Skip to content

Commit 902a89a

Browse files
jim-parryjim-parry
committed
Change naming and explain better
1 parent 4f7c1d6 commit 902a89a

4 files changed

Lines changed: 107 additions & 76 deletions

File tree

‎application/Config/ContentSecurityPolicy.php‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -25,18 +25,18 @@ class ContentSecurityPolicy extends BaseConfig
2525
// sources allowed; string or array of strings
2626
// Note: once you set a policy to 'none', it cannot be further restricted
2727

28-
public $defaultSrc = null;
28+
public $defaultSrc = 'self';
2929
public $scriptSrc = 'self';
3030
public $styleSrc = 'self';
3131
public $imageSrc = 'self';
32-
public $baseURI = null;
33-
public $childSrc = null;
32+
public $baseURI = 'self';
33+
public $childSrc = 'self';
3434
public $connectSrc = 'self';
3535
public $fontSrc = null;
36-
public $formAction = null;
36+
public $formAction = 'self';
3737
public $frameAncestors = null;
3838
public $mediaSrc = null;
39-
public $objectSrc = null;
39+
public $objectSrc = 'self';
4040
public $manifestSrc = null;
4141

4242
// mime types allowed; string or array of strings

‎system/HTTP/ContentSecurityPolicy.php‎

Lines changed: 51 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -279,13 +279,13 @@ public function reportOnly(bool $value = true)
279279
* @see http://www.w3.org/TR/CSP/#directive-base-uri
280280
*
281281
* @param string|array $uri
282-
* @param boolean|null $override
282+
* @param boolean|null $explicitReporting
283283
*
284284
* @return $this
285285
*/
286-
public function addBaseURI($uri, ?bool $override = null)
286+
public function addBaseURI($uri, ?bool $explicitReporting = null)
287287
{
288-
$this->addOption($uri, 'baseURI', $override ?? $this->reportOnly);
288+
$this->addOption($uri, 'baseURI', $explicitReporting ?? $this->reportOnly);
289289

290290
return $this;
291291
}
@@ -303,13 +303,13 @@ public function addBaseURI($uri, ?bool $override = null)
303303
* @see http://www.w3.org/TR/CSP/#directive-child-src
304304
*
305305
* @param string|array $uri
306-
* @param boolean|null $override
306+
* @param boolean|null $explicitReporting
307307
*
308308
* @return $this
309309
*/
310-
public function addChildSrc($uri, ?bool $override = null)
310+
public function addChildSrc($uri, ?bool $explicitReporting = null)
311311
{
312-
$this->addOption($uri, 'childSrc', $override ?? $this->reportOnly);
312+
$this->addOption($uri, 'childSrc', $explicitReporting ?? $this->reportOnly);
313313

314314
return $this;
315315
}
@@ -326,13 +326,13 @@ public function addChildSrc($uri, ?bool $override = null)
326326
* @see http://www.w3.org/TR/CSP/#directive-connect-src
327327
*
328328
* @param string|array $uri
329-
* @param boolean|null $override
329+
* @param boolean|null $explicitReporting
330330
*
331331
* @return $this
332332
*/
333-
public function addConnectSrc($uri, ?bool $override = null)
333+
public function addConnectSrc($uri, ?bool $explicitReporting = null)
334334
{
335-
$this->addOption($uri, 'connectSrc', $override ?? $this->reportOnly);
335+
$this->addOption($uri, 'connectSrc', $explicitReporting ?? $this->reportOnly);
336336

337337
return $this;
338338
}
@@ -349,13 +349,13 @@ public function addConnectSrc($uri, ?bool $override = null)
349349
* @see http://www.w3.org/TR/CSP/#directive-default-src
350350
*
351351
* @param string|array $uri
352-
* @param boolean|null $override
352+
* @param boolean|null $explicitReporting
353353
*
354354
* @return $this
355355
*/
356-
public function setDefaultSrc($uri, ?bool $override = null)
356+
public function setDefaultSrc($uri, ?bool $explicitReporting = null)
357357
{
358-
$this->defaultSrc = [(string) $uri => $override ?? $this->reportOnly];
358+
$this->defaultSrc = [(string) $uri => $explicitReporting ?? $this->reportOnly];
359359

360360
return $this;
361361
}
@@ -371,13 +371,13 @@ public function setDefaultSrc($uri, ?bool $override = null)
371371
* @see http://www.w3.org/TR/CSP/#directive-font-src
372372
*
373373
* @param string|array $uri
374-
* @param boolean|null $override
374+
* @param boolean|null $explicitReporting
375375
*
376376
* @return $this
377377
*/
378-
public function addFontSrc($uri, ?bool $override = null)
378+
public function addFontSrc($uri, ?bool $explicitReporting = null)
379379
{
380-
$this->addOption($uri, 'fontSrc', $override ?? $this->reportOnly);
380+
$this->addOption($uri, 'fontSrc', $explicitReporting ?? $this->reportOnly);
381381

382382
return $this;
383383
}
@@ -391,13 +391,13 @@ public function addFontSrc($uri, ?bool $override = null)
391391
* @see http://www.w3.org/TR/CSP/#directive-form-action
392392
*
393393
* @param string|array $uri
394-
* @param boolean|null $override
394+
* @param boolean|null $explicitReporting
395395
*
396396
* @return $this
397397
*/
398-
public function addFormAction($uri, ?bool $override = null)
398+
public function addFormAction($uri, ?bool $explicitReporting = null)
399399
{
400-
$this->addOption($uri, 'formAction', $override ?? $this->reportOnly);
400+
$this->addOption($uri, 'formAction', $explicitReporting ?? $this->reportOnly);
401401

402402
return $this;
403403
}
@@ -411,13 +411,13 @@ public function addFormAction($uri, ?bool $override = null)
411411
* @see http://www.w3.org/TR/CSP/#directive-frame-ancestors
412412
*
413413
* @param string|array $uri
414-
* @param boolean|null $override
414+
* @param boolean|null $explicitReporting
415415
*
416416
* @return $this
417417
*/
418-
public function addFrameAncestor($uri, ?bool $override = null)
418+
public function addFrameAncestor($uri, ?bool $explicitReporting = null)
419419
{
420-
$this->addOption($uri, 'frameAncestors', $override ?? $this->reportOnly);
420+
$this->addOption($uri, 'frameAncestors', $explicitReporting ?? $this->reportOnly);
421421

422422
return $this;
423423
}
@@ -431,13 +431,13 @@ public function addFrameAncestor($uri, ?bool $override = null)
431431
* @see http://www.w3.org/TR/CSP/#directive-img-src
432432
*
433433
* @param string|array $uri
434-
* @param boolean|null $override
434+
* @param boolean|null $explicitReporting
435435
*
436436
* @return $this
437437
*/
438-
public function addImageSrc($uri, ?bool $override = null)
438+
public function addImageSrc($uri, ?bool $explicitReporting = null)
439439
{
440-
$this->addOption($uri, 'imageSrc', $override ?? $this->reportOnly);
440+
$this->addOption($uri, 'imageSrc', $explicitReporting ?? $this->reportOnly);
441441

442442
return $this;
443443
}
@@ -451,13 +451,13 @@ public function addImageSrc($uri, ?bool $override = null)
451451
* @see http://www.w3.org/TR/CSP/#directive-media-src
452452
*
453453
* @param string|array $uri
454-
* @param boolean|null $override
454+
* @param boolean|null $explicitReporting
455455
*
456456
* @return $this
457457
*/
458-
public function addMediaSrc($uri, ?bool $override = null)
458+
public function addMediaSrc($uri, ?bool $explicitReporting = null)
459459
{
460-
$this->addOption($uri, 'mediaSrc', $override ?? $this->reportOnly);
460+
$this->addOption($uri, 'mediaSrc', $explicitReporting ?? $this->reportOnly);
461461

462462
return $this;
463463
}
@@ -471,13 +471,13 @@ public function addMediaSrc($uri, ?bool $override = null)
471471
* @see https://www.w3.org/TR/CSP/#directive-manifest-src
472472
*
473473
* @param string|array $uri
474-
* @param boolean|null $override
474+
* @param boolean|null $explicitReporting
475475
*
476476
* @return $this
477477
*/
478-
public function addManifestSrc($uri, ?bool $override = null)
478+
public function addManifestSrc($uri, ?bool $explicitReporting = null)
479479
{
480-
$this->addOption($uri, 'manifestSrc', $override ?? $this->reportOnly);
480+
$this->addOption($uri, 'manifestSrc', $explicitReporting ?? $this->reportOnly);
481481

482482
return $this;
483483
}
@@ -491,13 +491,13 @@ public function addManifestSrc($uri, ?bool $override = null)
491491
* @see http://www.w3.org/TR/CSP/#directive-object-src
492492
*
493493
* @param string|array $uri
494-
* @param boolean|null $override
494+
* @param boolean|null $explicitReporting
495495
*
496496
* @return $this
497497
*/
498-
public function addObjectSrc($uri, ?bool $override = null)
498+
public function addObjectSrc($uri, ?bool $explicitReporting = null)
499499
{
500-
$this->addOption($uri, 'objectSrc', $override ?? $this->reportOnly);
500+
$this->addOption($uri, 'objectSrc', $explicitReporting ?? $this->reportOnly);
501501

502502
return $this;
503503
}
@@ -510,14 +510,14 @@ public function addObjectSrc($uri, ?bool $override = null)
510510
*
511511
* @see http://www.w3.org/TR/CSP/#directive-plugin-types
512512
*
513-
* @param string|array $mime One or more plugin mime types, separate by spaces
514-
* @param boolean|null $override
513+
* @param string|array $mime One or more plugin mime types, separate by spaces
514+
* @param boolean|null $explicitReporting
515515
*
516516
* @return $this
517517
*/
518-
public function addPluginType($mime, ?bool $override = null)
518+
public function addPluginType($mime, ?bool $explicitReporting = null)
519519
{
520-
$this->addOption($mime, 'pluginTypes', $override ?? $this->reportOnly);
520+
$this->addOption($mime, 'pluginTypes', $explicitReporting ?? $this->reportOnly);
521521

522522
return $this;
523523
}
@@ -549,14 +549,14 @@ public function setReportURI($uri)
549549
*
550550
* @see http://www.w3.org/TR/CSP/#directive-sandbox
551551
*
552-
* @param string|array $flags An array of sandbox flags that can be added to the directive.
553-
* @param boolean|null $override
552+
* @param string|array $flags An array of sandbox flags that can be added to the directive.
553+
* @param boolean|null $explicitReporting
554554
*
555555
* @return $this
556556
*/
557-
public function addSandbox($flags, ?bool $override = null)
557+
public function addSandbox($flags, ?bool $explicitReporting = null)
558558
{
559-
$this->addOption($flags, 'sandbox', $override ?? $this->reportOnly);
559+
$this->addOption($flags, 'sandbox', $explicitReporting ?? $this->reportOnly);
560560
return $this;
561561
}
562562

@@ -569,13 +569,13 @@ public function addSandbox($flags, ?bool $override = null)
569569
* @see http://www.w3.org/TR/CSP/#directive-connect-src
570570
*
571571
* @param string|array $uri
572-
* @param boolean|null $override
572+
* @param boolean|null $explicitReporting
573573
*
574574
* @return $this
575575
*/
576-
public function addScriptSrc($uri, ?bool $override = null)
576+
public function addScriptSrc($uri, ?bool $explicitReporting = null)
577577
{
578-
$this->addOption($uri, 'scriptSrc', $override ?? $this->reportOnly);
578+
$this->addOption($uri, 'scriptSrc', $explicitReporting ?? $this->reportOnly);
579579

580580
return $this;
581581
}
@@ -589,13 +589,13 @@ public function addScriptSrc($uri, ?bool $override = null)
589589
* @see http://www.w3.org/TR/CSP/#directive-connect-src
590590
*
591591
* @param string|array $uri
592-
* @param boolean|null $override
592+
* @param boolean|null $explicitReporting
593593
*
594594
* @return $this
595595
*/
596-
public function addStyleSrc($uri, ?bool $override = null)
596+
public function addStyleSrc($uri, ?bool $explicitReporting = null)
597597
{
598-
$this->addOption($uri, 'styleSrc', $override ?? $this->reportOnly);
598+
$this->addOption($uri, 'styleSrc', $explicitReporting ?? $this->reportOnly);
599599

600600
return $this;
601601
}
@@ -626,9 +626,9 @@ public function upgradeInsecureRequests(bool $value = true)
626626
*
627627
* @param string|array $options
628628
* @param string $target
629-
* @param boolean|null $override
629+
* @param boolean|null $explicitReporting
630630
*/
631-
protected function addOption($options, string $target, ?bool $override = null)
631+
protected function addOption($options, string $target, ?bool $explicitReporting = null)
632632
{
633633
// Ensure we have an array to work with...
634634
if (is_string($this->{$target}))
@@ -640,12 +640,12 @@ protected function addOption($options, string $target, ?bool $override = null)
640640
{
641641
foreach ($options as $opt)
642642
{
643-
$this->{$target}[$opt] = $override ?? $this->reportOnly;
643+
$this->{$target}[$opt] = $explicitReporting ?? $this->reportOnly;
644644
}
645645
}
646646
else
647647
{
648-
$this->{$target}[$options] = $override ?? $this->reportOnly;
648+
$this->{$target}[$options] = $explicitReporting ?? $this->reportOnly;
649649
}
650650
}
651651

‎tests/system/Email/EmailTest.php‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?php namespace CodeIgniter\Email;
2+
3+
class EmailTest extends \CIUnitTestCase
4+
{
5+
6+
public function testNewGoodChecked()
7+
{
8+
$path = BASEPATH . 'Common.php';
9+
$file = new File($path, true);
10+
$this->assertEquals($path, $file->getRealPath());
11+
}
12+
13+
}

‎user_guide_src/source/outgoing/response.rst‎

Lines changed: 38 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -163,33 +163,51 @@ When enabled, the response object will contain an instance of ``CodeIgniter\HTTP
163163
values set in **application/Config/ContentSecurityPolicy.php** are applied to that instance and, if no changes are
164164
needed during runtime, then the correctly formatted header is sent and you're all done.
165165

166+
With CSP enabled, two header lines are added to the HTTP response: a Content-Security-Policy header, with
167+
policies identifying content types or origins that are explicitly allowed for different
168+
contexts, and a Content-Security-Policy-Report-Only header, which identifies content types
169+
or origins that will be allowed but which will also be reported to the destination
170+
of your choice.
171+
172+
Our implementation provides for a default treatment, changeable through the ``reportOnly()`` method.
173+
When an additional entry is added to a CSP directive, as shown below, it will be added
174+
to the CSP header appropriate for blocking or preventing. That can be over-ridden on a per
175+
call basis, by providing an optional second parameter to the adding method call.
176+
166177
Runtime Configuration
167178
---------------------
168179

169180
If your application needs to make changes at run-time, you can access the instance at ``$response->CSP``. The
170-
class holds a number of methods that map pretty clearly to the appropriate header value that you need to set::
171-
172-
$reportOnly = true;
173-
174-
$response->CSP->reportOnly($reportOnly);
175-
$response->CSP->setDefaultSrc('cdn.example.com', $reportOnly);
181+
class holds a number of methods that map pretty clearly to the appropriate header value that you need to set.
182+
Examples are shown below, with different combinations of parameters, though all accept either a directive
183+
name or anarray of them.::
184+
185+
// specify the default directive treatment
186+
$response->CSP->reportOnly(false);
187+
188+
// specify the origin to use if none provided for a directive
189+
$response->CSP->setDefaultSrc('cdn.example.com');
190+
// specify the URL that "report-only" reports get sent to
176191
$response->CSP->setReportURI('http://example.com/csp/reports');
192+
// specify that HTTP requests be upgraded to HTTPS
177193
$response->CSP->upgradeInsecureRequests(true);
178194

179-
$response->CSP->addBaseURI('example.com', true);
180-
$response->CSP->addChildSrc('https://youtube.com', $reportOnly);
181-
$response->CSP->addConnectSrc('https://*.facebook.com', $reportOnly);
182-
$response->CSP->addFontSrc('fonts.example.com', $reportOnly);
183-
$response->CSP->addFormAction('self', $reportOnly);
184-
$response->CSP->addFrameAncestor('none', $reportOnly);
185-
$response->CSP->addImageSrc('cdn.example.com', $reportOnly);
186-
$response->CSP->addMediaSrc('cdn.example.com', $reportOnly);
187-
$response->CSP->addManifestSrc('cdn.example.com', $reportOnly);
188-
$response->CSP->addObjectSrc('cdn.example.com', $reportOnly);
189-
$response->CSP->addPluginType('application/pdf', $reportOnly);
190-
$response->CSP->addScriptSrc('scripts.example.com', $reportOnly);
191-
$response->CSP->addStyleSrc('css.example.com', $reportOnly);
192-
$response->CSP->addSandbox(['allow-forms', 'allow-scripts'],$reportOnly);
195+
// add types or origins to CSP directives
196+
// assuming that the default treatment is to block rather than just report
197+
$response->CSP->addBaseURI('example.com', true); // report only
198+
$response->CSP->addChildSrc('https://youtube.com'); // blocked
199+
$response->CSP->addConnectSrc('https://*.facebook.com', false); // blocked
200+
$response->CSP->addFontSrc('fonts.example.com');
201+
$response->CSP->addFormAction('self');
202+
$response->CSP->addFrameAncestor('none', true); // report this one
203+
$response->CSP->addImageSrc('cdn.example.com');
204+
$response->CSP->addMediaSrc('cdn.example.com');
205+
$response->CSP->addManifestSrc('cdn.example.com');
206+
$response->CSP->addObjectSrc('cdn.example.com', false); // reject from here
207+
$response->CSP->addPluginType('application/pdf', false); // reject this media type
208+
$response->CSP->addScriptSrc('scripts.example.com', true); // allow but report requests from here
209+
$response->CSP->addStyleSrc('css.example.com');
210+
$response->CSP->addSandbox(['allow-forms', 'allow-scripts']);
193211

194212

195213
The first parameter to each of the "add" methods is an appropriate string value,

0 commit comments

Comments
 (0)