feat: add ContentSecurityPolicy::clearDirective()

Author: kenjis

system/HTTP/ContentSecurityPolicy.php

@@ -819,4 +819,14 @@ protected function addToHeader(string $name, $values = null)
             $this->reportOnlyHeaders[$name] = implode(' ', $reportSources);
         }
     }
+
+    /**
+     * Clear the directive.
+     *
+     * @param string $directive CSP directive
+     */
+    public function clearDirective(string $directive): void
+    {
+        $this->{$this->directives[$directive]} = [];
+    }
 }

tests/system/HTTP/ContentSecurityPolicyTest.php

@@ -642,4 +642,19 @@ public function testHeaderScriptNonceEmittedOnceGetScriptNonceCalled(): void
         $result = $this->getHeaderEmitted('Content-Security-Policy');
         $this->assertStringContainsString("script-src 'self' 'nonce-", $result);
     }
+
+    public function testClearDirective(): void
+    {
+        $this->prepare();
+
+        $this->csp->addStyleSrc('css.example.com');
+        $this->csp->clearDirective('style-src');
+
+        $this->csp->finalize($this->response);
+
+        $header = $this->response->getHeaderLine('Content-Security-Policy');
+
+        $this->assertStringNotContainsString('style-src ', $header);
+        $this->assertStringNotContainsString('css.example.com', $header);
+    }
 }