Spatie\Csp\Policies\Policy

Complexity

Total Complexity

17

Size/Duplication

Total Lines	128
Duplicated Lines	0 %

Coupling/Cohesion

Components	2
Dependencies	4

Importance

Changes

0

12 Methods

Rating	Name	Duplication	Size	Complexity
	configure()	0	1	?
A	addDirective()	0	14	3
A	reportOnly()	0	6	1
A	enforce()	0	6	1
A	reportTo()	0	6	1
A	shouldBeApplied()	0	4	1
A	addNonceForDirective()	0	4	1
A	addFrame()	0	7	1
A	applyTo()	0	14	3
A	__toString()	0	10	1
A	guardAgainstInvalidDirectives()	0	6	2
A	sanitizeValue()	0	17	2

<?php

namespace Spatie\Csp\Policies;

use Spatie\Csp\Directive;
use Illuminate\Http\Request;
use Spatie\Csp\Exceptions\InvalidDirective;
use Symfony\Component\HttpFoundation\Response;

abstract class Policy
{
    protected $directives = [];

    protected $reportOnly = false;

    abstract public function configure();

    /**
     * @param string $directive
     * @param string|array $values
     *
     * @return \Spatie\Csp\Policies\Policy
     *
     * @throws \Spatie\Csp\Exceptions\InvalidDirective
     */
    public function addDirective(string $directive, $values): self
    {
        $this->guardAgainstInvalidDirectives($directive);

        foreach (array_wrap($values) as $value) {
            $sanitizedValue = $this->sanitizeValue($value);

            if (! in_array($sanitizedValue, $this->directives[$directive] ?? [])) {
                $this->directives[$directive][] = $sanitizedValue;
            }
        }

        return $this;
    }

    public function reportOnly(): self
    {
        $this->reportOnly = true;

        return $this;
    }

    public function enforce(): self
    {
        $this->reportOnly = false;

        return $this;
    }

    public function reportTo(string $uri): self
    {
        $this->directives['report-uri'] = [$uri];

        return $this;
    }

    public function shouldBeApplied(Request $request, Response $response): bool

The parameter $request is not used and could be removed.

The parameter $response is not used and could be removed.

    {
        return config('csp.enabled');
    }

    public function addNonceForDirective(string $directive): self
    {
        return $this->addDirective($directive, "'nonce-".app('csp-nonce')."'");
    }

    /**
     * @param string|array $values
     *
     * @return \Spatie\Csp\Policies\Policy
     *
     * @throws \Spatie\Csp\Exceptions\InvalidDirective
     */
    public function addFrame($values): self
    {
        return $this
            ->addDirective(Directive::WORKER, $values)
            ->addDirective(Directive::CHILD, $values)
            ->addDirective(Directive::FRAME, $values);
    }

    public function applyTo(Response $response)
    {
        $this->configure();

        $headerName = $this->reportOnly
            ? 'Content-Security-Policy-Report-Only'
            : 'Content-Security-Policy';

        if ($response->headers->has($headerName)) {
            return;
        }

        $response->headers->set($headerName, (string) $this);
    }

    public function __toString()
    {
        return collect($this->directives)
            ->map(function (array $values, string $directive) {
                $valueString = implode(' ', $values);

                return "{$directive} {$valueString}";
            })
            ->implode(';');
    }

    protected function guardAgainstInvalidDirectives(string $directive)
    {
        if (! Directive::isValid($directive)) {
            throw InvalidDirective::notSupported($directive);
        }
    }

    protected function sanitizeValue(string $value): string
    {
        $specialDirectiveValues = [
            'none',
            'report-sample',
            'self',
            'strict-dynamic',
            'unsafe-eval',
            'unsafe-inline',
        ];

        if (in_array($value, $specialDirectiveValues)) {
            return "'{$value}'";
        }

        return $value;
    }
}