Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 5dc2637

Browse filesBrowse files
herndlmfabpot
herndlm
authored and
fabpot
committed
[WebProfilerBundle] Disable CSP if dumper was used
1 parent c06a76c commit 5dc2637
Copy full SHA for 5dc2637

File tree

5 files changed

+61
-2
lines changed
Filter options

5 files changed

+61
-2
lines changed

‎src/Symfony/Bundle/WebProfilerBundle/EventListener/WebDebugToolbarListener.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/WebProfilerBundle/EventListener/WebDebugToolbarListener.php
+12-2Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@
1616
use Symfony\Component\HttpFoundation\Request;
1717
use Symfony\Component\HttpFoundation\Response;
1818
use Symfony\Component\HttpFoundation\Session\Flash\AutoExpireFlashBag;
19+
use Symfony\Component\HttpKernel\DataCollector\DumpDataCollector;
1920
use Symfony\Component\HttpKernel\Event\ResponseEvent;
2021
use Symfony\Component\HttpKernel\KernelEvents;
2122
use Symfony\Component\Routing\Generator\UrlGeneratorInterface;
@@ -44,15 +45,17 @@ class WebDebugToolbarListener implements EventSubscriberInterface
4445
protected $mode;
4546
protected $excludedAjaxPaths;
4647
private $cspHandler;
48+
private $dumpDataCollector;
4749

48-
public function __construct(Environment $twig, bool $interceptRedirects = false, int $mode = self::ENABLED, UrlGeneratorInterface $urlGenerator = null, string $excludedAjaxPaths = '^/bundles|^/_wdt', ContentSecurityPolicyHandler $cspHandler = null)
50+
public function __construct(Environment $twig, bool $interceptRedirects = false, int $mode = self::ENABLED, UrlGeneratorInterface $urlGenerator = null, string $excludedAjaxPaths = '^/bundles|^/_wdt', ContentSecurityPolicyHandler $cspHandler = null, DumpDataCollector $dumpDataCollector = null)
4951
{
5052
$this->twig = $twig;
5153
$this->urlGenerator = $urlGenerator;
5254
$this->interceptRedirects = $interceptRedirects;
5355
$this->mode = $mode;
5456
$this->excludedAjaxPaths = $excludedAjaxPaths;
5557
$this->cspHandler = $cspHandler;
58+
$this->dumpDataCollector = $dumpDataCollector;
5659
}
5760

5861
public function isEnabled(): bool
@@ -89,7 +92,14 @@ public function onKernelResponse(ResponseEvent $event)
8992
return;
9093
}
9194

92-
$nonces = $this->cspHandler ? $this->cspHandler->updateResponseHeaders($request, $response) : [];
95+
$nonces = [];
96+
if ($this->cspHandler) {
97+
if ($this->dumpDataCollector && $this->dumpDataCollector->getDumpsCount() > 0) {
98+
$this->cspHandler->disableCsp();
99+
}
100+
101+
$nonces = $this->cspHandler->updateResponseHeaders($request, $response);
102+
}
93103

94104
// do not capture redirects or modify XML HTTP Requests
95105
if ($request->isXmlHttpRequest()) {

‎src/Symfony/Bundle/WebProfilerBundle/Resources/config/toolbar.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/WebProfilerBundle/Resources/config/toolbar.php
+1Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
service('router')->ignoreOnInvalid(),
2525
abstract_arg('paths that should be excluded from the AJAX requests shown in the toolbar'),
2626
service('web_profiler.csp.handler'),
27+
service('data_collector.dump')->ignoreOnInvalid(),
2728
])
2829
->tag('kernel.event_subscriber')
2930
;

‎src/Symfony/Bundle/WebProfilerBundle/Tests/DependencyInjection/WebProfilerExtensionTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/WebProfilerBundle/Tests/DependencyInjection/WebProfilerExtensionTest.php
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
use Symfony\Component\ErrorHandler\ErrorRenderer\HtmlErrorRenderer;
2121
use Symfony\Component\EventDispatcher\DependencyInjection\RegisterListenersPass;
2222
use Symfony\Component\EventDispatcher\EventDispatcher;
23+
use Symfony\Component\HttpKernel\DataCollector\DumpDataCollector;
2324
use Symfony\Component\HttpKernel\KernelInterface;
2425

2526
class WebProfilerExtensionTest extends TestCase
@@ -55,6 +56,7 @@ protected function setUp(): void
5556
$this->kernel = $this->createMock(KernelInterface::class);
5657

5758
$this->container = new ContainerBuilder();
59+
$this->container->register('data_collector.dump', DumpDataCollector::class)->setPublic(true);
5860
$this->container->register('error_handler.error_renderer.html', HtmlErrorRenderer::class)->setPublic(true);
5961
$this->container->register('event_dispatcher', EventDispatcher::class)->setPublic(true);
6062
$this->container->register('router', $this->getMockClass('Symfony\\Component\\Routing\\RouterInterface'))->setPublic(true);

‎src/Symfony/Bundle/WebProfilerBundle/Tests/EventListener/WebDebugToolbarListenerTest.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/WebProfilerBundle/Tests/EventListener/WebDebugToolbarListenerTest.php
+44Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,13 @@
1212
namespace Symfony\Bundle\WebProfilerBundle\Tests\EventListener;
1313

1414
use PHPUnit\Framework\TestCase;
15+
use Symfony\Bundle\WebProfilerBundle\Csp\ContentSecurityPolicyHandler;
1516
use Symfony\Bundle\WebProfilerBundle\EventListener\WebDebugToolbarListener;
1617
use Symfony\Component\HttpFoundation\HeaderBag;
1718
use Symfony\Component\HttpFoundation\Request;
1819
use Symfony\Component\HttpFoundation\Response;
1920
use Symfony\Component\HttpFoundation\Session\Session;
21+
use Symfony\Component\HttpKernel\DataCollector\DumpDataCollector;
2022
use Symfony\Component\HttpKernel\Event\ResponseEvent;
2123
use Symfony\Component\HttpKernel\HttpKernelInterface;
2224
use Symfony\Component\HttpKernel\Kernel;
@@ -300,6 +302,48 @@ public function testThrowingErrorCleanup()
300302
$this->assertEquals('Exception: This multiline tabbed text should come out on a single plain line', $response->headers->get('X-Debug-Error'));
301303
}
302304

305+
public function testCspIsDisabledIfDumperWasUsed()
306+
{
307+
$response = new Response('<html><head></head><body></body></html>');
308+
$response->headers->set('X-Debug-Token', 'xxxxxxxx');
309+
310+
$event = new ResponseEvent($this->createMock(Kernel::class), $this->getRequestMock(), HttpKernelInterface::MASTER_REQUEST, $response);
311+
312+
$cspHandler = $this->createMock(ContentSecurityPolicyHandler::class);
313+
$cspHandler->expects($this->once())
314+
->method('disableCsp');
315+
$dumpDataCollector = $this->createMock(DumpDataCollector::class);
316+
$dumpDataCollector->expects($this->once())
317+
->method('getDumpsCount')
318+
->willReturn(1);
319+
320+
$listener = new WebDebugToolbarListener($this->getTwigMock(), false, WebDebugToolbarListener::ENABLED, null, '', $cspHandler, $dumpDataCollector);
321+
$listener->onKernelResponse($event);
322+
323+
$this->assertEquals("<html><head></head><body>\nWDT\n</body></html>", $response->getContent());
324+
}
325+
326+
public function testCspIsKeptEnabledIfDumperWasNotUsed()
327+
{
328+
$response = new Response('<html><head></head><body></body></html>');
329+
$response->headers->set('X-Debug-Token', 'xxxxxxxx');
330+
331+
$event = new ResponseEvent($this->createMock(Kernel::class), $this->getRequestMock(), HttpKernelInterface::MASTER_REQUEST, $response);
332+
333+
$cspHandler = $this->createMock(ContentSecurityPolicyHandler::class);
334+
$cspHandler->expects($this->never())
335+
->method('disableCsp');
336+
$dumpDataCollector = $this->createMock(DumpDataCollector::class);
337+
$dumpDataCollector->expects($this->once())
338+
->method('getDumpsCount')
339+
->willReturn(0);
340+
341+
$listener = new WebDebugToolbarListener($this->getTwigMock(), false, WebDebugToolbarListener::ENABLED, null, '', $cspHandler, $dumpDataCollector);
342+
$listener->onKernelResponse($event);
343+
344+
$this->assertEquals("<html><head></head><body>\nWDT\n</body></html>", $response->getContent());
345+
}
346+
303347
protected function getRequestMock($isXmlHttpRequest = false, $requestFormat = 'html', $hasSession = true)
304348
{
305349
$request = $this->getMockBuilder(Request::class)->setMethods(['getSession', 'isXmlHttpRequest', 'getRequestFormat'])->disableOriginalConstructor()->getMock();

‎src/Symfony/Bundle/WebProfilerBundle/Tests/Functional/WebProfilerBundleKernel.php

Copy file name to clipboardExpand all lines: src/Symfony/Bundle/WebProfilerBundle/Tests/Functional/WebProfilerBundleKernel.php
+2Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010
use Symfony\Component\Config\Loader\LoaderInterface;
1111
use Symfony\Component\DependencyInjection\ContainerBuilder;
1212
use Symfony\Component\HttpFoundation\Response;
13+
use Symfony\Component\HttpKernel\DataCollector\DumpDataCollector;
1314
use Symfony\Component\HttpKernel\Kernel;
1415
use Symfony\Component\Routing\Loader\Configurator\RoutingConfigurator;
1516

@@ -65,6 +66,7 @@ public function getLogDir()
6566

6667
protected function build(ContainerBuilder $container)
6768
{
69+
$container->register('data_collector.dump', DumpDataCollector::class);
6870
$container->register('logger', NullLogger::class);
6971
}
7072

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.