Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 20b4c7f

Browse filesBrowse files
romainneutronromainneutron
committed
[WebProfilerBundle] Fix bundle usage in Content-Security-Policy context
1 parent e7d7e1e commit 20b4c7f
Copy full SHA for 20b4c7f

18 files changed

+333
-50
lines changed

‎src/Symfony/Bundle/WebProfilerBundle/CSP/ContentSecurityPolicyHandler.php

Copy file name to clipboard
+219Lines changed: 219 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,219 @@
1+
<?php
2+
3+
/*
4+
* This file is part of the Symfony package.
5+
*
6+
* (c) Fabien Potencier <fabien@symfony.com>
7+
*
8+
* For the full copyright and license information, please view the LICENSE
9+
* file that was distributed with this source code.
10+
*/
11+
12+
namespace Symfony\Bundle\WebProfilerBundle\CSP;
13+
14+
use Symfony\Component\HttpFoundation\Request;
15+
use Symfony\Component\HttpFoundation\Response;
16+
17+
/**
18+
* Handles Content-Security-Policy HTTP header for the WebProfiler Bundle.
19+
*
20+
* @author Romain Neutron <imprec@gmail.com>
21+
*/
22+
class ContentSecurityPolicyHandler
23+
{
24+
/**
25+
* Returns an array of nonces to be used in Twig templates and Content-Security-Policy headers.
26+
*
27+
* Nonce can be provided by;
28+
* - The request - In case HTML content is fetched via AJAX and inserted in DOM, it must use the same nonce as origin
29+
* - The response - A call to getNonces() has already been done previously. Same nonce are returned
30+
* - They are otherwise randomly generated
31+
*
32+
* @param Request $request
33+
* @param Response $response
34+
*
35+
* @return array
36+
*/
37+
public function getNonces(Request $request, Response $response)
38+
{
39+
if ($request->headers->has('X-WebProfiler-Script-Nonce') && $request->headers->has('X-WebProfiler-Style-Nonce')) {
40+
return [
41+
'csp_script_nonce' => $request->headers->get('X-WebProfiler-Script-Nonce'),
42+
'csp_style_nonce' => $request->headers->get('X-WebProfiler-Style-Nonce'),
43+
];
44+
}
45+
46+
if ($response->headers->has('X-WebProfiler-Script-Nonce') && $response->headers->has('X-WebProfiler-Style-Nonce')) {
47+
return [
48+
'csp_script_nonce' => $response->headers->get('X-WebProfiler-Script-Nonce'),
49+
'csp_style_nonce' => $response->headers->get('X-WebProfiler-Style-Nonce'),
50+
];
51+
}
52+
53+
$nonces = [
54+
'csp_script_nonce' => $this->generateNonce(),
55+
'csp_style_nonce' => $this->generateNonce(),
56+
];
57+
58+
$response->headers->set('X-WebProfiler-Script-Nonce', $nonces['csp_script_nonce']);
59+
$response->headers->set('X-WebProfiler-Style-Nonce', $nonces['csp_style_nonce']);
60+
61+
return $nonces;
62+
}
63+
64+
/**
65+
* Cleanup temporary headers and updates Content-Security-Policy headers.
66+
*
67+
* This method should be called on KernelEvents::RESPONSE
68+
*
69+
* @param Request $request
70+
* @param Response $response
71+
*
72+
* @return array Nonce used by the bundle in Content-Security-Policy header
73+
*/
74+
public function onKernelResponse(Request $request, Response $response)
75+
{
76+
$nonces = $this->getNonces($request, $response);
77+
$this->cleanHeaders($response);
78+
$this->updateCSPheaders($response, $nonces);
79+
80+
return $nonces;
81+
}
82+
83+
/**
84+
* @param Response $response
85+
*/
86+
private function cleanHeaders(Response $response)
87+
{
88+
$response->headers->remove('X-WebProfiler-Script-Nonce');
89+
$response->headers->remove('X-WebProfiler-Style-Nonce');
90+
}
91+
92+
/**
93+
* Updates Content-Security-Policy headers in a response.
94+
*
95+
* @param Response $response
96+
* @param array $nonces
97+
*
98+
* @return array
99+
*/
100+
private function updateCSPheaders(Response $response, array $nonces = array()) {
101+
$nonces = array_replace([
102+
'csp_script_nonce' => $this->generateNonce(),
103+
'csp_style_nonce' => $this->generateNonce(),
104+
], $nonces);
105+
106+
$scriptRule = false;
107+
$styleRule = false;
108+
109+
$headers = $this->getCSPHeaders($response);
110+
111+
foreach($headers as $header => $directives) {
112+
if ($this->CSPpreventsUnsafeInline($directives, 'script-src')) {
113+
$scriptRule = true;
114+
$headers[$header]['script-src'][] = sprintf('\'nonce-%s\'', $nonces['csp_script_nonce']);
115+
}
116+
if ($this->CSPpreventsUnsafeInline($directives, 'style-src')) {
117+
$styleRule = true;
118+
$headers[$header]['style-src'][] = sprintf('\'nonce-%s\'', $nonces['csp_style_nonce']);
119+
}
120+
}
121+
122+
if (!$styleRule && !$scriptRule) {
123+
return $nonces;
124+
}
125+
126+
foreach ($headers as $header => $directives) {
127+
$response->headers->set($header, $this->generateCSPHeader($directives));
128+
}
129+
130+
return $nonces;
131+
}
132+
133+
/**
134+
* Generates a valid CSP nonce.
135+
*
136+
* @return string
137+
*/
138+
private function generateNonce()
139+
{
140+
return bin2hex(random_bytes(16));
141+
}
142+
143+
/**
144+
* Converts a directives set array into Content-Security-Policy header.
145+
*
146+
* @param array $directives The directives set
147+
*
148+
* @return string The Content-Security-Policy header
149+
*/
150+
private function generateCSPHeader(array $directives)
151+
{
152+
foreach ($directives as $name => $values) {
153+
$directives[$name] = sprintf('%s %s', $name, implode(' ', $values));
154+
}
155+
156+
return implode('; ', $directives);
157+
}
158+
159+
/**
160+
* Converts a Content-Security-Policy header value into a directives set array.
161+
*
162+
* @param string $header The header value
163+
*
164+
* @return array The directives set
165+
*/
166+
private function parseDirectives($header) {
167+
$directives = [];
168+
169+
foreach (explode(';', $header) as $directive) {
170+
$parts = explode(' ', trim($directive));
171+
if (count($parts) < 1) {
172+
continue;
173+
}
174+
$name = array_shift($parts);
175+
$directives[$name] = $parts;
176+
}
177+
178+
return $directives;
179+
}
180+
181+
/**
182+
* Detects if the 'unsafe-inline' is prevented for a directive within the directives set.
183+
*
184+
* @param $directives The directives set
185+
* @param $type The name of the directive to check
186+
*
187+
* @return bool
188+
*/
189+
private function CSPpreventsUnsafeInline($directives, $type) {
190+
if (!isset($directives[$type])) {
191+
return false;
192+
}
193+
194+
return !in_array('\'unsafe-inline\'', $directives[$type], true);
195+
}
196+
197+
/**
198+
* Retrieves the Content-Security-Policy headers (either X-Content-Security-Policy or Content-Security-Policy) from
199+
* a response.
200+
*
201+
* @param Response $response The response
202+
*
203+
* @return array An associative array of headers
204+
*/
205+
private function getCSPHeaders(Response $response)
206+
{
207+
$headers = [];
208+
209+
if ($response->headers->has('Content-Security-Policy')) {
210+
$headers['Content-Security-Policy'] = $this->parseDirectives($response->headers->get('Content-Security-Policy'));
211+
}
212+
213+
if ($response->headers->has('X-Content-Security-Policy')) {
214+
$headers['X-Content-Security-Policy'] = $this->parseDirectives($response->headers->get('X-Content-Security-Policy'));
215+
}
216+
217+
return $headers;
218+
}
219+
}

‎src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php
+26-9Lines changed: 26 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111

1212
namespace Symfony\Bundle\WebProfilerBundle\Controller;
1313

14+
use Symfony\Bundle\WebProfilerBundle\CSP\ContentSecurityPolicyHandler;
1415
use Symfony\Bundle\WebProfilerBundle\Profiler\TemplateManager;
1516
use Symfony\Component\HttpFoundation\RedirectResponse;
1617
use Symfony\Component\HttpFoundation\Request;
@@ -33,6 +34,7 @@ class ProfilerController
3334
private $twig;
3435
private $templates;
3536
private $toolbarPosition;
37+
private $cspHandler;
3638

3739
/**
3840
* Constructor.
@@ -43,13 +45,14 @@ class ProfilerController
4345
* @param array $templates The templates
4446
* @param string $toolbarPosition The toolbar position (top, bottom, normal, or null -- use the configuration)
4547
*/
46-
public function __construct(UrlGeneratorInterface $generator, Profiler $profiler = null, \Twig_Environment $twig, array $templates, $toolbarPosition = 'normal')
48+
public function __construct(UrlGeneratorInterface $generator, Profiler $profiler = null, \Twig_Environment $twig, array $templates, $toolbarPosition = 'normal', ContentSecurityPolicyHandler $cspHandler = null)
4749
{
4850
$this->generator = $generator;
4951
$this->profiler = $profiler;
5052
$this->twig = $twig;
5153
$this->templates = $templates;
5254
$this->toolbarPosition = $toolbarPosition;
55+
$this->cspHandler = $cspHandler;
5356
}
5457

5558
/**
@@ -103,7 +106,7 @@ public function panelAction(Request $request, $token)
103106
throw new NotFoundHttpException(sprintf('Panel "%s" is not available for token "%s".', $panel, $token));
104107
}
105108

106-
return new Response($this->twig->render($this->getTemplateManager()->getName($profile, $panel), array(
109+
return $this->renderWithCSPNonces($request, $this->getTemplateManager()->getName($profile, $panel), array(
107110
'token' => $token,
108111
'profile' => $profile,
109112
'collector' => $profile->getCollector($panel),
@@ -113,7 +116,7 @@ public function panelAction(Request $request, $token)
113116
'templates' => $this->getTemplateManager()->getTemplates($profile),
114117
'is_ajax' => $request->isXmlHttpRequest(),
115118
'profiler_markup_version' => 2, // 1 = original profiler, 2 = Symfony 2.8+ profiler
116-
)), 200, array('Content-Type' => 'text/html'));
119+
));
117120
}
118121

119122
/**
@@ -155,10 +158,10 @@ public function infoAction(Request $request, $about)
155158

156159
$this->profiler->disable();
157160

158-
return new Response($this->twig->render('@WebProfiler/Profiler/info.html.twig', array(
161+
return $this->renderWithCSPNonces($request, '@WebProfiler/Profiler/info.html.twig', array(
159162
'about' => $about,
160163
'request' => $request,
161-
)), 200, array('Content-Type' => 'text/html'));
164+
));
162165
}
163166

164167
/**
@@ -206,15 +209,15 @@ public function toolbarAction(Request $request, $token)
206209
// the profiler is not enabled
207210
}
208211

209-
return new Response($this->twig->render('@WebProfiler/Profiler/toolbar.html.twig', array(
212+
return $this->renderWithCSPNonces($request, '@WebProfiler/Profiler/toolbar.html.twig', array(
210213
'request' => $request,
211214
'position' => $position,
212215
'profile' => $profile,
213216
'templates' => $this->getTemplateManager()->getTemplates($profile),
214217
'profiler_url' => $url,
215218
'token' => $token,
216219
'profiler_markup_version' => 2, // 1 = original toolbar, 2 = Symfony 2.8+ toolbar
217-
)), 200, array('Content-Type' => 'text/html'));
220+
));
218221
}
219222

220223
/**
@@ -295,7 +298,7 @@ public function searchResultsAction(Request $request, $token)
295298
$end = $request->query->get('end', null);
296299
$limit = $request->query->get('limit');
297300

298-
return new Response($this->twig->render('@WebProfiler/Profiler/results.html.twig', array(
301+
return $this->renderWithCSPNonces($request, '@WebProfiler/Profiler/results.html.twig', array(
299302
'request' => $request,
300303
'token' => $token,
301304
'profile' => $profile,
@@ -307,7 +310,7 @@ public function searchResultsAction(Request $request, $token)
307310
'end' => $end,
308311
'limit' => $limit,
309312
'panel' => null,
310-
)), 200, array('Content-Type' => 'text/html'));
313+
));
311314
}
312315

313316
/**
@@ -397,4 +400,18 @@ protected function getTemplateManager()
397400

398401
return $this->templateManager;
399402
}
403+
404+
private function renderWithCSPNonces(Request $request, $template, $variables, $code = 200, $headers = array('Content-Type' => 'text/html'))
405+
{
406+
$response = new Response('', $code, $headers);
407+
408+
$nonces = $this->cspHandler ? $this->cspHandler->getNonces($request, $response) : [];
409+
410+
$variables['csp_script_nonce'] = isset($nonces['csp_script_nonce']) ? $nonces['csp_script_nonce'] : null;
411+
$variables['csp_style_nonce'] = isset($nonces['csp_style_nonce']) ? $nonces['csp_style_nonce'] : null;
412+
413+
$response->setContent($this->twig->render($template, $variables));
414+
415+
return $response;
416+
}
400417
}

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.