Merge branch 'feature/175' into develop

Close #175
Fix #163

Author: michalbundyra

CHANGELOG.md

@@ -6,7 +6,7 @@ All notable changes to this project will be documented in this file, in reverse
 
 ### Added
 
-- Nothing.
+- [#175](https://github.com/zendframework/zend-http/pull/175) adds support for Content Security Policy Level 3 Header directives.
 
 ### Changed
 

src/Header/ContentSecurityPolicy.php

@@ -8,7 +8,7 @@
 namespace Zend\Http\Header;
 
 /**
- * Content Security Policy 1.0 Header
+ * Content Security Policy Level 3 Header
  *
  * @link http://www.w3.org/TR/CSP/
  */
@@ -21,17 +21,38 @@ class ContentSecurityPolicy implements MultipleHeaderInterface
      */
     protected $validDirectiveNames = [
         // As per http://www.w3.org/TR/CSP/#directives
+        // Fetch directives
+        'child-src',
+        'connect-src',
         'default-src',
-        'script-src',
-        'object-src',
-        'style-src',
+        'font-src',
+        'frame-src',
         'img-src',
+        'manifest-src',
         'media-src',
-        'frame-src',
-        'font-src',
-        'connect-src',
+        'object-src',
+        'prefetch-src',
+        'script-src',
+        'script-src-elem',
+        'script-src-attr',
+        'style-src',
+        'style-src-elem',
+        'style-src-attr',
+        'worker-src',
+
+        // Document directives
+        'base-uri',
+        'plugin-types',
         'sandbox',
+
+        // Navigation directives
+        'form-action',
+        'frame-ancestors',
+        'navigate-to',
+
+        // Reporting directives
         'report-uri',
+        'report-to',
     ];
 
     /**

test/Header/ContentSecurityPolicyTest.php

@@ -187,4 +187,65 @@ public function testMultiple()
             $headers->toString()
         );
     }
+
+    public static function validDirectives()
+    {
+        return [
+            ['child-src', ["'self'"],"Content-Security-Policy: child-src 'self';"],
+            ['manifest-src', ["'self'"], "Content-Security-Policy: manifest-src 'self';"],
+            ['worker-src', ["'self'"], "Content-Security-Policy: worker-src 'self';"],
+            ['prefetch-src', ["'self'"], "Content-Security-Policy: prefetch-src 'self';"],
+            ['script-src-elem', ["'self'"], "Content-Security-Policy: script-src-elem 'self';"],
+            ['script-src-attr', ["'self'"], "Content-Security-Policy: script-src-attr 'self';"],
+            ['style-src-elem', ["'self'"], "Content-Security-Policy: style-src-elem 'self';"],
+            ['style-src-attr', ["'self'"], "Content-Security-Policy: style-src-attr 'self';"],
+            ['base-uri', ["'self'", "'unsafe-inline'"], "Content-Security-Policy: base-uri 'self' 'unsafe-inline';"],
+            ['plugin-types', ['text/csv'], 'Content-Security-Policy: plugin-types text/csv;'],
+            [
+                'form-action',
+                ['http://*.example.com', "'self'"],
+                "Content-Security-Policy: form-action http://*.example.com 'self';"
+            ],
+            [
+                'frame-ancestors',
+                ['http://*.example.com', "'self'"],
+                "Content-Security-Policy: frame-ancestors http://*.example.com 'self';"
+            ],
+            ['navigate-to', ['example.com'], 'Content-Security-Policy: navigate-to example.com;'],
+            ['sandbox', ['allow-forms'], 'Content-Security-Policy: sandbox allow-forms;'],
+        ];
+    }
+
+    /**
+     * @dataProvider validDirectives
+     *
+     * @param string $directive
+     * @param string[] $values
+     * @param string $expected
+     */
+    public function testContentSecurityPolicySetDirectiveThrowsExceptionIfMissingDirectiveNameGiven(
+        $directive,
+        array $values,
+        $expected
+    ) {
+        $csp = new ContentSecurityPolicy();
+        $csp->setDirective($directive, $values);
+
+        self::assertSame($expected, $csp->toString());
+    }
+
+    /**
+     * @dataProvider validDirectives
+     *
+     * @param string $directive
+     * @param string[] $values
+     * @param string $header
+     */
+    public function testFromString($directive, array $values, $header)
+    {
+        $contentSecurityPolicy = ContentSecurityPolicy::fromString($header);
+
+        self::assertArrayHasKey($directive, $contentSecurityPolicy->getDirectives());
+        self::assertSame(implode(' ', $values), $contentSecurityPolicy->getDirectives()[$directive]);
+    }
 }