bug #36315 [WebProfilerBundle] Support for Content Security Policy style-src-elem and script-src-elem in WebProfiler (ampaze)

fabpot · fabpot · commit 004f1f3823d4 · 2020-04-04T10:50:20.000+02:00
This PR was merged into the 3.4 branch. Discussion ---------- [WebProfilerBundle] Support for Content Security Policy style-src-elem and script-src-elem in WebProfiler | Q | A | ------------- | --- | Branch? | 3.4 | Bug fix? | yes | New feature? | no  | Deprecations? | no  | License | MIT If a `style-src-elem` or `script-src-elem` Content Security Policy exist, the WebProfiler Styles or Scripts will be rejected as the nonce is missing. Commits ------- 7f33f1f Support for Content Security Policy style-src-elem and script-src-elem in WebProfiler
diff --git a/src/Symfony/Bundle/WebProfilerBundle/Csp/ContentSecurityPolicyHandler.php b/src/Symfony/Bundle/WebProfilerBundle/Csp/ContentSecurityPolicyHandler.php
@@ -128,7 +128,7 @@ private function updateCspHeaders(Response $response, array $nonces = [])
         $headers = $this->getCspHeaders($response);
 
         foreach ($headers as $header => $directives) {
-            foreach (['script-src' => 'csp_script_nonce', 'style-src' => 'csp_style_nonce'] as $type => $tokenName) {
+            foreach (['script-src' => 'csp_script_nonce', 'script-src-elem' => 'csp_script_nonce', 'style-src' => 'csp_style_nonce', 'style-src-elem' => 'csp_style_nonce'] as $type => $tokenName) {
                 if ($this->authorizesInline($directives, $type)) {
                     continue;
                 }

Original file line number	Diff line number	Diff line change
`@@ -128,7 +128,7 @@ private function updateCspHeaders(Response $response, array $nonces = [])`
`128`	`128`	`$headers = $this->getCspHeaders($response);`
`129`	`129`
`130`	`130`	`foreach ($headers as $header => $directives) {`
`131`		`- foreach (['script-src' => 'csp_script_nonce', 'style-src' => 'csp_style_nonce'] as $type => $tokenName) {`
	`131`	`+ foreach (['script-src' => 'csp_script_nonce', 'script-src-elem' => 'csp_script_nonce', 'style-src' => 'csp_style_nonce', 'style-src-elem' => 'csp_style_nonce'] as $type => $tokenName) {`
`132`	`132`	`if ($this->authorizesInline($directives, $type)) {`
`133`	`133`	`continue;`
`134`	`134`	`}`