Signify\Middleware\SecurityHeaderMiddleware

Complexity

Total Complexity

31

Size/Duplication

Total Lines	227
Duplicated Lines	0 %

Importance

Changes	9
Bugs	4	Features	0

11 Methods

Rating	Name	Duplication	Size	Complexity
B	isCSPReportingOnlyAvailable()	0	39	7
A	getIncludeSubdomains()	0	3	1
A	getReportToGroup()	0	3	1
A	updateCspHeader()	0	20	5
A	getReportURIDirective()	0	3	1
A	isCSPReportingOnly()	0	3	2
A	getReportURI()	0	3	1
A	getReportToHeader()	0	11	1
A	addReportToHeader()	0	6	2
A	getReportToDirective()	0	3	1
B	process()	0	40	9

<?php
namespace Signify\Middleware;

use Signify\Extensions\SecurityHeaderSiteconfigExtension;
use SilverStripe\Control\Director;
use SilverStripe\Control\HTTPRequest;
use SilverStripe\Control\Middleware\HTTPMiddleware;
use SilverStripe\Core\ClassInfo;
use SilverStripe\Core\Extensible;
use SilverStripe\Core\Config\Configurable;
use SilverStripe\Dev\TestOnly;
use SilverStripe\ORM\DB;
use SilverStripe\ORM\DataObject;
use SilverStripe\SiteConfig\SiteConfig;

class SecurityHeaderMiddleware implements HTTPMiddleware
{
    use Configurable;
    use Extensible;

    /**
     * An array of HTTP headers.
     * @config
     * @var array
     */
    private static $headers = [

The private property $headers is not used, and could be removed.

        'global' => array(),
    ];

    /**
     * Whether to automatically add the CMS report endpoint to the CSP config.
     * @config
     * @var string
     */
    private static $enable_reporting = true;

The private property $enable_reporting is not used, and could be removed.

    /**
     * The URI to report CSP violations to.
     * See routes.yml
     * @config
     * @var string
     */
    private static $report_uri = 'cspviolations/report';

The private property $report_uri is not used, and could be removed.

    /**
     * Whether to use the report-to header and CSP directive.
     * @config
     * @var string
     */
    private static $use_report_to = false;

The private property $use_report_to is not used, and could be removed.

    /**
     * Whether subdomains should report to the same endpoint.
     * @config
     * @var string
     */
    private static $report_to_subdomains = false;

The private property $report_to_subdomains is not used, and could be removed.

    /**
     * The group name for the report-to CSP directive.
     * @config
     * @var string
     */
    private static $report_to_group = 'signify-csp-violation';

The private property $report_to_group is not used, and could be removed.

    /**
     * Can isCSPReportingOnly be used safely.
     *
     * This is not a config option.
     *
     * @var boolean
     */
    private static $is_csp_reporting_only_safe = false;


    public function process(HTTPRequest $request, callable $delegate)
    {
        $response = $delegate($request);

        $headersConfig = (array) $this->config()->get('headers');
        if (empty($headersConfig['global'])) {
            return $response;
        }

        $headersToSend = $headersConfig['global'];
        if ($this->config()->get('enable_reporting') && $this->config()->get('use_report_to')) {
            $this->addReportToHeader($headersToSend);
        }
        // Update CSP header.
        if (array_key_exists('Content-Security-Policy', $headersToSend)) {
            $header = 'Content-Security-Policy';
            $headerValue = $headersToSend['Content-Security-Policy'];
            // Set report only mode if appropriate.
            if ($this->isCSPReportingOnly()) {
                unset($headersToSend['Content-Security-Policy']);
                $header = 'Content-Security-Policy-Report-Only';
            }
            // Update CSP header value.
            $headersToSend[$header] = $this->updateCspHeader($headerValue);
        }
        $this->extend('updateHeaders', $headersToSend, $request);

        // Add headers to response.
        foreach ($headersToSend as $header => $value) {
            if (empty($value)) {
                continue;
            }
            $value = preg_replace('/\v/', '', $value);
            $this->extend('updateHeader', $header, $value, $request);
            if ($value) {
                $response->addHeader($header, $value);
            }
        }

        return $response;
    }

    /**
     * Returns true if the Content-Security-Policy-Report-Only header should be used.
     *
     * @return boolean
     */
    public function isCSPReportingOnly()
    {
        return self::isCSPReportingOnlyAvailable() ? SiteConfig::current_site_config()->CSPReportingOnly : false;

The method Signify\Middleware\SecurityHeaderMiddleware::isCSPReportingOnlyAvailable() is not static, but was called statically.

    }

    protected function getReportURI()
    {
        return Director::absoluteURL($this->config()->get('report_uri'));
    }

    protected function getIncludeSubdomains()
    {
        return $this->config()->get('report_to_subdomains');
    }

    protected function getReportToGroup()
    {
        return $this->config()->get('report_to_group');
    }

    protected function getReportURIDirective()
    {
        return "report-uri {$this->getReportURI()}";
    }

    protected function getReportToDirective()
    {
        return "report-to {$this->getReportToGroup()}";
    }

    protected function addReportToHeader(&$headers)
    {
        if (array_key_exists('Report-To', $headers)) {
            $headers['Report-To'] = $headers['Report-To'] . ',' . $this->getReportToHeader();
        } else {
            $headers['Report-To'] = $this->getReportToHeader();
        }
    }

    protected function getReportToHeader()
    {
        $header = [
            'group' => $this->getReportToGroup(),
            'max_age' => 1800,
            'endpoints' => [[
                'url' => $this->getReportURI(),
            ],],
            'include_subdomains' => $this->getIncludeSubdomains(),
        ];
        return json_encode($header);
    }

    protected function updateCspHeader($cspHeader)
    {
        if ($this->config()->get('enable_reporting')) {
            // Add or update report-uri directive.
            if (strpos($cspHeader, 'report-uri')) {
                $cspHeader = str_replace('report-uri', $this->getReportURIDirective(), $cspHeader);
            } else {
                $cspHeader = rtrim($cspHeader, ';') . "; {$this->getReportURIDirective()};";
            }

            // Add report-to directive.
            // Note that unlike report-uri, only the first endpoint is used if multiple are declared.
            if ($this->config()->get('use_report_to')) {
                if (strpos($cspHeader, 'report-to') === false) {
                    $cspHeader = rtrim($cspHeader, ';') . "; {$this->getReportToDirective()};";
                }
            }
        }

        return $cspHeader;
    }

    /**
     * Is the CSPReportingOnly field safe to read.
     *
     * If the module is installed and the codebase is flushed before the database has been built, accessing SiteConfig causes an error.
     *
     * @return boolean
     */
    private function isCSPReportingOnlyAvailable()
    {
        // Cached true value.
        if (self::$is_csp_reporting_only_safe) {
            return self::$is_csp_reporting_only_safe;
        }

        // Basically SiteConfig, but it could be an injected class.
        $classes = ClassInfo::classesWithExtension(SecurityHeaderSiteconfigExtension::class);

        // Check if all tables and fields required for the class exist in the database.
        $requiredClasses = [];
        foreach ($classes as $class) {
            $requiredClasses += ClassInfo::dataClassesFor($class);
        }

        $schema = DataObject::getSchema();
        foreach ($requiredClasses as $required) {
            // Skip test classes, as not all test classes are scaffolded at once
            if (is_a($required, TestOnly::class, true)) {
                continue;
            }

            // if any of the tables aren't created in the database
            $table = $schema->tableName($required);
            if (!ClassInfo::hasTable($table)) {
                return false;
            }

            // if any of the tables don't have all fields mapped as table columns
            $dbFields = DB::field_list($table);
            if (!isset($dbFields['CSPReportingOnly'])) {
                return false;
            }
        }

        self::$is_csp_reporting_only_safe = true;

        return true;
    }
}