Skip to content

Commit 4bb89b6

Browse files
feat: Add CSP3 script-src-elem directive (#9722)
* feat: Add script-src-elem option to CSP options. Signed-off-by: Mark Unwin <mark.unwin@gmail.com> * fix: Add missing unit test for script-src-elem. Signed-off-by: Mark Unwin <mark.unwin@gmail.com> * Fixes --------- Signed-off-by: Mark Unwin <mark.unwin@gmail.com> Co-authored-by: John Paul E. Balandan, CPA <paulbalandan@gmail.com>
1 parent bdad80d commit 4bb89b6

4 files changed

Lines changed: 59 additions & 3 deletions

File tree

app/Config/ContentSecurityPolicy.php

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,13 @@ class ContentSecurityPolicy extends BaseConfig
5656
*/
5757
public $scriptSrc = 'self';
5858

59+
/**
60+
* Specifies valid sources for JavaScript <script> elements.
61+
*
62+
* @var list<string>|string
63+
*/
64+
public $scriptSrcElem = 'self';
65+
5966
/**
6067
* Lists allowed stylesheets' URLs.
6168
*

system/HTTP/ContentSecurityPolicy.php

Lines changed: 25 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,8 +43,9 @@ class ContentSecurityPolicy
4343
'plugin-types' => 'pluginTypes',
4444
'script-src' => 'scriptSrc',
4545
'style-src' => 'styleSrc',
46-
'manifest-src' => 'manifestSrc',
4746
'sandbox' => 'sandbox',
47+
'manifest-src' => 'manifestSrc',
48+
'script-src-elem' => 'scriptSrcElem',
4849
];
4950

5051
/**
@@ -185,6 +186,13 @@ class ContentSecurityPolicy
185186
*/
186187
protected $manifestSrc = [];
187188

189+
/**
190+
* The `script-src-elem` directive applies to all script requests and script blocks.
191+
*
192+
* @var array<string, bool>|string
193+
*/
194+
protected $scriptSrcElem = [];
195+
188196
/**
189197
* Instructs user agents to rewrite URL schemes by changing HTTP to HTTPS.
190198
*
@@ -649,6 +657,22 @@ public function addScriptSrc($uri, ?bool $explicitReporting = null)
649657
return $this;
650658
}
651659

660+
/**
661+
* Adds a new value to the `script-src-elem` directive.
662+
*
663+
* @see https://www.w3.org/TR/CSP/#directive-script-src-elem
664+
*
665+
* @param list<string>|string $uri
666+
*
667+
* @return $this
668+
*/
669+
public function addScriptSrcElem($uri, ?bool $explicitReporting = null)
670+
{
671+
$this->addOption($uri, 'scriptSrcElem', $explicitReporting ?? $this->reportOnly);
672+
673+
return $this;
674+
}
675+
652676
/**
653677
* Adds a new value to the `style-src` directive.
654678
*

tests/system/HTTP/ContentSecurityPolicyTest.php

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -374,6 +374,23 @@ public function testScriptSrc(): void
374374
$this->assertContains("script-src 'self' cdn.cloudy.com", $this->getCspDirectives($header));
375375
}
376376

377+
#[PreserveGlobalState(false)]
378+
#[RunInSeparateProcess]
379+
public function testScriptSrcElem(): void
380+
{
381+
$this->csp->addScriptSrcElem('cdn.cloudy.com');
382+
$this->csp->addScriptSrcElem('them.com', true);
383+
$this->assertTrue($this->work());
384+
385+
$header = $this->getHeaderEmitted('Content-Security-Policy-Report-Only');
386+
$this->assertIsString($header);
387+
$this->assertContains('script-src-elem them.com', $this->getCspDirectives($header));
388+
389+
$header = $this->getHeaderEmitted('Content-Security-Policy');
390+
$this->assertIsString($header);
391+
$this->assertContains("script-src-elem 'self' cdn.cloudy.com", $this->getCspDirectives($header));
392+
}
393+
377394
#[PreserveGlobalState(false)]
378395
#[RunInSeparateProcess]
379396
public function testStyleSrc(): void

user_guide_src/source/changelogs/v4.7.0.rst

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -331,8 +331,16 @@ Others
331331
Model
332332
=====
333333

334-
Helpers and Functions
335-
=====================
334+
HTTP
335+
====
336+
337+
Content Security Policy
338+
-----------------------
339+
340+
- Added support for the following CSP Level 3 directives:
341+
- ``script-src-elem``
342+
343+
Update your CSP configuration in **app/Config/ContentSecurityPolicy.php** to include these new directives as needed.
336344

337345
Others
338346
======

0 commit comments

Comments
 (0)