| Code Coverage
| Lines | Functions and Methods | Classes and Traits
Total |  | n/a | 0 / 0 |  | n/a | 0 / 0 | CRAP |  | n/a | 0 / 0
ContentSecurityPolicy |  | n/a | 0 / 0 |  | n/a | 0 / 0 | 0 |  | n/a | 0 / 0

1 | <?php
2 |
3 | namespace Config;
4 |
5 | use CodeIgniter\Config\BaseConfig;
6 |
7 | /**
8 | * Stores the default settings for the ContentSecurityPolicy, if you
9 | * choose to use it. The values here will be read in and set as defaults
10 | * for the site. If needed, they can be overridden on a page-by-page basis.
11 | *
12 | * Suggested reference for explanations:
13 | *
14 | * @see https://www.html5rocks.com/en/tutorials/security/content-security-policy/
15 | */
16 | class ContentSecurityPolicy extends BaseConfig
17 | {
18 | // -------------------------------------------------------------------------
19 | // Broadbrush CSP management
20 | // -------------------------------------------------------------------------
21 |
22 | /**
23 | * Default CSP report context
24 | */
25 | public bool $reportOnly = false;
26 |
27 | /**
28 | * Specifies a URL where a browser will send reports
29 | * when a content security policy is violated.
30 | */
31 | public ?string $reportURI = null;
32 |
33 | /**
34 | * Specifies a reporting endpoint to which violation reports ought to be sent.
35 | */
36 | public ?string $reportTo = null;
37 |
38 | /**
39 | * Instructs user agents to rewrite URL schemes, changing
40 | * HTTP to HTTPS. This directive is for websites with
41 | * large numbers of old URLs that need to be rewritten.
42 | */
43 | public bool $upgradeInsecureRequests = false;
44 |
45 | // -------------------------------------------------------------------------
46 | // CSP DIRECTIVES SETTINGS
47 | // NOTE: once you set a policy to 'none', it cannot be further restricted
48 | // -------------------------------------------------------------------------
49 |
50 | /**
51 | * Will default to `'self'` if not overridden
52 | *
53 | * @var list<string>|string|null
54 | */
55 | public $defaultSrc;
56 |
57 | /**
58 | * Lists allowed scripts' URLs.
59 | *
60 | * @var list<string>|string
61 | */
62 | public $scriptSrc = 'self';
63 |
64 | /**
65 | * Specifies valid sources for JavaScript <script> elements.
66 | *
67 | * @var list<string>|string
68 | */
69 | public array|string $scriptSrcElem = 'self';
70 |
71 | /**
72 | * Specifies valid sources for JavaScript inline event
73 | * handlers and JavaScript URLs.
74 | *
75 | * @var list<string>|string
76 | */
77 | public array|string $scriptSrcAttr = 'self';
78 |
79 | /**
80 | * Lists allowed stylesheets' URLs.
81 | *
82 | * @var list<string>|string
83 | */
84 | public $styleSrc = 'self';
85 |
86 | /**
87 | * Specifies valid sources for stylesheets <link> elements.
88 | *
89 | * @var list<string>|string
90 | */
91 | public array|string $styleSrcElem = 'self';
92 |
93 | /**
94 | * Specifies valid sources for stylesheets inline
95 | * style attributes and `<style>` elements.
96 | *
97 | * @var list<string>|string
98 | */
99 | public array|string $styleSrcAttr = 'self';
100 |
101 | /**
102 | * Defines the origins from which images can be loaded.
103 | *
104 | * @var list<string>|string
105 | */
106 | public $imageSrc = 'self';
107 |
108 | /**
109 | * Restricts the URLs that can appear in a page's `<base>` element.
110 | *
111 | * Will default to self if not overridden
112 | *
113 | * @var list<string>|string|null
114 | */
115 | public $baseURI;
116 |
117 | /**
118 | * Lists the URLs for workers and embedded frame contents
119 | *
120 | * @var list<string>|string
121 | */
122 | public $childSrc = 'self';
123 |
124 | /**
125 | * Limits the origins that you can connect to (via XHR,
126 | * WebSockets, and EventSource).
127 | *
128 | * @var list<string>|string
129 | */
130 | public $connectSrc = 'self';
131 |
132 | /**
133 | * Specifies the origins that can serve web fonts.
134 | *
135 | * @var list<string>|string
136 | */
137 | public $fontSrc;
138 |
139 | /**
140 | * Lists valid endpoints for submission from `<form>` tags.
141 | *
142 | * @var list<string>|string
143 | */
144 | public $formAction = 'self';
145 |
146 | /**
147 | * Specifies the sources that can embed the current page.
148 | * This directive applies to `<frame>`, `<iframe>`, `<embed>`,
149 | * and `<applet>` tags. This directive can't be used in
150 | * `<meta>` tags and applies only to non-HTML resources.
151 | *
152 | * @var list<string>|string|null
153 | */
154 | public $frameAncestors;
155 |
156 | /**
157 | * The frame-src directive restricts the URLs which may
158 | * be loaded into nested browsing contexts.
159 | *
160 | * @var list<string>|string|null
161 | */
162 | public $frameSrc;
163 |
164 | /**
165 | * Restricts the origins allowed to deliver video and audio.
166 | *
167 | * @var list<string>|string|null
168 | */
169 | public $mediaSrc;
170 |
171 | /**
172 | * Allows control over Flash and other plugins.
173 | *
174 | * @var list<string>|string
175 | */
176 | public $objectSrc = 'self';
177 |
178 | /**
179 | * @var list<string>|string|null
180 | */
181 | public $manifestSrc;
182 |
183 | /**
184 | * @var list<string>|string
185 | */
186 | public array|string $workerSrc = [];
187 |
188 | /**
189 | * Limits the kinds of plugins a page may invoke.
190 | *
191 | * @var list<string>|string|null
192 | */
193 | public $pluginTypes;
194 |
195 | /**
196 | * List of actions allowed.
197 | *
198 | * @var list<string>|string|null
199 | */
200 | public $sandbox;
201 |
202 | /**
203 | * Nonce placeholder for style tags.
204 | */
205 | public string $styleNonceTag = '{csp-style-nonce}';
206 |
207 | /**
208 | * Nonce placeholder for script tags.
209 | */
210 | public string $scriptNonceTag = '{csp-script-nonce}';
211 |
212 | /**
213 | * Replace nonce tag automatically?
214 | */
215 | public bool $autoNonce = true;
216 | }