Skip to content

Commit 2522b36

Browse files
MoonEMoonE
committed
Remove obsolete alternative CSP headers
Signed-off-by: Maximilian Krög <maxi_kroeg@web.de>
1 parent a024371 commit 2522b36

3 files changed

Lines changed: 5 additions & 72 deletions

File tree

‎psalm-baseline.xml‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9915,17 +9915,6 @@
99159915
<code><![CDATA[Config::getInstance()]]></code>
99169916
<code><![CDATA[DatabaseInterface::getInstance()]]></code>
99179917
</DeprecatedMethod>
9918-
<PossiblyInvalidArgument>
9919-
<code><![CDATA[testGetHttpHeaders]]></code>
9920-
<code><![CDATA[testGetHttpHeaders]]></code>
9921-
<code><![CDATA[testGetHttpHeaders]]></code>
9922-
<code><![CDATA[testGetHttpHeaders]]></code>
9923-
<code><![CDATA[testGetHttpHeaders]]></code>
9924-
<code><![CDATA[testGetHttpHeaders]]></code>
9925-
<code><![CDATA[testGetHttpHeaders]]></code>
9926-
<code><![CDATA[testGetHttpHeaders]]></code>
9927-
<code><![CDATA[testGetHttpHeaders]]></code>
9928-
</PossiblyInvalidArgument>
99299918
</file>
99309919
<file src="tests/unit/Html/GeneratorTest.php">
99319920
<DeprecatedMethod>

‎src/Header.php‎

Lines changed: 4 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -343,7 +343,7 @@ public function getHttpHeaders(ClockInterface|null $clock = null): array
343343

344344
$headers['Referrer-Policy'] = 'same-origin';
345345

346-
$headers = array_merge($headers, $this->getCspHeaders());
346+
$headers['Content-Security-Policy'] = $this->getCspHeader();
347347

348348
/**
349349
* Re-enable possible disabled XSS filters.
@@ -423,12 +423,8 @@ public function getPageTitle(): string
423423
return $this->title;
424424
}
425425

426-
/**
427-
* Get all the CSP allow policy headers
428-
*
429-
* @return array<string, string>
430-
*/
431-
private function getCspHeaders(): array
426+
/** Get the Content-Security-Policy header */
427+
private function getCspHeader(): string
432428
{
433429
$mapTileUrl = ' tile.openstreetmap.org';
434430
$captchaUrl = '';
@@ -444,9 +440,7 @@ private function getCspHeaders(): array
444440
$captchaUrl = ' ' . $this->config->config->CaptchaCsp . ' ';
445441
}
446442

447-
$headers = [];
448-
449-
$headers['Content-Security-Policy'] = sprintf(
443+
return sprintf(
450444
'default-src \'self\' %s%s;script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' %s%s;'
451445
. 'style-src \'self\' \'unsafe-inline\' %s%s;img-src \'self\' data: %s%s%s;object-src \'none\';',
452446
$captchaUrl,
@@ -459,32 +453,6 @@ private function getCspHeaders(): array
459453
$mapTileUrl,
460454
$captchaUrl,
461455
);
462-
463-
$headers['X-Content-Security-Policy'] = sprintf(
464-
'default-src \'self\' %s%s;options inline-script eval-script;'
465-
. 'referrer no-referrer;img-src \'self\' data: %s%s%s;object-src \'none\';',
466-
$captchaUrl,
467-
$cspAllow,
468-
$cspAllow,
469-
$mapTileUrl,
470-
$captchaUrl,
471-
);
472-
473-
$headers['X-WebKit-CSP'] = sprintf(
474-
'default-src \'self\' %s%s;script-src \'self\' %s%s \'unsafe-inline\' \'unsafe-eval\';'
475-
. 'referrer no-referrer;style-src \'self\' \'unsafe-inline\' %s;'
476-
. 'img-src \'self\' data: %s%s%s;object-src \'none\';',
477-
$captchaUrl,
478-
$cspAllow,
479-
$captchaUrl,
480-
$cspAllow,
481-
$captchaUrl,
482-
$cspAllow,
483-
$mapTileUrl,
484-
$captchaUrl,
485-
);
486-
487-
return $headers;
488456
}
489457

490458
private function getVariablesForJavaScript(): string

‎tests/unit/HeaderTest.php‎

Lines changed: 1 addition & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -188,8 +188,6 @@ public function testGetHttpHeaders(
188188
string $captchaCsp,
189189
string|null $expectedFrameOptions,
190190
string $expectedCsp,
191-
string $expectedXCsp,
192-
string $expectedWebKitCsp,
193191
): void {
194192
$header = $this->getNewHeaderInstance();
195193

@@ -204,8 +202,6 @@ public function testGetHttpHeaders(
204202
'X-Frame-Options' => $expectedFrameOptions ?? '',
205203
'Referrer-Policy' => 'same-origin',
206204
'Content-Security-Policy' => $expectedCsp,
207-
'X-Content-Security-Policy' => $expectedXCsp,
208-
'X-WebKit-CSP' => $expectedWebKitCsp,
209205
'X-XSS-Protection' => '1; mode=block',
210206
'X-Content-Type-Options' => 'nosniff',
211207
'X-Permitted-Cross-Domain-Policies' => 'none',
@@ -224,7 +220,7 @@ public function testGetHttpHeaders(
224220
self::assertSame($expected, $header->getHttpHeaders(MockClock::from('2015-10-21T05:28:00-02:00')));
225221
}
226222

227-
/** @return mixed[][] */
223+
/** @psalm-return list<array{string|bool, string, string, string, string, string|null, string}> */
228224
public static function providerForTestGetHttpHeaders(): array
229225
{
230226
return [
@@ -238,11 +234,6 @@ public static function providerForTestGetHttpHeaders(): array
238234
'default-src \'self\' ;script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' ;'
239235
. 'style-src \'self\' \'unsafe-inline\' ;img-src \'self\' data: tile.openstreetmap.org;'
240236
. 'object-src \'none\';',
241-
'default-src \'self\' ;options inline-script eval-script;referrer no-referrer;'
242-
. 'img-src \'self\' data: tile.openstreetmap.org;object-src \'none\';',
243-
'default-src \'self\' ;script-src \'self\' \'unsafe-inline\' \'unsafe-eval\';'
244-
. 'referrer no-referrer;style-src \'self\' \'unsafe-inline\' ;'
245-
. 'img-src \'self\' data: tile.openstreetmap.org;object-src \'none\';',
246237
],
247238
[
248239
'sameorigin',
@@ -257,14 +248,6 @@ public static function providerForTestGetHttpHeaders(): array
257248
. 'style-src \'self\' \'unsafe-inline\' captcha.tld csp.tld example.com example.net;'
258249
. 'img-src \'self\' data: example.com example.net tile.openstreetmap.org captcha.tld csp.tld ;'
259250
. 'object-src \'none\';',
260-
'default-src \'self\' captcha.tld csp.tld example.com example.net;'
261-
. 'options inline-script eval-script;referrer no-referrer;img-src \'self\' data: example.com '
262-
. 'example.net tile.openstreetmap.org captcha.tld csp.tld ;object-src \'none\';',
263-
'default-src \'self\' captcha.tld csp.tld example.com example.net;script-src \'self\' '
264-
. 'captcha.tld csp.tld example.com example.net \'unsafe-inline\' \'unsafe-eval\';'
265-
. 'referrer no-referrer;style-src \'self\' \'unsafe-inline\' captcha.tld csp.tld ;'
266-
. 'img-src \'self\' data: example.com example.net tile.openstreetmap.org captcha.tld csp.tld ;'
267-
. 'object-src \'none\';',
268251
],
269252
[
270253
true,
@@ -277,13 +260,6 @@ public static function providerForTestGetHttpHeaders(): array
277260
. 'script-src \'self\' \'unsafe-inline\' \'unsafe-eval\' captcha.tld csp.tld ;'
278261
. 'style-src \'self\' \'unsafe-inline\' captcha.tld csp.tld ;'
279262
. 'img-src \'self\' data: tile.openstreetmap.org captcha.tld csp.tld ;object-src \'none\';',
280-
'default-src \'self\' captcha.tld csp.tld ;'
281-
. 'options inline-script eval-script;referrer no-referrer;'
282-
. 'img-src \'self\' data: tile.openstreetmap.org captcha.tld csp.tld ;object-src \'none\';',
283-
'default-src \'self\' captcha.tld csp.tld ;'
284-
. 'script-src \'self\' captcha.tld csp.tld \'unsafe-inline\' \'unsafe-eval\';'
285-
. 'referrer no-referrer;style-src \'self\' \'unsafe-inline\' captcha.tld csp.tld ;'
286-
. 'img-src \'self\' data: tile.openstreetmap.org captcha.tld csp.tld ;object-src \'none\';',
287263
],
288264
];
289265
}

0 commit comments

Comments
 (0)