Update ContentSecurityPolicy handling and ResponseExtension

This commit is contained in:
Younes ENNAJI
2026-03-02 03:27:04 +00:00
parent f399bc912d
commit 286fe5143e
3 changed files with 24 additions and 3 deletions
@@ -44,6 +44,11 @@ final class ContentSecurityPolicyHandler implements ContentSecurityPolicyHandler
$this->cspDisabled = true; $this->cspDisabled = true;
} }
public function reset(): void
{
$this->cspDisabled = false;
}
public function updateResponseHeaders(RequestInterface $request, ResponseInterface $response): array public function updateResponseHeaders(RequestInterface $request, ResponseInterface $response): array
{ {
if ($this->cspDisabled) { if ($this->cspDisabled) {
@@ -168,10 +173,13 @@ final class ContentSecurityPolicyHandler implements ContentSecurityPolicyHandler
$directives = []; $directives = [];
foreach (explode(';', $header ?: '') as $directive) { foreach (explode(';', $header ?: '') as $directive) {
$parts = explode(' ', trim($directive)); $directive = trim($directive);
if (\count($parts) < 1) { // @phpstan-ignore-line
if ('' === $directive) {
continue; continue;
} }
$parts = explode(' ', $directive);
$name = array_shift($parts); $name = array_shift($parts);
$directives[$name] = $parts; $directives[$name] = $parts;
} }
@@ -20,4 +20,9 @@ interface ContentSecurityPolicyHandlerInterface
* @return array{csp_script_nonce?: ?string, csp_style_nonce?: ?string} * @return array{csp_script_nonce?: ?string, csp_style_nonce?: ?string}
*/ */
public function updateResponseHeaders(RequestInterface $request, ResponseInterface $response): array; public function updateResponseHeaders(RequestInterface $request, ResponseInterface $response): array;
/**
* Reset the handler state for long-running processes (Octane, FrankenPHP, etc.).
*/
public function reset(): void;
} }
+9 -1
View File
@@ -94,7 +94,15 @@ final readonly class ResponseExtension implements ResponseExtensionInterface
$url = $request->getUri(); $url = $request->getUri();
foreach ($this->excludedPaths as $regexPattern) { foreach ($this->excludedPaths as $regexPattern) {
if (preg_match($regexPattern, $url)) { $result = @preg_match($regexPattern, $url);
if (false === $result) {
trigger_error(\sprintf('Invalid regex pattern "%s" in excluded_paths configuration', $regexPattern), \E_USER_WARNING);
continue;
}
if (1 === $result) {
return true; return true;
} }
} }