Skip to content

Commit 0864c0c

Browse files
stevenmaguirestevenmaguire
committed
init
0 parents  commit 0864c0c

12 files changed

+808
-0
lines changed

‎.gitattributes

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Path-based git attributes
2+
# https://www.kernel.org/pub/software/scm/git/docs/gitattributes.html
3+
4+
# Ignore all test and documentation with "export-ignore".
5+
/.gitattributes export-ignore
6+
/.gitignore export-ignore
7+
/.travis.yml export-ignore
8+
/phpunit.xml.dist export-ignore
9+
/.scrutinizer.yml export-ignore
10+
/tests export-ignore

‎.gitignore

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
build
2+
composer.lock
3+
docs
4+
vendor

‎.scrutinizer.yml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
filter:
2+
excluded_paths: [tests/*]
3+
checks:
4+
php:
5+
code_rating: true
6+
remove_extra_empty_lines: true
7+
remove_php_closing_tag: true
8+
remove_trailing_whitespace: true
9+
fix_use_statements:
10+
remove_unused: true
11+
preserve_multiple: false
12+
preserve_blanklines: true
13+
order_alphabetically: true
14+
fix_php_opening_tag: true
15+
fix_linefeed: true
16+
fix_line_ending: true
17+
fix_identation_4spaces: true
18+
fix_doc_comments: true
19+
tools:
20+
external_code_coverage:
21+
timeout: 600
22+
runs: 1
23+
php_analyzer: true
24+
php_code_coverage: false
25+
php_code_sniffer:
26+
config:
27+
standard: PSR2
28+
filter:
29+
paths: ['src']
30+
php_loc:
31+
enabled: true
32+
excluded_dirs: [vendor, tests]
33+
php_cpd:
34+
enabled: true
35+
excluded_dirs: [vendor, tests]

‎.travis.yml

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
language: php
2+
3+
php:
4+
- 5.6
5+
- 7.0
6+
- hhvm
7+
8+
before_script:
9+
- travis_retry composer self-update
10+
- travis_retry composer install --no-interaction --prefer-source --dev
11+
- travis_retry phpenv rehash
12+
13+
script:
14+
- ./vendor/bin/phpcs --standard=psr2 src/
15+
- ./vendor/bin/phpunit --coverage-text --coverage-clover=coverage.clover
16+
17+
after_script:
18+
- wget https://scrutinizer-ci.com/ocular.phar
19+
- php ocular.phar code-coverage:upload --format=php-clover coverage.clover

‎CHANGELOG.md

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
#Changelog
2+
3+
All Notable changes to `laravel-middleware-csp` will be documented in this file
4+
5+
## NEXT - YYYY-MM-DD
6+
7+
### Added
8+
- Nothing
9+
10+
### Deprecated
11+
- Nothing
12+
13+
### Fixed
14+
- Nothing
15+
16+
### Removed
17+
- Nothing
18+
19+
### Security
20+
- Nothing

‎CONTRIBUTING.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# Contributing
2+
3+
Contributions are **welcome** and will be fully **credited**.
4+
5+
We accept contributions via Pull Requests on [Github](https://github.com/stevenmaguire/laravel-middleware-csp).
6+
7+
8+
## Pull Requests
9+
10+
- **[PSR-2 Coding Standard](https://github.com/php-fig/fig-standards/blob/master/accepted/PSR-2-coding-style-guide.md)** - The easiest way to apply the conventions is to install [PHP Code Sniffer](http://pear.php.net/package/PHP_CodeSniffer).
11+
12+
- **Add tests!** - Your patch won't be accepted if it doesn't have tests.
13+
14+
- **Document any change in behaviour** - Make sure the `README.md` and any other relevant documentation are kept up-to-date.
15+
16+
- **Consider our release cycle** - We try to follow [SemVer v2.0.0](http://semver.org/). Randomly breaking public APIs is not an option.
17+
18+
- **Create feature branches** - Don't ask us to pull from your master branch.
19+
20+
- **One pull request per feature** - If you want to do more than one thing, send multiple pull requests.
21+
22+
- **Send coherent history** - Make sure each individual commit in your pull request is meaningful. If you had to make multiple intermediate commits while developing, please squash them before submitting.
23+
24+
25+
## Running Tests
26+
27+
``` bash
28+
$ phpunit
29+
```
30+
31+
32+
**Happy coding**!

‎LICENSE.md

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# The MIT License (MIT)
2+
3+
Copyright (c) 2015 Steven Maguire <stevenmaguire@gmail.com>
4+
5+
> Permission is hereby granted, free of charge, to any person obtaining a copy
6+
> of this software and associated documentation files (the "Software"), to deal
7+
> in the Software without restriction, including without limitation the rights
8+
> to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
> copies of the Software, and to permit persons to whom the Software is
10+
> furnished to do so, subject to the following conditions:
11+
>
12+
> The above copyright notice and this permission notice shall be included in
13+
> all copies or substantial portions of the Software.
14+
>
15+
> THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
> IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
> FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
> AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
> LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
> OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
21+
> THE SOFTWARE.

‎README.md

Lines changed: 234 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,234 @@
1+
# Content Security Policy Middleware
2+
3+
[![Latest Version](https://img.shields.io/github/release/stevenmaguire/laravel-middleware-csp.svg?style=flat-square)](https://github.com/stevenmaguire/laravel-middleware-csp/releases)
4+
[![Software License](https://img.shields.io/badge/license-MIT-brightgreen.svg?style=flat-square)](LICENSE.md)
5+
[![Build Status](https://img.shields.io/travis/stevenmaguire/laravel-middleware-csp/master.svg?style=flat-square)](https://travis-ci.org/stevenmaguire/laravel-middleware-csp)
6+
[![Coverage Status](https://img.shields.io/scrutinizer/coverage/g/stevenmaguire/laravel-middleware-csp.svg?style=flat-square)](https://scrutinizer-ci.com/g/stevenmaguire/laravel-middleware-csp/code-structure)
7+
[![Quality Score](https://img.shields.io/scrutinizer/g/stevenmaguire/laravel-middleware-csp.svg?style=flat-square)](https://scrutinizer-ci.com/g/stevenmaguire/laravel-middleware-csp)
8+
[![Total Downloads](https://img.shields.io/packagist/dt/stevenmaguire/laravel-middleware-csp.svg?style=flat-square)](https://packagist.org/packages/stevenmaguire/laravel-middleware-csp)
9+
10+
Provides support for enforcing Content Security Policy with headers in Laravel responses.
11+
12+
## Install
13+
14+
Via Composer
15+
16+
``` bash
17+
$ composer require stevenmaguire/laravel-middleware-csp
18+
```
19+
20+
## Usage
21+
22+
### Register as route middleware
23+
24+
``` php
25+
// within app/Http/Kernal.php
26+
27+
protected $routeMiddleware = [
28+
//
29+
'secure.content' => \Stevenmaguire\Http\Middleware\Laravel\EnforceContentSecurity::class,
30+
//
31+
];
32+
```
33+
34+
### Apply content security policy to routes
35+
36+
The following will apply all default profiles to the `gallery` route.
37+
38+
``` php
39+
// within app/Http/routes.php
40+
41+
Route::get('gallery', ['middleware' => 'secure.content', function () {
42+
return 'pictures!';
43+
}]);
44+
```
45+
46+
The following will apply all default profiles and a specific `flickr` profile to the `gallery` route.
47+
48+
``` php
49+
// within app/Http/routes.php
50+
51+
Route::get('gallery', ['middleware' => 'secure.content:flickr', function () {
52+
return 'pictures!';
53+
}]);
54+
```
55+
56+
57+
### Apply content security policy to controllers
58+
59+
The following will apply all default profiles to all methods within the `GalleryController`.
60+
61+
``` php
62+
// within app/Http/Controllers/GalleryController.php
63+
64+
public function __construct()
65+
{
66+
$this->middleware('secure.content');
67+
}
68+
```
69+
The following will apply all default profiles and a specific `google` profile to all methods within the `GalleryController`.
70+
71+
``` php
72+
// within app/Http/Controllers/GalleryController.php
73+
74+
public function __construct()
75+
{
76+
$this->middleware('secure.content:google');
77+
}
78+
```
79+
You can include any number of specific profiles to any middleware decoration. For instance, the following will apply default, `google`, `flickr`, and `my_custom` profiles to all methods within the `GalleryController`.
80+
81+
``` php
82+
// within app/Http/Controllers/GalleryController.php
83+
84+
public function __construct()
85+
{
86+
$this->middleware('secure.content:google,flickr,my_custom');
87+
}
88+
```
89+
90+
### Create content security profiles
91+
92+
The default location for content security profiles is `security.content`. If you wish to use this default configuration, ensure your project includes the appropriate configuration files.
93+
94+
The structure of this configuration array is important. The middleware expects to find a `default` key with a string value and a `profiles` key with an array value.
95+
96+
``` php
97+
// within config/security.php
98+
99+
return [
100+
'content' => [
101+
'default' => '',
102+
'profiles' => [],
103+
],
104+
];
105+
106+
```
107+
The `profiles` array contains the security profiles for your application. Each profile name must be unique and is expected to have a value of an array.
108+
109+
``` php
110+
// within config/security.php
111+
112+
return [
113+
'content' => [
114+
'default' => '',
115+
'profiles' => [
116+
'profile_one' => [],
117+
'profile_two' => [],
118+
'profile_three' => [],
119+
],
120+
],
121+
];
122+
123+
```
124+
Each profile array should contain keys that correspond to Content Security Policy directives. The value of each of these directives can be a string, comma-separated string, or array of strings. Each string value should correspond to the domain associated with your directive and profile.
125+
126+
``` php
127+
// within config/security.php
128+
129+
return [
130+
'content' => [
131+
'default' => '',
132+
'profiles' => [
133+
'profile_one' => [
134+
'base-uri' => 'https://domain.com,http://google.com',
135+
],
136+
'profile_two' => [
137+
'font-src' => 'https://domain.com',
138+
'base-uri' => [
139+
"'self'",
140+
'http://google.com'
141+
],
142+
],
143+
'profile_three' => [
144+
'font-src' => [
145+
"'self'"
146+
],
147+
],
148+
],
149+
],
150+
];
151+
152+
```
153+
The `default` key value should be a string, comma-separated string, or array of strings that correspond to the unique profile names that you would like to enforce on all responses with minimal content security applied.
154+
155+
``` php
156+
// within config/security.php
157+
158+
return [
159+
'content' => [
160+
'default' => 'profile_one',
161+
'profiles' => [
162+
'profile_one' => [
163+
'base-uri' => 'https://domain.com,http://google.com',
164+
],
165+
'profile_two' => [
166+
'font-src' => 'https://domain.com',
167+
'base-uri' => [
168+
"'self'",
169+
'http://google.com'
170+
],
171+
],
172+
'profile_three' => [
173+
'font-src' => [
174+
"'self'"
175+
],
176+
],
177+
],
178+
],
179+
];
180+
181+
```
182+
183+
Here is a real-world example:
184+
185+
``` php
186+
// within config/security.php
187+
188+
return [
189+
'content' => [
190+
'default' => 'global',
191+
'profiles' => [
192+
'global' => [
193+
'base-uri' => "'self'",
194+
'font-src' => [
195+
"'self'",
196+
'fonts.gstatic.com'
197+
],
198+
'img-src' => "'self'",
199+
'script-src' => "'self'",
200+
'style-src' => [
201+
"'self'",
202+
"'unsafe-inline'",
203+
'fonts.googleapis.com'
204+
],
205+
],
206+
'flickr' => [
207+
'img-src' => [
208+
'https://*.staticflickr.com',
209+
],
210+
],
211+
],
212+
],
213+
];
214+
215+
```
216+
217+
## Testing
218+
219+
``` bash
220+
$ ./vendor/bin/phpunit
221+
```
222+
223+
## Contributing
224+
225+
Please see [CONTRIBUTING](https://github.com/stevenmaguire/laravel-middleware-csp/blob/master/CONTRIBUTING.md) for details.
226+
227+
## Credits
228+
229+
- [Steven Maguire](https://github.com/stevenmaguire)
230+
- [All Contributors](https://github.com/stevenmaguire/laravel-middleware-csp/contributors)
231+
232+
## License
233+
234+
The MIT License (MIT). Please see [License File](LICENSE.md) for more information.

0 commit comments

Comments
 (0)