Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

[WebProfiler] Remove 'none' when appending CSP tokens#36786

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
fabpot merged 1 commit intosymfony:4.4fromndench:fix-csp-none
May 13, 2020

Conversation

@ndench
Copy link
Contributor

@ndenchndench commentedMay 12, 2020•
edited
Loading

QA
Branch?3.4, 4.4, 5.0
Bug fix?yes
New feature?no
Deprecations?no
TicketsFix#36645
LicenseMIT
Doc PRn/a

@nicolas-grekas asked me to to have a look at this after#36678.

If a user has a CSP policy ofdefault-src 'none', then the WebProfiler copies'none' toscript-src andstyle-src then adds other sources. This creates an invalid policy since'none' is only allowed when it's the only item in the source list.

This will probably need to be merged into 3.4 first, I started on 4.4 so I can test in my current symfony project which requires 4.4.

@nicolas-grekas
Copy link
Member

nicolas-grekas commentedMay 12, 2020•
edited
Loading

Thank you@ndench
Is this ready for 4.4? Do your local tests work as expected?

@ndench
Copy link
ContributorAuthor

Yep, seems to work as expected for me. I'm unsure why aappveyor is failing though.

The only issue I can see is if someone specifiesdefault-src: 'none' <some other source> at which point we won't remove the'none'. However, that means their CSP was invalid before the WebProfiler touches it, so I don't think that's a problem.

@fabpot
Copy link
Member

Thank you@ndench.

@fabpotfabpot merged commit3150104 intosymfony:4.4May 13, 2020
@fabpotfabpot mentioned this pull requestMay 16, 2020
This was referencedMay 31, 2020
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@fabpotfabpotfabpot approved these changes

@nicolas-grekasnicolas-grekasnicolas-grekas approved these changes

Assignees

No one assigned

Projects

None yet

Milestone

3.4

Development

Successfully merging this pull request may close these issues.

4 participants

@ndench@nicolas-grekas@fabpot@carsonbot
[8]ページ先頭
©2009-2025 Movatter.jp