nicoSWD\SecHeaderCheck\Domain\Result\Processor\ContentSecurityPolicyProcessor

Complexity

Total Complexity

8

Size/Duplication

Total Lines	31
Duplicated Lines	0 %

Test Coverage

Coverage

0%

Importance

Changes

0

2 Methods

Rating	Name	Duplication	Size	Complexity
B	process()	0	24	7
A	header()	0	3	1

<?php declare(strict_types=1);

/**
 * @license  http://opensource.org/licenses/mit-license.php MIT
 * @link     https://github.com/nicoSWD
 * @author   Nicolas Oelgart <nico@oelgart.com>
 */
namespace nicoSWD\SecHeaderCheck\Domain\Result\Processor;

use nicoSWD\SecHeaderCheck\Domain\Result\ObservationCollection;
use nicoSWD\SecHeaderCheck\Domain\Result\Result\ContentSecurityPolicyHeaderResult;
use nicoSWD\SecHeaderCheck\Domain\Result\ParsedHeaders;
use nicoSWD\SecHeaderCheck\Domain\Result\Warning\ContentSecurityPolicyMissingFrameAncestorsDirectiveWarning;

final class ContentSecurityPolicyProcessor extends AbstractProcessor
{
    public function process(ParsedHeaders $parsedHeaders): void
    {
        $contentSecurityPolicyHeader = $this->header();
        $hasSecureFrameAncestors = false;
        $hasSecureXFrameOptions = false;
        $observations = new ObservationCollection();

        if ($contentSecurityPolicyHeader->isSecure()) {
            $hasSecureFrameAncestors = true;
        }

        $xFrameOptionsHeader = $parsedHeaders->getXFrameOptionsResult();

        if ($xFrameOptionsHeader && $xFrameOptionsHeader->isSecure()) {
            $hasSecureXFrameOptions = true;
        }

        if (!$hasSecureXFrameOptions) {
            if ($contentSecurityPolicyHeader && !$hasSecureFrameAncestors) {
                $observations->addWarning(new ContentSecurityPolicyMissingFrameAncestorsDirectiveWarning());
            }
        }

        $this->addObservations($observations);
    }

    private function header(): ContentSecurityPolicyHeaderResult
    {
        return $this->parsedHeader;

The expression return $this->parsedHeader returns the type nicoSWD\SecHeaderCheck\Domain\Result\AbstractParsedHeader which includes types incompatible with the type-hinted return nicoSWD\SecHeaderCheck\Domain\Result\Result\ContentSecurityPolicyHeaderResult.

    }
}