26
26
*/
27
27
class ContentSecurityPolicy
28
28
{
29
+ /**
30
+ * CSP directives
31
+ *
32
+ * @var array<string, string>
33
+ */
34
+ protected array $ directives = [
35
+ 'base-uri ' => 'baseURI ' ,
36
+ 'child-src ' => 'childSrc ' ,
37
+ 'connect-src ' => 'connectSrc ' ,
38
+ 'default-src ' => 'defaultSrc ' ,
39
+ 'font-src ' => 'fontSrc ' ,
40
+ 'form-action ' => 'formAction ' ,
41
+ 'frame-ancestors ' => 'frameAncestors ' ,
42
+ 'frame-src ' => 'frameSrc ' ,
43
+ 'img-src ' => 'imageSrc ' ,
44
+ 'media-src ' => 'mediaSrc ' ,
45
+ 'object-src ' => 'objectSrc ' ,
46
+ 'plugin-types ' => 'pluginTypes ' ,
47
+ 'script-src ' => 'scriptSrc ' ,
48
+ 'style-src ' => 'styleSrc ' ,
49
+ 'manifest-src ' => 'manifestSrc ' ,
50
+ 'sandbox ' => 'sandbox ' ,
51
+ 'report-uri ' => 'reportURI ' ,
52
+ ];
53
+
29
54
/**
30
55
* Used for security enforcement
31
56
*
@@ -113,37 +138,37 @@ class ContentSecurityPolicy
113
138
/**
114
139
* Used for security enforcement
115
140
*
116
- * @var string
141
+ * @var array| string
117
142
*/
118
- protected $ reportURI ;
143
+ protected $ scriptSrc = [] ;
119
144
120
145
/**
121
146
* Used for security enforcement
122
147
*
123
148
* @var array|string
124
149
*/
125
- protected $ sandbox = [];
150
+ protected $ styleSrc = [];
126
151
127
152
/**
128
153
* Used for security enforcement
129
154
*
130
155
* @var array|string
131
156
*/
132
- protected $ scriptSrc = [];
157
+ protected $ manifestSrc = [];
133
158
134
159
/**
135
160
* Used for security enforcement
136
161
*
137
162
* @var array|string
138
163
*/
139
- protected $ styleSrc = [];
164
+ protected $ sandbox = [];
140
165
141
166
/**
142
167
* Used for security enforcement
143
168
*
144
- * @var array| string
169
+ * @var string|null
145
170
*/
146
- protected $ manifestSrc = [] ;
171
+ protected $ reportURI ;
147
172
148
173
/**
149
174
* Used for security enforcement
@@ -704,26 +729,6 @@ protected function buildHeaders(ResponseInterface $response)
704
729
$ response ->setHeader ('Content-Security-Policy ' , []);
705
730
$ response ->setHeader ('Content-Security-Policy-Report-Only ' , []);
706
731
707
- $ directives = [
708
- 'base-uri ' => 'baseURI ' ,
709
- 'child-src ' => 'childSrc ' ,
710
- 'connect-src ' => 'connectSrc ' ,
711
- 'default-src ' => 'defaultSrc ' ,
712
- 'font-src ' => 'fontSrc ' ,
713
- 'form-action ' => 'formAction ' ,
714
- 'frame-ancestors ' => 'frameAncestors ' ,
715
- 'frame-src ' => 'frameSrc ' ,
716
- 'img-src ' => 'imageSrc ' ,
717
- 'media-src ' => 'mediaSrc ' ,
718
- 'object-src ' => 'objectSrc ' ,
719
- 'plugin-types ' => 'pluginTypes ' ,
720
- 'script-src ' => 'scriptSrc ' ,
721
- 'style-src ' => 'styleSrc ' ,
722
- 'manifest-src ' => 'manifestSrc ' ,
723
- 'sandbox ' => 'sandbox ' ,
724
- 'report-uri ' => 'reportURI ' ,
725
- ];
726
-
727
732
// inject default base & default URIs if needed
728
733
if (empty ($ this ->baseURI )) {
729
734
$ this ->baseURI = 'self ' ;
@@ -733,7 +738,7 @@ protected function buildHeaders(ResponseInterface $response)
733
738
$ this ->defaultSrc = 'self ' ;
734
739
}
735
740
736
- foreach ($ directives as $ name => $ property ) {
741
+ foreach ($ this -> directives as $ name => $ property ) {
737
742
if (! empty ($ this ->{$ property })) {
738
743
$ this ->addToHeader ($ name , $ this ->{$ property });
739
744
}
@@ -814,4 +819,20 @@ protected function addToHeader(string $name, $values = null)
814
819
$ this ->reportOnlyHeaders [$ name ] = implode (' ' , $ reportSources );
815
820
}
816
821
}
822
+
823
+ /**
824
+ * Clear the directive.
825
+ *
826
+ * @param string $directive CSP directive
827
+ */
828
+ public function clearDirective (string $ directive ): void
829
+ {
830
+ if ($ directive === 'report-uris ' ) {
831
+ $ this ->{$ this ->directives [$ directive ]} = null ;
832
+
833
+ return ;
834
+ }
835
+
836
+ $ this ->{$ this ->directives [$ directive ]} = [];
837
+ }
817
838
}
0 commit comments