTypes = null;
4544

46-
public $reportURI = null;
47-
48-
public $sandbox = false;
45+
// list of actions allowed; string or array of strings
46+
public $sandbox = null;
4947

50-
public $upgradeInsecureRequests = false;
5148
}

‎system/HTTP/ContentSecurityPolicy.php‎

Lines changed: 40 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ class ContentSecurityPolicy
9999
*
100100
* @var type
101101
*/
102-
protected $frameAncestors = null;
102+
protected $frameAncestors = [];
103103

104104
/**
105105
* Used for security enforcement
@@ -125,9 +125,9 @@ class ContentSecurityPolicy
125125
/**
126126
* Used for security enforcement
127127
*
128-
* @var type
128+
* @var array
129129
*/
130-
protected $pluginTypes = null;
130+
protected $pluginTypes = [];
131131

132132
/**
133133
* Used for security enforcement
@@ -139,9 +139,9 @@ class ContentSecurityPolicy
139139
/**
140140
* Used for security enforcement
141141
*
142-
* @var boolean
142+
* @var array
143143
*/
144-
protected $sandbox = false;
144+
protected $sandbox = [];
145145

146146
/**
147147
* Used for security enforcement
@@ -249,9 +249,6 @@ public function finalize(ResponseInterface &$response)
249249
$this->buildHeaders($response);
250250
}
251251

252-
//--------------------------------------------------------------------
253-
//--------------------------------------------------------------------
254-
// Setters
255252
//--------------------------------------------------------------------
256253

257254
/**
@@ -275,20 +272,20 @@ public function reportOnly(bool $value = true)
275272
//--------------------------------------------------------------------
276273

277274
/**
278-
* Sets the base_uri value. Can be either a URI class or a simple string.
275+
* Adds a new base_uri value. Can be either a URI class or a simple string.
279276
*
280277
* base_uri restricts the URLs that can appear in a page’s <base> element.
281278
*
282279
* @see http://www.w3.org/TR/CSP/#directive-base-uri
283280
*
284-
* @param string $uri
281+
* @param string|array $uri
285282
* @param boolean|null $override
286283
*
287284
* @return $this
288285
*/
289-
public function setBaseURI($uri, ?bool $override = null)
286+
public function addBaseURI($uri, ?bool $override = null)
290287
{
291-
$this->baseURI = [(string) $uri => $override ?? $this->reportOnly];
288+
$this->addOption($uri, 'baseURI', $override ?? $this->reportOnly);
292289

293290
return $this;
294291
}
@@ -305,7 +302,7 @@ public function setBaseURI($uri, ?bool $override = null)
305302
*
306303
* @see http://www.w3.org/TR/CSP/#directive-child-src
307304
*
308-
* @param $uri
305+
* @param string|array $uri
309306
* @param boolean|null $override
310307
*
311308
* @return $this
@@ -328,7 +325,7 @@ public function addChildSrc($uri, ?bool $override = null)
328325
*
329326
* @see http://www.w3.org/TR/CSP/#directive-connect-src
330327
*
331-
* @param $uri
328+
* @param string|array $uri
332329
* @param boolean|null $override
333330
*
334331
* @return $this
@@ -351,7 +348,7 @@ public function addConnectSrc($uri, ?bool $override = null)
351348
*
352349
* @see http://www.w3.org/TR/CSP/#directive-default-src
353350
*
354-
* @param $uri
351+
* @param string|array $uri
355352
* @param boolean|null $override
356353
*
357354
* @return $this
@@ -373,7 +370,7 @@ public function setDefaultSrc($uri, ?bool $override = null)
373370
*
374371
* @see http://www.w3.org/TR/CSP/#directive-font-src
375372
*
376-
* @param $uri
373+
* @param string|array $uri
377374
* @param boolean|null $override
378375
*
379376
* @return $this
@@ -393,7 +390,7 @@ public function addFontSrc($uri, ?bool $override = null)
393390
*
394391
* @see http://www.w3.org/TR/CSP/#directive-form-action
395392
*
396-
* @param $uri
393+
* @param string|array $uri
397394
* @param boolean|null $override
398395
*
399396
* @return $this
@@ -413,7 +410,7 @@ public function addFormAction($uri, ?bool $override = null)
413410
*
414411
* @see http://www.w3.org/TR/CSP/#directive-frame-ancestors
415412
*
416-
* @param $uri
413+
* @param string|array $uri
417414
* @param boolean|null $override
418415
*
419416
* @return $this
@@ -433,7 +430,7 @@ public function addFrameAncestor($uri, ?bool $override = null)
433430
*
434431
* @see http://www.w3.org/TR/CSP/#directive-img-src
435432
*
436-
* @param $uri
433+
* @param string|array $uri
437434
* @param boolean|null $override
438435
*
439436
* @return $this
@@ -453,7 +450,7 @@ public function addImageSrc($uri, ?bool $override = null)
453450
*
454451
* @see http://www.w3.org/TR/CSP/#directive-media-src
455452
*
456-
* @param $uri
453+
* @param string|array $uri
457454
* @param boolean|null $override
458455
*
459456
* @return $this
@@ -473,7 +470,7 @@ public function addMediaSrc($uri, ?bool $override = null)
473470
*
474471
* @see https://www.w3.org/TR/CSP/#directive-manifest-src
475472
*
476-
* @param $uri
473+
* @param string|array $uri
477474
* @param boolean|null $override
478475
*
479476
* @return $this
@@ -493,7 +490,7 @@ public function addManifestSrc($uri, ?bool $override = null)
493490
*
494491
* @see http://www.w3.org/TR/CSP/#directive-object-src
495492
*
496-
* @param $uri
493+
* @param string|array $uri
497494
* @param boolean|null $override
498495
*
499496
* @return $this
@@ -513,7 +510,7 @@ public function addObjectSrc($uri, ?bool $override = null)
513510
*
514511
* @see http://www.w3.org/TR/CSP/#directive-plugin-types
515512
*
516-
* @param string $mime One or more plugin mime types, separate by spaces
513+
* @param string|array $mime One or more plugin mime types, separate by spaces
517514
* @param boolean|null $override
518515
*
519516
* @return $this
@@ -533,7 +530,7 @@ public function addPluginType($mime, ?bool $override = null)
533530
*
534531
* @see http://www.w3.org/TR/CSP/#directive-report-uri
535532
*
536-
* @param $uri
533+
* @param string $uri
537534
*
538535
* @return $this
539536
*/
@@ -552,21 +549,14 @@ public function setReportURI($uri)
552549
*
553550
* @see http://www.w3.org/TR/CSP/#directive-sandbox
554551
*
555-
* @param boolean $value
556-
* @param array $flags An array of sandbox flags that can be added to the directive.
552+
* @param string|array $flags An array of sandbox flags that can be added to the directive.
553+
* @param boolean|null $override
557554
*
558555
* @return $this
559556
*/
560-
public function setSandbox(bool $value = true, array $flags = null)
557+
public function addSandbox($flags, ?bool $override = null)
561558
{
562-
if (empty($this->sandbox) && empty($flags))
563-
{
564-
$this->sandbox = $value;
565-
}
566-
else
567-
{
568-
$this->sandbox = $flags;
569-
}
559+
$this->addOption($flags, 'sandbox', $override ?? $this->reportOnly);
570560
return $this;
571561
}
572562

@@ -578,7 +568,7 @@ public function setSandbox(bool $value = true, array $flags = null)
578568
*
579569
* @see http://www.w3.org/TR/CSP/#directive-connect-src
580570
*
581-
* @param $uri
571+
* @param string|array $uri
582572
* @param boolean|null $override
583573
*
584574
* @return $this
@@ -598,7 +588,7 @@ public function addScriptSrc($uri, ?bool $override = null)
598588
*
599589
* @see http://www.w3.org/TR/CSP/#directive-connect-src
600590
*
601-
* @param $uri
591+
* @param string|array $uri
602592
* @param boolean|null $override
603593
*
604594
* @return $this
@@ -616,7 +606,7 @@ public function addStyleSrc($uri, ?bool $override = null)
616606
* Sets whether the user agents should rewrite URL schemes, changing
617607
* HTTP to HTTPS.
618608
*
619-
* @param boolean|true $value
609+
* @param boolean $value
620610
*
621611
* @return $this
622612
*/
@@ -627,15 +617,14 @@ public function upgradeInsecureRequests(bool $value = true)
627617
return $this;
628618
}
629619

630-
//--------------------------------------------------------------------
631620
//--------------------------------------------------------------------
632621
// Utility
633622
//--------------------------------------------------------------------
634623

635624
/**
636625
* DRY method to add an string or array to a class property.
637626
*
638-
* @param $options
627+
* @param string|array $options
639628
* @param string $target
640629
* @param boolean|null $override
641630
*/
@@ -649,14 +638,10 @@ protected function addOption($options, string $target, ?bool $override = null)
649638

650639
if (is_array($options))
651640
{
652-
$newOptions = [];
653641
foreach ($options as $opt)
654642
{
655-
$newOptions[] = [$opt => $override ?? $this->reportOnly];
643+
$this->{$target}[$opt] = $override ?? $this->reportOnly;
656644
}
657-
658-
$this->{$target} = array_merge($this->{$target}, $newOptions);
659-
unset($newOptions);
660645
}
661646
else
662647
{
@@ -750,6 +735,16 @@ protected function buildHeaders(ResponseInterface &$response)
750735
'report-uri' => 'reportURI',
751736
];
752737

738+
// inject default base & default URIs if needed
739+
if (empty($this->baseURI))
740+
{
741+
$this->baseURI = 'none';
742+
}
743+
if (empty($this->defaultURI))
744+
{
745+
$this->defaultURI = 'none';
746+
}
747+
753748
foreach ($directives as $name => $property)
754749
{
755750
// base_uri
@@ -806,8 +801,6 @@ protected function addToHeader(string $name, $values = null)
806801
{
807802
if (empty($values))
808803
{
809-
// It's possible that directives like 'sandbox' will not
810-
// have any values passed in, so add them to the main policy.
811804
$this->tempHeaders[$name] = null;
812805
return;
813806
}

0 commit comments

Comments
 (0)