Skip to content

Commit e0b63d3

Browse files
jim-parryjim-parry
committed
Base ContentSecurityPolicy testing & enhancement
1 parent b8bbadd commit e0b63d3

3 files changed

Lines changed: 463 additions & 51 deletions

File tree

‎system/HTTP/ContentSecurityPolicy.php‎

Lines changed: 57 additions & 51 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
1-
<?php namespace CodeIgniter\HTTP;
1+
<?php
2+
namespace CodeIgniter\HTTP;
23

34
/**
45
* CodeIgniter
@@ -280,14 +281,14 @@ public function reportOnly(bool $value = true)
280281
*
281282
* @see http://www.w3.org/TR/CSP/#directive-base-uri
282283
*
283-
* @param string $uri
284-
* @param boolean $reportOnly
284+
* @param string $uri
285+
* @param boolean|null $override
285286
*
286287
* @return $this
287288
*/
288-
public function setBaseURI($uri, bool $reportOnly)
289+
public function setBaseURI($uri, ?bool $override = null)
289290
{
290-
$this->baseURI = [(string) $uri => $reportOnly];
291+
$this->baseURI = [(string) $uri => $override ?? $this->reportOnly];
291292

292293
return $this;
293294
}
@@ -305,13 +306,13 @@ public function setBaseURI($uri, bool $reportOnly)
305306
* @see http://www.w3.org/TR/CSP/#directive-child-src
306307
*
307308
* @param $uri
308-
* @param boolean $reportOnly
309+
* @param boolean|null $override
309310
*
310311
* @return $this
311312
*/
312-
public function addChildSrc($uri, bool $reportOnly = false)
313+
public function addChildSrc($uri, ?bool $override = null)
313314
{
314-
$this->addOption($uri, 'childSrc', $reportOnly);
315+
$this->addOption($uri, 'childSrc', $override ?? $this->reportOnly);
315316

316317
return $this;
317318
}
@@ -328,13 +329,13 @@ public function addChildSrc($uri, bool $reportOnly = false)
328329
* @see http://www.w3.org/TR/CSP/#directive-connect-src
329330
*
330331
* @param $uri
331-
* @param boolean $reportOnly
332+
* @param boolean|null $override
332333
*
333334
* @return $this
334335
*/
335-
public function addConnectSrc($uri, bool $reportOnly = false)
336+
public function addConnectSrc($uri, ?bool $override = null)
336337
{
337-
$this->addOption($uri, 'connectSrc', $reportOnly);
338+
$this->addOption($uri, 'connectSrc', $override ?? $this->reportOnly);
338339

339340
return $this;
340341
}
@@ -351,13 +352,13 @@ public function addConnectSrc($uri, bool $reportOnly = false)
351352
* @see http://www.w3.org/TR/CSP/#directive-default-src
352353
*
353354
* @param $uri
354-
* @param boolean $reportOnly
355+
* @param boolean|null $override
355356
*
356357
* @return $this
357358
*/
358-
public function setDefaultSrc($uri, bool $reportOnly = false)
359+
public function setDefaultSrc($uri, ?bool $override = null)
359360
{
360-
$this->defaultSrc = [(string) $uri => $reportOnly];
361+
$this->defaultSrc = [(string) $uri => $override ?? $this->reportOnly];
361362

362363
return $this;
363364
}
@@ -373,13 +374,13 @@ public function setDefaultSrc($uri, bool $reportOnly = false)
373374
* @see http://www.w3.org/TR/CSP/#directive-font-src
374375
*
375376
* @param $uri
376-
* @param boolean $reportOnly
377+
* @param boolean|null $override
377378
*
378379
* @return $this
379380
*/
380-
public function addFontSrc($uri, bool $reportOnly = false)
381+
public function addFontSrc($uri, ?bool $override = null)
381382
{
382-
$this->addOption($uri, 'fontSrc', $reportOnly);
383+
$this->addOption($uri, 'fontSrc', $override ?? $this->reportOnly);
383384

384385
return $this;
385386
}
@@ -393,13 +394,13 @@ public function addFontSrc($uri, bool $reportOnly = false)
393394
* @see http://www.w3.org/TR/CSP/#directive-form-action
394395
*
395396
* @param $uri
396-
* @param boolean $reportOnly
397+
* @param boolean|null $override
397398
*
398399
* @return $this
399400
*/
400-
public function addFormAction($uri, bool $reportOnly = false)
401+
public function addFormAction($uri, ?bool $override = null)
401402
{
402-
$this->addOption($uri, 'formAction', $reportOnly);
403+
$this->addOption($uri, 'formAction', $override ?? $this->reportOnly);
403404

404405
return $this;
405406
}
@@ -413,13 +414,13 @@ public function addFormAction($uri, bool $reportOnly = false)
413414
* @see http://www.w3.org/TR/CSP/#directive-frame-ancestors
414415
*
415416
* @param $uri
416-
* @param boolean $reportOnly
417+
* @param boolean|null $override
417418
*
418419
* @return $this
419420
*/
420-
public function addFrameAncestor($uri, bool $reportOnly = false)
421+
public function addFrameAncestor($uri, ?bool $override = null)
421422
{
422-
$this->addOption($uri, 'frameAncestors', $reportOnly);
423+
$this->addOption($uri, 'frameAncestors', $override ?? $this->reportOnly);
423424

424425
return $this;
425426
}
@@ -433,13 +434,13 @@ public function addFrameAncestor($uri, bool $reportOnly = false)
433434
* @see http://www.w3.org/TR/CSP/#directive-img-src
434435
*
435436
* @param $uri
436-
* @param boolean $reportOnly
437+
* @param boolean|null $override
437438
*
438439
* @return $this
439440
*/
440-
public function addImageSrc($uri, bool $reportOnly = false)
441+
public function addImageSrc($uri, ?bool $override = null)
441442
{
442-
$this->addOption($uri, 'imageSrc', $reportOnly);
443+
$this->addOption($uri, 'imageSrc', $override ?? $this->reportOnly);
443444

444445
return $this;
445446
}
@@ -453,13 +454,13 @@ public function addImageSrc($uri, bool $reportOnly = false)
453454
* @see http://www.w3.org/TR/CSP/#directive-media-src
454455
*
455456
* @param $uri
456-
* @param boolean $reportOnly
457+
* @param boolean|null $override
457458
*
458459
* @return $this
459460
*/
460-
public function addMediaSrc($uri, bool $reportOnly = false)
461+
public function addMediaSrc($uri, ?bool $override = null)
461462
{
462-
$this->addOption($uri, 'mediaSrc', $reportOnly);
463+
$this->addOption($uri, 'mediaSrc', $override ?? $this->reportOnly);
463464

464465
return $this;
465466
}
@@ -473,13 +474,13 @@ public function addMediaSrc($uri, bool $reportOnly = false)
473474
* @see https://www.w3.org/TR/CSP/#directive-manifest-src
474475
*
475476
* @param $uri
476-
* @param boolean $reportOnly
477+
* @param boolean|null $override
477478
*
478479
* @return $this
479480
*/
480-
public function addManifestSrc($uri, bool $reportOnly = false)
481+
public function addManifestSrc($uri, ?bool $override = null)
481482
{
482-
$this->addOption($uri, 'manifestSrc', $reportOnly);
483+
$this->addOption($uri, 'manifestSrc', $override ?? $this->reportOnly);
483484

484485
return $this;
485486
}
@@ -493,13 +494,13 @@ public function addManifestSrc($uri, bool $reportOnly = false)
493494
* @see http://www.w3.org/TR/CSP/#directive-object-src
494495
*
495496
* @param $uri
496-
* @param boolean $reportOnly
497+
* @param boolean|null $override
497498
*
498499
* @return $this
499500
*/
500-
public function addObjectSrc($uri, bool $reportOnly = false)
501+
public function addObjectSrc($uri, ?bool $override = null)
501502
{
502-
$this->addOption($uri, 'objectSrc', $reportOnly);
503+
$this->addOption($uri, 'objectSrc', $override ?? $this->reportOnly);
503504

504505
return $this;
505506
}
@@ -512,14 +513,14 @@ public function addObjectSrc($uri, bool $reportOnly = false)
512513
*
513514
* @see http://www.w3.org/TR/CSP/#directive-plugin-types
514515
*
515-
* @param string $mime One or more plugin mime types, separate by spaces
516-
* @param boolean $reportOnly
516+
* @param string $mime One or more plugin mime types, separate by spaces
517+
* @param boolean|null $override
517518
*
518519
* @return $this
519520
*/
520-
public function addPluginType($mime, bool $reportOnly = false)
521+
public function addPluginType($mime, ?bool $override = null)
521522
{
522-
$this->addOption($mime, 'pluginTypes', $reportOnly);
523+
$this->addOption($mime, 'pluginTypes', $override ?? $this->reportOnly);
523524

524525
return $this;
525526
}
@@ -566,7 +567,6 @@ public function setSandbox(bool $value = true, array $flags = null)
566567
{
567568
$this->sandbox = $flags;
568569
}
569-
570570
return $this;
571571
}
572572

@@ -579,13 +579,13 @@ public function setSandbox(bool $value = true, array $flags = null)
579579
* @see http://www.w3.org/TR/CSP/#directive-connect-src
580580
*
581581
* @param $uri
582-
* @param boolean $reportOnly
582+
* @param boolean|null $override
583583
*
584584
* @return $this
585585
*/
586-
public function addScriptSrc($uri, bool $reportOnly = false)
586+
public function addScriptSrc($uri, ?bool $override = null)
587587
{
588-
$this->addOption($uri, 'scriptSrc', $reportOnly);
588+
$this->addOption($uri, 'scriptSrc', $override ?? $this->reportOnly);
589589

590590
return $this;
591591
}
@@ -599,13 +599,13 @@ public function addScriptSrc($uri, bool $reportOnly = false)
599599
* @see http://www.w3.org/TR/CSP/#directive-connect-src
600600
*
601601
* @param $uri
602-
* @param boolean $reportOnly
602+
* @param boolean|null $override
603603
*
604604
* @return $this
605605
*/
606-
public function addStyleSrc($uri, bool $reportOnly = false)
606+
public function addStyleSrc($uri, ?bool $override = null)
607607
{
608-
$this->addOption($uri, 'styleSrc', $reportOnly);
608+
$this->addOption($uri, 'styleSrc', $override ?? $this->reportOnly);
609609

610610
return $this;
611611
}
@@ -636,10 +636,10 @@ public function upgradeInsecureRequests(bool $value = true)
636636
* DRY method to add an string or array to a class property.
637637
*
638638
* @param $options
639-
* @param string $target
640-
* @param boolean $reportOnly If TRUE, this item will be reported, not restricted
639+
* @param string $target
640+
* @param boolean|null $override
641641
*/
642-
protected function addOption($options, string $target, bool $reportOnly = false)
642+
protected function addOption($options, string $target, ?bool $override = null)
643643
{
644644
// Ensure we have an array to work with...
645645
if (is_string($this->{$target}))
@@ -652,15 +652,15 @@ protected function addOption($options, string $target, bool $reportOnly = false)
652652
$newOptions = [];
653653
foreach ($options as $opt)
654654
{
655-
$newOptions[] = [$opt => $reportOnly];
655+
$newOptions[] = [$opt => $override ?? $this->reportOnly];
656656
}
657657

658658
$this->{$target} = array_merge($this->{$target}, $newOptions);
659659
unset($newOptions);
660660
}
661661
else
662662
{
663-
$this->{$target}[$options] = $reportOnly;
663+
$this->{$target}[$options] = $override ?? $this->reportOnly;
664664
}
665665
}
666666

@@ -769,6 +769,12 @@ protected function buildHeaders(ResponseInterface &$response)
769769
{
770770
$header .= " {$name} {$value};";
771771
}
772+
// add token only if needed
773+
if ($this->upgradeInsecureRequests)
774+
{
775+
$header .= ' upgrade-insecure-requests;';
776+
}
777+
772778
$response->appendHeader('Content-Security-Policy', $header);
773779
}
774780

0 commit comments

Comments
 (0)