diff --git a/seckit.module b/seckit.module
index 5a2cb15..e860552 100644
--- a/seckit.module
+++ b/seckit.module
@@ -1,4 +1,5 @@
$report->{'violated-directive'},
+ '@directive' => $report->{'violated-directive'},
'@blocked_uri' => $report->{'blocked-uri'},
- '@data' => print_r($report, TRUE),
+ '@data' => print_r($report, TRUE),
);
\Drupal::logger('seckit')->warning('CSP: Directive @directive violated.
Blocked URI: @blocked_uri.
Data: @data
', $info);
}
@@ -56,4 +55,5 @@ class SeckitExportController {
return new Response();
}
+
}
diff --git a/src/EventSubscriber/SecKitEventSubscriber.php b/src/EventSubscriber/SecKitEventSubscriber.php
index 999e57b..bea0e0d 100644
--- a/src/EventSubscriber/SecKitEventSubscriber.php
+++ b/src/EventSubscriber/SecKitEventSubscriber.php
@@ -9,6 +9,9 @@ use Symfony\Component\EventDispatcher\EventSubscriberInterface;
use Symfony\Component\HttpFoundation\Response;
use Drupal\Component\Utility\Xss;
+/**
+ * Subscribing an event.
+ */
class SecKitEventSubscriber implements EventSubscriberInterface {
protected $config;
@@ -27,44 +30,59 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
*/
protected $response;
+ /**
+ * Class constructor.
+ */
public function __construct() {
$this->config = \Drupal::config('seckit.settings');
}
+ /**
+ * Executes actions on the request event.
+ *
+ * @param \Symfony\Component\HttpKernel\Event\GetResponseEvent $event
+ * Event Response Object.
+ */
public function onKernelRequest(GetResponseEvent $event) {
$this->request = $event->getRequest();
- // execute necessary functions
+ // Execute necessary functions.
if ($this->config->get('seckit_csrf.origin')) {
- $this->_seckit_origin($event);
+ $this->seckitOrigin($event);
}
}
+ /**
+ * Executes actions on the respose event.
+ *
+ * @param \Symfony\Component\HttpKernel\Event\FilterResponseEvent $event
+ * Filter Response Event object.
+ */
public function onKernelResponse(FilterResponseEvent $event) {
$this->response = $event->getResponse();
- // execute necessary functions
+ // Execute necessary functions.
if ($this->config->get('seckit_xss.csp.checkbox')) {
- $this->_seckit_csp();
+ $this->seckitCsp();
}
if ($this->config->get('seckit_xss.x_xss.select')) {
- $this->_seckit_x_xss($this->config->get('seckit_xss.x_xss.select'));
+ $this->seckitXxss($this->config->get('seckit_xss.x_xss.select'));
}
if ($this->config->get('seckit_clickjacking.js_css_noscript')) {
- $this->_seckit_js_css_noscript();
+ $this->seckitJsCssNoscript();
}
if ($this->config->get('seckit_ssl.hsts')) {
- $this->_seckit_hsts();
+ $this->seckitHsts();
}
if ($this->config->get('seckit_various.from_origin')) {
- $this->_seckit_from_origin();
+ $this->seckitFromOrigin();
}
- $this->_seckit_x_content_type_options($this->config->get('seckit_xss.x_content_type.checkbox'));
+ $this->seckitXcontentTypeOptions($this->config->get('seckit_xss.x_content_type.checkbox'));
- // Always call this (regardless of the setting) since if it's disabled it may
- // be necessary to actively disable the Drupal core clickjacking defense.
- $this->_seckit_x_frame($this->config->get('seckit_clickjacking.x_frame'));
+ // Always call this (regardless of the setting) since if it's disabled it
+ // may be necessary to actively disable the core's clickjacking defense.
+ $this->seckitXframe($this->config->get('seckit_clickjacking.x_frame'));
}
/**
@@ -89,7 +107,7 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
* Implementation of Origin is based on specification draft available at
* http://tools.ietf.org/html/draft-abarth-origin-09
*/
- public function _seckit_origin($event) {
+ public function seckitOrigin($event) {
// Allow requests without an 'Origin' header, or with a 'null' origin.
$origin = isset($_SERVER['HTTP_ORIGIN']) ? $_SERVER['HTTP_ORIGIN'] : '';
if (!$origin || $origin === 'null') {
@@ -126,12 +144,11 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
// Clean the POST data first, as drupal_access_denied() may render a page
// with forms which check for their submissions.
$args = array(
- '@ip' => $this->request->getClientIp(),
+ '@ip' => $this->request->getClientIp(),
'@origin' => $origin,
);
$message = 'Possible CSRF attack was blocked. IP address: @ip, Origin: @origin.';
- $warning = t($message, $args);
\Drupal::logger('seckit')->warning($message, $args);
$event->setResponse(new Response(t('Access denied'), Response::HTTP_FORBIDDEN));
@@ -145,30 +162,30 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
*
* Based on specification available at http://www.w3.org/TR/CSP/
*/
- public function _seckit_csp() {
+ public function seckitCsp() {
// Get default/set options.
$csp_report_only = $this->config->get('seckit_xss.csp.policy-uri');
$csp_default_src = $this->config->get('seckit_xss.csp.default-src');
- $csp_script_src = $this->config->get('seckit_xss.csp.script-src');
- $csp_object_src = $this->config->get('seckit_xss.csp.object-src');
- $csp_img_src = $this->config->get('seckit_xss.csp.img-src');
- $csp_media_src = $this->config->get('seckit_xss.csp.media-src');
- $csp_style_src = $this->config->get('seckit_xss.csp.style-src');
- $csp_frame_src = $this->config->get('seckit_xss.csp.frame-src');
- $csp_child_src = $this->config->get('seckit_xss.csp.child-src');
- $csp_font_src = $this->config->get('seckit_xss.csp.font-src');
+ $csp_script_src = $this->config->get('seckit_xss.csp.script-src');
+ $csp_object_src = $this->config->get('seckit_xss.csp.object-src');
+ $csp_img_src = $this->config->get('seckit_xss.csp.img-src');
+ $csp_media_src = $this->config->get('seckit_xss.csp.media-src');
+ $csp_style_src = $this->config->get('seckit_xss.csp.style-src');
+ $csp_frame_src = $this->config->get('seckit_xss.csp.frame-src');
+ $csp_child_src = $this->config->get('seckit_xss.csp.child-src');
+ $csp_font_src = $this->config->get('seckit_xss.csp.font-src');
$csp_connect_src = $this->config->get('seckit_xss.csp.connect-src');
- $csp_report_uri = $this->config->get('seckit_xss.csp.report-uri');
- $csp_policy_uri = $this->config->get('seckit_xss.csp.policy-uri');
+ $csp_report_uri = $this->config->get('seckit_xss.csp.report-uri');
+ $csp_policy_uri = $this->config->get('seckit_xss.csp.policy-uri');
// Prepare directives.
$directives = array();
// If policy-uri is declared, no other directives are permitted.
- /*if ($csp_report_only) {
- $directives = "policy-uri " . base_path() . $csp_report_only;
- }*/
+ /* if ($csp_report_only) {
+ $directives = "policy-uri " . base_path() . $csp_report_only;
+ } */
// Otherwise prepare directives.
- // else {
+ // else {.
if ($csp_default_src) {
$directives[] = "default-src $csp_default_src";
}
@@ -205,19 +222,24 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
// Merge directives.
$directives = implode('; ', $directives);
// }
-
- // send HTTP response header if directives were prepared
+ // send HTTP response header if directives were prepared.
if ($directives) {
if ($csp_report_only) {
- // use report-only mode
- $this->response->headers->set('Content-Security-Policy-Report-Only', $directives); // official name
- $this->response->headers->set('X-Content-Security-Policy-Report-Only', $directives); // Firefox and IE10
- $this->response->headers->set('X-WebKit-CSP-Report-Only', $directives); // Chrome and Safari
+ // Use report-only mode.
+ // Official name.
+ $this->response->headers->set('Content-Security-Policy-Report-Only', $directives);
+ // Firefox and IE10.
+ $this->response->headers->set('X-Content-Security-Policy-Report-Only', $directives);
+ // Chrome and Safari.
+ $this->response->headers->set('X-WebKit-CSP-Report-Only', $directives);
}
else {
- $this->response->headers->set('Content-Security-Policy', $directives); // official name
- $this->response->headers->set('X-Content-Security-Policy', $directives); // Firefox and IE10
- $this->response->headers->set('X-WebKit-CSP', $directives); // Chrome and Safari
+ // Official name.
+ $this->response->headers->set('Content-Security-Policy', $directives);
+ // Firefox and IE10.
+ $this->response->headers->set('X-Content-Security-Policy', $directives);
+ // Chrome and Safari.
+ $this->response->headers->set('X-WebKit-CSP', $directives);
}
}
}
@@ -227,23 +249,26 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
*
* X-XSS-Protection controls IE8/Safari/Chrome internal XSS filter.
*/
- public function _seckit_x_xss($setting) {
+ public function seckitXxss($setting) {
switch ($setting) {
case SECKIT_X_XSS_0:
- $this->response->headers->set('X-XSS-Protection', '0'); // set X-XSS-Protection header to 0
+ // Set X-XSS-Protection header to 0.
+ $this->response->headers->set('X-XSS-Protection', '0');
break;
case SECKIT_X_XSS_1:
- $this->response->headers->set('X-XSS-Protection', '1'); // set X-XSS-Protection header to 1;
+ // Set X-XSS-Protection header to 1.
+ $this->response->headers->set('X-XSS-Protection', '1');
break;
case SECKIT_X_XSS_1_BLOCK:
- $this->response->headers->set('X-XSS-Protection', '1; mode=block'); // set X-XSS-Protection header to 1; mode=block
+ // Set X-XSS-Protection header to 1; mode=block.
+ $this->response->headers->set('X-XSS-Protection', '1; mode=block');
break;
-
case SECKIT_X_XSS_DISABLE:
- default: // do nothing
+ // Do nothing.
+ default:
break;
}
}
@@ -251,12 +276,11 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
/**
* Sends X-Content-Type-Options HTTP response header.
*/
- public function _seckit_x_content_type_options($enabled) {
+ public function seckitXcontentTypeOptions($enabled) {
// If we disabled this, remove the header set by core.
if (!$enabled) {
$this->response->headers->remove('X-Content-Type-Options');
}
-
}
/**
@@ -264,19 +288,21 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
*
* X-Frame-Options controls should browser show frames or not.
* More information can be found at initial article about it at
- * http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx
+ * http://blogs.msdn.com/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx.
*
- * Implementation of X-Frame-Options is based on specification draft availabe at
- * http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01
+ * Implementation of X-Frame-Options is based on specification draft availabe
+ * at http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01.
*/
- public function _seckit_x_frame($setting) {
+ public function seckitXframe($setting) {
switch ($setting) {
case SECKIT_X_FRAME_SAMEORIGIN:
- $this->response->headers->set('X-Frame-Options', 'SameOrigin'); // set X-Frame-Options to SameOrigin
+ // Set X-Frame-Options to SameOrigin.
+ $this->response->headers->set('X-Frame-Options', 'SameOrigin');
break;
case SECKIT_X_FRAME_DENY:
- $this->response->headers->set('X-Frame-Options', 'Deny'); // set X-Frame-Options to Deny
+ // Set X-Frame-Options to Deny.
+ $this->response->headers->set('X-Frame-Options', 'Deny');
break;
case SECKIT_X_FRAME_ALLOW_FROM:
@@ -297,26 +323,29 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
}
}
- static function getSubscribedEvents() {
+ /**
+ * {@inheritdoc}
+ */
+ public static function getSubscribedEvents() {
$events[KernelEvents::REQUEST][] = array('onKernelRequest', 100);
$events[KernelEvents::RESPONSE][] = array('onKernelResponse');
return $events;
}
-
/**
* Enables JavaScript + CSS + Noscript Clickjacking defense.
*
* Closes inline JavaScript and allows loading of any inline HTML elements.
* After, it starts new inline JavaScript to avoid breaking syntax.
- * We need it, because Drupal API doesn't allow to init HTML elements in desired sequence.
+ * We need it, because Drupal API doesn't allow to init HTML elements in
+ * desired sequence.
*/
- public function _seckit_js_css_noscript() {
- //@todo Consider batter solution?
+ public function seckitJsCssNoscript() {
+ // @todo Consider batter solution?
$content = $this->response->getContent();
$head_close_position = strpos($content, '');
if ($head_close_position) {
- $content = substr_replace($content, $this->_seckit_get_js_css_noscript_code(), $head_close_position, 0);
+ $content = substr_replace($content, $this->seckitGetJsCssNoscriptCode(), $head_close_position, 0);
$this->response->setContent($content);
}
}
@@ -325,12 +354,13 @@ class SecKitEventSubscriber implements EventSubscriberInterface {
* Gets JavaScript and CSS code.
*
* @return string
+ * Return the js and css code.
*/
- public function _seckit_get_js_css_noscript_code($noscript_message = NULL) {
+ public function seckitGetJsCssNoscriptCode($noscript_message = NULL) {
// Allows noscript automated testing.
$noscript_message = $noscript_message ?
- $noscript_message :
- $this->config->get('seckit_clickjacking.noscript_message');
+ $noscript_message :
+ $this->config->get('seckit_clickjacking.noscript_message');
$message = Xss::filter($noscript_message);
$path = base_path() . drupal_get_path('module', 'seckit');
@@ -357,8 +387,8 @@ EOT;
* Implementation of HSTS is based on the specification draft available at
* http://tools.ietf.org/html/draft-hodges-strict-transport-sec-02
*/
- public function _seckit_hsts() {
- // prepare HSTS header value
+ public function seckitHsts() {
+ // Prepare HSTS header value.
$header[] = sprintf("max-age=%d", $this->config->get('seckit_ssl.hsts_max_age'));
if ($this->config->get('seckit_ssl.hsts_subdomains')) {
$header[] = 'includeSubDomains';
@@ -373,15 +403,15 @@ EOT;
$this->response->headers->set('Strict-Transport-Security', $header);
}
-
/**
* Sends From-Origin HTTP response header.
*
* Implementation is based on specification draft
* available at http://www.w3.org/TR/from-origin.
*/
- public function _seckit_from_origin() {
+ public function seckitFromOrigin() {
$value = $this->config->get('seckit_various.from_origin_destination');
$this->response->headers->set('From-Origin', $value);
}
+
}
diff --git a/src/Form/SecKitSettingsForm.php b/src/Form/SecKitSettingsForm.php
index 137a4d9..79a6464 100644
--- a/src/Form/SecKitSettingsForm.php
+++ b/src/Form/SecKitSettingsForm.php
@@ -9,8 +9,9 @@ use Drupal\Core\Form\FormStateInterface;
* Implements a form to collect security check configuration.
*/
class SecKitSettingsForm extends ConfigFormBase {
+
/**
- * {@inheritdoc}.
+ * {@inheritdoc}
*/
public function getFormId() {
return 'seckit_settings_form';
@@ -24,7 +25,7 @@ class SecKitSettingsForm extends ConfigFormBase {
}
/**
- * {@inheritdoc}.
+ * {@inheritdoc}
*/
public function buildForm(array $form, FormStateInterface $form_state) {
$module_path = drupal_get_path('module', 'seckit');
@@ -32,7 +33,7 @@ class SecKitSettingsForm extends ConfigFormBase {
$config = \Drupal::config('seckit.settings');
- // main description
+ // Main description.
$args = array(
':browserscope' => 'http://www.browserscope.org/?category=security',
'@browserscope' => 'Browserscope',
@@ -41,7 +42,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#markup' => $this->t('This module provides your website with various options to mitigate risks of common web application vulnerabilities like Cross-site Scripting, Cross-site Request Forgery and Clickjacking. It also has some options to improve your SSL/TLS security and fixes Drupal 6 core Upload module issue leading to an easy exploitation of an old Internet Explorer MIME sniffer HTML injection vulnerability. Note that some security features are not supported by all browsers. You may find this out at @browserscope.', $args),
);
- // main fieldset for XSS
+ // Main fieldset for XSS.
$form['seckit_xss'] = array(
'#type' => 'details',
'#title' => $this->t('Cross-site Scripting'),
@@ -51,7 +52,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('Configure levels and various techniques of protection from cross-site scripting attacks'),
);
- // fieldset for Content Security Policy (CSP)
+ // Fieldset for Content Security Policy (CSP).
$args = array(
':wiki' => 'https://wiki.mozilla.org/Security/CSP',
'@wiki' => 'Mozilla Wiki',
@@ -65,7 +66,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#open' => !empty($config->get('seckit_xss.csp.checkbox')),
'#description' => $this->t('Content Security Policy is a policy framework that allows to specify trustworthy sources of content and to restrict its capabilities. You may read more about it at @wiki.', $args),
);
- // CSP enable/disable
+ // CSP enable/disable.
$form['seckit_xss']['csp']['checkbox'] = array(
'#type' => 'checkbox',
'#default_value' => $config->get('seckit_xss.csp.checkbox'),
@@ -73,7 +74,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#return_value' => 1,
'#description' => $this->t('Send Content-Security-Policy (official), X-Content-Security-Policy (supported by Mozilla Firefox and IE10) and X-WebKit-CSP (supported by Google Chrome and Safari) HTTP response headers with the list of Content Security Policy directives.'),
);
- // CSP report-only mode
+ // CSP report-only mode.
$form['seckit_xss']['csp']['report-only'] = array(
'#type' => 'checkbox',
'#default_value' => $config->get('seckit_xss.csp.report-only'),
@@ -81,23 +82,23 @@ class SecKitSettingsForm extends ConfigFormBase {
'#return_value' => 1,
'#description' => $this->t('Use Content Security Policy in report-only mode. In this case, violations of policies will only be reported, not blocked. Use this while configuring policies. Reports are logged.'),
);
- // CSP description
+ // CSP description.
$keywords = array(
"'none' - block content from any source",
"'self' - allow content only from your domain",
"'unsafe-inline' - allow specific inline content (note, that it is supported by a subset of directives)",
- "'unsafe-eval' - allow a set of string-to-code API which is restricted by default (supported by script-src directive)"
+ "'unsafe-eval' - allow a set of string-to-code API which is restricted by default (supported by script-src directive)",
);
$wildcards = array(
'* - load content from any source',
'*.example.com - load content from example.com and all its subdomains',
- 'example.com:* - load content from example.com via any port. Otherwise, it will use your website default port'
+ 'example.com:* - load content from example.com via any port. Otherwise, it will use your website default port',
);
$args = array(
- '@keywords' => $this->_getItemsList($keywords),
- '@wildcards' => $this->_getItemsList($wildcards),
+ '@keywords' => $this->getItemsList($keywords),
+ '@wildcards' => $this->getItemsList($wildcards),
':spec' => 'http://www.w3.org/TR/CSP/',
'@spec' => 'specification page',
);
@@ -107,122 +108,122 @@ class SecKitSettingsForm extends ConfigFormBase {
$form['seckit_xss']['csp']['description'] = array(
'#markup' => $description,
);
- // CSP default-src directive
+ // CSP default-src directive.
$form['seckit_xss']['csp']['default-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.default-src'),
'#title' => 'default-src',
'#description' => $this->t("Specify security policy for all types of content, which are not specified further (frame-ancestors excepted). Default is 'self'."),
);
- // CSP script-src directive
+ // CSP script-src directive.
$form['seckit_xss']['csp']['script-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.script-src'),
'#title' => 'script-src',
'#description' => $this->t('Specify trustworthy sources for <script> elements.'),
);
- // CSP object-src directive
+ // CSP object-src directive.
$form['seckit_xss']['csp']['object-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.object-src'),
'#title' => 'object-src',
'#description' => $this->t('Specify trustworthy sources for <object>, <embed> and <applet> elements.'),
);
- // CSP style-src directive
+ // CSP style-src directive.
$form['seckit_xss']['csp']['style-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.style-src'),
'#title' => 'style-src',
'#description' => $this->t('Specify trustworthy sources for stylesheets. Note, that inline stylesheets and style attributes of HTML elements are allowed.'),
);
- // CSP img-src directive
+ // CSP img-src directive.
$form['seckit_xss']['csp']['img-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.img-src'),
'#title' => 'img-src',
'#description' => $this->t('Specify trustworthy sources for <img> elements.'),
);
- // CSP media-src directive
+ // CSP media-src directive.
$form['seckit_xss']['csp']['media-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.media-src'),
'#title' => 'media-src',
'#description' => $this->t('Specify trustworthy sources for <audio> and <video> elements.'),
);
- // CSP frame-src directive
+ // CSP frame-src directive.
$form['seckit_xss']['csp']['frame-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.frame-src'),
'#title' => 'frame-src',
'#description' => $this->t('Specify trustworthy sources for <iframe> and <frame> elements. This directive is deprecated and will be replaced by child-src. It is recommended to use the both the frame-src and child-src directives until all browsers you support recognize the child-src directive.'),
);
- // CSP child-src directive
+ // CSP child-src directive.
$form['seckit_xss']['csp']['child-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.child-src'),
'#title' => 'child-src',
'#description' => $this->t('Specify trustworthy sources for <iframe> and <frame> elements as well as for loading Workers.'),
);
- // CSP font-src directive
+ // CSP font-src directive.
$form['seckit_xss']['csp']['font-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.font-src'),
'#title' => 'font-src',
'#description' => $this->t('Specify trustworthy sources for @font-src CSS loads.'),
);
- // CSP connect-src directive
+ // CSP connect-src directive.
$form['seckit_xss']['csp']['connect-src'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.connect-src'),
'#title' => 'connect-src',
'#description' => $this->t('Specify trustworthy sources for XMLHttpRequest, WebSocket and EventSource connections.'),
);
$report_default = !empty($config->get('seckit_xss.report-uri')) ? $config->get('seckit_xss.report-uri') : SECKIT_CSP_REPORT_URL;
- // CSP report-uri directive
+ // CSP report-uri directive.
$form['seckit_xss']['csp']['report-uri'] = array(
'#type' => 'textfield',
'#maxlength' => 1024,
'#default_value' => $report_default,
'#title' => 'report-uri',
- '#description' => $this->t('Specify a URL (relative to the Drupal root) to which user-agents will report CSP violations. Use the default value, unless you have set up an alternative handler for these reports. Defaults to ' . SECKIT_CSP_REPORT_URL . ' which logs the report data.'),
+ '#description' => $this->t('Specify a URL (relative to the Drupal root) to which user-agents will report CSP violations. Use the default value, unless you have set up an alternative handler for these reports. Defaults to @report-url which logs the report data.', array('@report-url' => SECKIT_CSP_REPORT_URL)),
);
- // CSP policy-uri directive
+ // CSP policy-uri directive.
$form['seckit_xss']['csp']['policy-uri'] = array(
'#type' => 'textfield',
- '#maxlength'=> 1024,
+ '#maxlength' => 1024,
'#default_value' => $config->get('seckit_xss.csp.policy-uri'),
'#title' => 'policy-uri',
'#description' => $this->t("Specify a URL (relative to the Drupal root) for a file containing the (entire) policy. All other directives will be omitted by Security Kit, as policy-uri may only be defined in the absence of other policy definitions in the X-Content-Security-Policy HTTP header. The MIME type for this URI must be text/x-content-security-policy, otherwise user-agents will enforce the policy allow 'none' instead."),
);
- // fieldset for X-XSS-Protection
+ // Fieldset for X-XSS-Protection.
$form['seckit_xss']['x_xss'] = array(
'#type' => 'details',
'#title' => $this->t('X-XSS-Protection header'),
'#collapsible' => TRUE,
'#tree' => TRUE,
- '#open' => $config->get('seckit_xss.x_xss.select') != SECKIT_X_XSS_DISABLE,
+ '#open' => $config->get('seckit_xss.x_xss.select') != SECKIT_X_XSS_DISABLE,
'#description' => $this->t('X-XSS-Protection HTTP response header controls Microsoft Internet Explorer, Google Chrome and Apple Safari internal XSS filters.'),
);
- // options for X-XSS-Protection
+ // Options for X-XSS-Protection.
$x_xss_protection_options = array(
SECKIT_X_XSS_DISABLE => $config->get('seckit_xss.x_xss.seckit_x_xss_option_disable', $this->t('Disabled')),
SECKIT_X_XSS_0 => $config->get('seckit_xss.x_xss.seckit_x_xss_option_0', '0'),
SECKIT_X_XSS_1 => $config->get('seckit_xss.x_xss.seckit_x_xss_option_1', '1;'),
SECKIT_X_XSS_1_BLOCK => $config->get('seckit_xss.x_xss.seckit_x_xss_option_1_block', '1; mode=block'),
);
- // configure X-XSS-Protection
+ // Configure X-XSS-Protection.
$args = array(
':link' => 'http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities',
'@link' => 'IE\'s XSS filter security flaws in past',
@@ -231,11 +232,11 @@ class SecKitSettingsForm extends ConfigFormBase {
array('#markup' => $this->t('Disabled - XSS filter will work in default mode. Enabled by default')),
array('#markup' => $this->t('0 - XSS filter will be disabled for a website. It may be useful because of @link', $args)),
array('#markup' => $this->t('1 - XSS filter will be left enabled, and will modify dangerous content')),
- array('#markup' => $this->t('1; mode=block - XSS filter will be left enabled, but it will block entire page instead of modifying dangerous content'))
+ array('#markup' => $this->t('1; mode=block - XSS filter will be left enabled, but it will block entire page instead of modifying dangerous content')),
);
$args = array(
- '@values' => $this->_getItemsList($items),
+ '@values' => $this->getItemsList($items),
);
$form['seckit_xss']['x_xss']['select'] = array(
@@ -246,7 +247,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('@values', $args),
);
- // fieldset for X-Content-Type-Options
+ // Fieldset for X-Content-Type-Options.
$args = array(
':link' => 'http://blogs.msdn.com/b/ie/archive/2010/10/26/mime-handling-changes-in-internet-explorer.aspx',
'@link' => 'MSDN article',
@@ -262,7 +263,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#tree' => TRUE,
'#description' => $this->t('X-Content-Type-Options HTTP response header prevents browser from upsniffing content and serving files with inappropriate MIME type. More information is available at @link.', $args),
);
- // enable/disable X-Content-Type-Options
+ // Enable/disable X-Content-Type-Options.
$form['seckit_xss']['x_content_type']['checkbox'] = array(
'#type' => 'checkbox',
'#title' => $this->t('Send HTTP response header'),
@@ -270,7 +271,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('Enable X-Content-Type-Options: nosniff HTTP response header. It is HIGHLY recommended that this value always be be set to "ON" to mitigate security risks, please read the link above.'),
);
- // main fieldset for CSRF
+ // Main fieldset for CSRF.
$form['seckit_csrf'] = array(
'#type' => 'details',
'#title' => $this->t('Cross-site Request Forgery'),
@@ -280,14 +281,14 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('Configure levels and various techniques of protection from cross-site request forgery attacks'),
);
- // enable/disable Origin
+ // Enable/disable Origin.
$form['seckit_csrf']['origin'] = array(
'#type' => 'checkbox',
'#title' => $this->t('HTTP Origin'),
'#default_value' => $config->get('seckit_csrf.origin'),
'#description' => $this->t('Check Origin HTTP request header.'),
);
- // Origin whitelist
+ // Origin whitelist.
$form['seckit_csrf']['origin_whitelist'] = array(
'#type' => 'textfield',
'#title' => $this->t('Allow requests from'),
@@ -297,7 +298,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('Comma separated list of trustworthy sources. Do not enter your website URL - it is automatically added. Syntax of the source is: [protocol] :// [host] : [port] . E.g, http://example.com, https://example.com, https://www.example.com, http://www.example.com:8080'),
);
- // main fieldset for Clickjacking
+ // Main fieldset for Clickjacking.
$form['seckit_clickjacking'] = array(
'#type' => 'details',
'#title' => $this->t('Clickjacking'),
@@ -316,17 +317,23 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('Configure the X-Frame-Options HTTP header'),
);
- // options for X-Frame-Options
+ // Options for X-Frame-Options.
$x_frame_options = array(
SECKIT_X_FRAME_DISABLE => $this->t('Disabled'),
SECKIT_X_FRAME_SAMEORIGIN => 'SameOrigin',
SECKIT_X_FRAME_DENY => 'Deny',
SECKIT_X_FRAME_ALLOW_FROM => 'Allow-From',
);
- // configure X-Frame-Options
- $items = array('Disabled - turn off X-Frame-Options', 'SameOrigin - browser allows all the attempts of framing website within its domain. Enabled by default', 'Deny - browser rejects any attempt of framing website', 'Allow-From - browser allows framing website only from specified source');
+ // Configure X-Frame-Options.
+ $items = array(
+ 'Disabled - turn off X-Frame-Options',
+ 'SameOrigin - browser allows all the attempts of framing website within its domain. Enabled by default',
+ 'Deny - browser rejects any attempt of framing website',
+ 'Allow-From - browser allows framing website only from specified source',
+ );
+
$args = array(
- '@values' => $this->_getItemsList($items),
+ '@values' => $this->getItemsList($items),
':msdn' => 'http://blogs.msdn.com/b/ie/archive/2009/01/27/ie8-security-part-vii-clickjacking-defenses.aspx',
'@msdn' => 'MSDN article',
':spec' => 'http://tools.ietf.org/html/draft-ietf-websec-x-frame-options-01',
@@ -367,7 +374,7 @@ class SecKitSettingsForm extends ConfigFormBase {
':noscript' => 'https://noscript.net/',
'@noscript' => 'NoScript',
);
- // fieldset for JavaScript settings. non-#tree.
+ // Fieldset for JavaScript settings. non-#tree.
$form['seckit_clickjacking']['javascript'] = array(
'#type' => 'details',
'#title' => $this->t('JavaScript-based protection'),
@@ -377,7 +384,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('Warning: With this enabled, the site will not work at all for users who have JavaScript disabled (e.g. users running the popular @noscript browser extension, if they haven\'t whitelisted your site).', $args),
);
- // enable/disable JS + CSS + Noscript protection
+ // Enable/disable JS + CSS + Noscript protection.
$args = array(
':eduardovela' => 'http://sirdarckcat.blogspot.com/',
'@eduardovela' => 'Eduardo Vela',
@@ -399,7 +406,7 @@ class SecKitSettingsForm extends ConfigFormBase {
),
);
- // custom text for "disabled JavaScript" message
+ // Custom text for "disabled JavaScript" message.
$form['seckit_clickjacking']['javascript']['noscript_message'] = array(
'#type' => 'textfield',
'#title' => $this->t('Custom text for disabled JavaScript message'),
@@ -416,7 +423,7 @@ class SecKitSettingsForm extends ConfigFormBase {
),
);
- // main fieldset for SSL/TLS
+ // Main fieldset for SSL/TLS.
$form['seckit_ssl'] = array(
'#type' => 'details',
'#title' => $this->t('SSL/TLS'),
@@ -426,7 +433,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('Configure various techniques to improve security of SSL/TLS'),
);
- // enable/disable HTTP Strict Transport Security (HSTS)
+ // Enable/disable HTTP Strict Transport Security (HSTS).
$args = array(
':wiki' => 'http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security',
'@wiki' => 'Wikipedia',
@@ -438,7 +445,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('Enable Strict-Transport-Security HTTP response header. HTTP Strict Transport Security (HSTS) header is proposed to prevent eavesdropping and man-in-the-middle attacks like SSLStrip, when a single non-HTTPS request is enough for credential theft or hijacking. It forces browser to connect to the server in HTTPS-mode only and automatically convert HTTP links into secure before sending request. @wiki has more information about HSTS', $args),
'#default_value' => $config->get('seckit_ssl.hsts'),
);
- // HSTS max-age directive
+ // HSTS max-age directive.
$form['seckit_ssl']['hsts_max_age'] = array(
'#type' => 'textfield',
'#title' => $this->t('Max-Age'),
@@ -450,7 +457,7 @@ class SecKitSettingsForm extends ConfigFormBase {
),
),
);
- // HSTS includeSubDomains directive
+ // HSTS includeSubDomains directive.
$form['seckit_ssl']['hsts_subdomains'] = array(
'#type' => 'checkbox',
'#title' => $this->t('Include Subdomains'),
@@ -458,7 +465,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#default_value' => $config->get('seckit_ssl.hsts_subdomains'),
);
- // HSTS preload directive
+ // HSTS preload directive.
$args = array(
':hsts_preload_list' => 'https://hstspreload.appspot.com/',
'@hsts_preload_list' => 'HSTS Preload list',
@@ -471,7 +478,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#default_value' => $config->get('seckit_ssl.hsts_preload'),
);
- // main fieldset for various
+ // Main fieldset for various.
$form['seckit_various'] = array(
'#type' => 'details',
'#title' => $this->t('Miscellaneous'),
@@ -481,7 +488,7 @@ class SecKitSettingsForm extends ConfigFormBase {
'#description' => $this->t('Configure miscellaneous unsorted security enhancements'),
);
- // enable/disable From-Origin
+ // Enable/disable From-Origin.
$args = array(
':spec' => 'http://www.w3.org/TR/from-origin/',
'@spec' => 'specification',
@@ -493,13 +500,13 @@ class SecKitSettingsForm extends ConfigFormBase {
'#default_value' => $config->get('seckit_various.from_origin'),
'#description' => $this->t('Enable From-Origin HTTP response header. This forces user-agent to retrieve embedded content from your site only to listed destination. More information is available at @spec page.', $args),
);
- // From-Origin destination
+ // From-Origin destination.
$items = array(
'same - allow loading of content only from your site. Default value.',
- 'serialized origin - address of trustworthy destination. For example, http://example.com, https://example.com, https://www.example.com, http://www.example.com:8080'
+ 'serialized origin - address of trustworthy destination. For example, http://example.com, https://example.com, https://www.example.com, http://www.example.com:8080',
);
$args = array(
- '@items' => $this->_getItemsList($items)
+ '@items' => $this->getItemsList($items),
);
$form['seckit_various']['from_origin_destination'] = array(
@@ -529,21 +536,21 @@ class SecKitSettingsForm extends ConfigFormBase {
* {@inheritdoc}
*/
public function validateForm(array &$form, FormStateInterface $form_state) {
- // if From-Origin is enabled, it should be explicitly set
+ // If From-Origin is enabled, it should be explicitly set.
$from_origin_enable = $form_state->getValue(array('seckit_various', 'from_origin'));
$from_origin_destination = $form_state->getValue(array('seckit_various', 'from_origin_destination'));
if ($from_origin_enable && !$from_origin_destination) {
$form_state->setErrorByName('seckit_various][from_origin_destination', $this->t('You have to set up trustworthy destination for From-Origin HTTP response header. Default is same.'));
}
- // if X-Frame-Options is set to Allow-From, it should be explicitly set
+ // If X-Frame-Options is set to Allow-From, it should be explicitly set.
$x_frame_value = $form_state->getValue(array('seckit_clickjacking', 'x_frame'));
if ($x_frame_value == SECKIT_X_FRAME_ALLOW_FROM) {
$x_frame_allow_from = $form_state->getValue(array('seckit_clickjacking', 'x_frame_allow_from'));
- if (!$this->_seckit_explode_value($x_frame_allow_from)) {
+ if (!$this->seckitExplodeValue($x_frame_allow_from)) {
$form_state->setErrorByName('seckit_clickjacking][x_frame_allow_from', $this->t('You must specify a trusted Origin for the Allow-From value of the X-Frame-Options HTTP response header.'));
}
}
- // if HTTP Strict Transport Security is enabled, max-age must be specified.
+ // If HTTP Strict Transport Security is enabled, max-age must be specified.
// HSTS max-age should only contain digits.
$hsts = $form_state->getValue(array('seckit_ssl', 'hsts'));
$hsts_max_age = $form_state->getValue(array('seckit_ssl', 'hsts_max_age'));
@@ -553,8 +560,8 @@ class SecKitSettingsForm extends ConfigFormBase {
if (preg_match('/[^0-9]/', $hsts_max_age)) {
$form_state->setErrorByName('seckit_ssl][hsts_max_age', $this->t('Only digits are allowed in HTTP Strict Transport Security Max-Age field.'));
}
- // if JS + CSS + Noscript Clickjacking protection is enabled,
- // custom text for disabled JS must be specified
+ // If JS + CSS + Noscript Clickjacking protection is enabled,
+ // custom text for disabled JS must be specified.
$js_css_noscript_enable = $form_state->getValue(array('seckit_clickjacking', 'js_css_noscript'));
$noscript_message = $form_state->getValue(array('seckit_clickjacking', 'noscript_message'));
if ($js_css_noscript_enable && !$noscript_message) {
@@ -594,7 +601,7 @@ class SecKitSettingsForm extends ConfigFormBase {
/**
* Build a list from given items.
*/
- public function _getItemsList($items) {
+ public function getItemsList($items) {
$list = array(
'#theme' => 'item_list',
'#items' => $items,
@@ -607,17 +614,20 @@ class SecKitSettingsForm extends ConfigFormBase {
*/
protected function buildAttributeList(
array &$list = [],
- array $rawAttributes = [],
- $currentName = '')
- {
+ array $rawAttributes = [],
+ $currentName = '') {
foreach ($rawAttributes as $key => $rawAttribute) {
- $name = $currentName ? $currentName . '.' . $key:$key;
- if (in_array($name,['op','form_id','form_token','form_build_id','submit'])){
+ $name = $currentName ? $currentName . '.' . $key : $key;
+ if (in_array(
+ $name,
+ ['op', 'form_id', 'form_token', 'form_build_id', 'submit']
+ )) {
continue;
}
if (is_array($rawAttribute)) {
$this->buildAttributeList($list, $rawAttribute, $name);
- } else {
+ }
+ else {
$list[$name] = $rawAttribute;
}
}
@@ -625,10 +635,12 @@ class SecKitSettingsForm extends ConfigFormBase {
/**
* Converts a multi-line configuration option to an array.
+ *
* Sanitises by trimming whitespace, and filtering empty options.
*/
- protected function _seckit_explode_value($string) {
+ protected function seckitExplodeValue($string) {
$values = explode("\n", $string);
return array_values(array_filter(array_map('trim', $values)));
}
+
}
diff --git a/src/Tests/SecKitCSPCaseTest.php b/src/Tests/SecKitCSPCaseTest.php
index d934cf4..dc532e8 100644
--- a/src/Tests/SecKitCSPCaseTest.php
+++ b/src/Tests/SecKitCSPCaseTest.php
@@ -1,13 +1,8 @@
getRouteByName('seckit.report');
// Need to remove trailing slash so it is not escapted in string.
$path = $route->getPath();
- $this->report_path = ltrim($path, '/');
+ $this->reportPath = ltrim($path, '/');
}
/**
* Tests Content Security Policy with all enabled directives.
*/
- public function testCSPHasAllDirectives() {
+ public function testCspHasAllDirectives() {
$form = array(
- 'seckit_xss[csp][checkbox]' => TRUE,
+ 'seckit_xss[csp][checkbox]' => TRUE,
'seckit_xss[csp][default-src]' => '*',
- 'seckit_xss[csp][script-src]' => '*',
- 'seckit_xss[csp][object-src]' => '*',
- 'seckit_xss[csp][style-src]' => '*',
- 'seckit_xss[csp][img-src]' => '*',
- 'seckit_xss[csp][media-src]' => '*',
- 'seckit_xss[csp][frame-src]' => '*',
- 'seckit_xss[csp][child-src]' => '*',
- 'seckit_xss[csp][font-src]' => '*',
+ 'seckit_xss[csp][script-src]' => '*',
+ 'seckit_xss[csp][object-src]' => '*',
+ 'seckit_xss[csp][style-src]' => '*',
+ 'seckit_xss[csp][img-src]' => '*',
+ 'seckit_xss[csp][media-src]' => '*',
+ 'seckit_xss[csp][frame-src]' => '*',
+ 'seckit_xss[csp][child-src]' => '*',
+ 'seckit_xss[csp][font-src]' => '*',
'seckit_xss[csp][connect-src]' => '*',
- 'seckit_xss[csp][report-uri]' => $this->report_path,
+ 'seckit_xss[csp][report-uri]' => $this->reportPath,
);
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; child-src *; font-src *; connect-src *; report-uri ' . base_path() . $this->report_path;
- $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'),
- t('Content-Security-Policy has all the directves (Official).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'),
- t('X-Content-Security-Policy has all the directves (Mozilla and IE10).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'),
- t('X-WebKit-CSP has all the directves (Chrome and Safari).'));
+ $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; child-src *; font-src *; connect-src *; report-uri ' . base_path() . $this->reportPath;
+ $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'), t('Content-Security-Policy has all the directves (Official).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'), t('X-Content-Security-Policy has all the directves (Mozilla and IE10).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'), t('X-WebKit-CSP has all the directves (Chrome and Safari).'));
}
/**
* Tests Content Security Policy with policy-uri directive.
+ *
* In this case, only policy-uri directive should be present.
- *//*
+ */
+ /*
public function testCSPPolicyUriDirectiveOnly() {
- $form = array(
- 'seckit_xss[csp][checkbox]' => TRUE,
- 'seckit_xss[csp][default-src]' => '*',
- 'seckit_xss[csp][script-src]' => '*',
- 'seckit_xss[csp][object-src]' => '*',
- 'seckit_xss[csp][style-src]' => '*',
- 'seckit_xss[csp][img-src]' => '*',
- 'seckit_xss[csp][media-src]' => '*',
- 'seckit_xss[csp][frame-src]' => '*',
- 'seckit_xss[csp][child-src]' => '*',
- 'seckit_xss[csp][font-src]' => '*',
- 'seckit_xss[csp][connect-src]' => '*',
- 'seckit_xss[csp][report-uri]' => SECKIT_CSP_REPORT_URL,
- 'seckit_xss[csp][policy-uri]' => 'http://mysite.com/csp.xml',
- );
- $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $expected = 'policy-uri http://mysite.com/csp.xml';
- $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'),
- t('Content-Security-Policy has only policy-uri (Official).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'),
- t('X-Content-Security-Policy has only policy-uri (Mozilla and IE10).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'),
- t('X-WebKit-CSP has only policy-uri(Chrome and Safari).'));
+ $form = array(
+ 'seckit_xss[csp][checkbox]' => TRUE,
+ 'seckit_xss[csp][default-src]' => '*',
+ 'seckit_xss[csp][script-src]' => '*',
+ 'seckit_xss[csp][object-src]' => '*',
+ 'seckit_xss[csp][style-src]' => '*',
+ 'seckit_xss[csp][img-src]' => '*',
+ 'seckit_xss[csp][media-src]' => '*',
+ 'seckit_xss[csp][frame-src]' => '*',
+ 'seckit_xss[csp][child-src]' => '*',
+ 'seckit_xss[csp][font-src]' => '*',
+ 'seckit_xss[csp][connect-src]' => '*',
+ 'seckit_xss[csp][report-uri]' => SECKIT_CSP_REPORT_URL,
+ 'seckit_xss[csp][policy-uri]' => 'http://mysite.com/csp.xml',
+ );
+ $this->drupalPostForm('admin/config/system/seckit',
+ $form, t('Save configuration'));
+ $expected = 'policy-uri http://mysite.com/csp.xml';
+ $this->assertEqual($expected,
+ $this->drupalGetHeader('Content-Security-Policy'),
+ t('Content-Security-Policy has only policy-uri (Official).'));
+ $this->assertEqual($expected,
+ $this->drupalGetHeader('X-Content-Security-Policy'),
+ t('X-Content-Security-Policy has only policy-uri (Mozilla and IE10).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'),
+ t('X-WebKit-CSP has only policy-uri(Chrome and Safari).'));
}
-*/
+ */
+
/**
* Tests Content Security Policy with all directives empty.
+ *
* In this case, we should revert back to default values.
*/
- public function testCSPAllDirectivesEmpty() {
+ public function testCspAllDirectivesEmpty() {
$form = array(
- 'seckit_xss[csp][checkbox]' => TRUE,
+ 'seckit_xss[csp][checkbox]' => TRUE,
'seckit_xss[csp][default-src]' => 'self',
- 'seckit_xss[csp][script-src]' => '',
- 'seckit_xss[csp][object-src]' => '',
- 'seckit_xss[csp][img-src]' => '',
- 'seckit_xss[csp][media-src]' => '',
- 'seckit_xss[csp][style-src]' => '',
- 'seckit_xss[csp][frame-src]' => '',
- 'seckit_xss[csp][child-src]' => '',
- 'seckit_xss[csp][font-src]' => '',
+ 'seckit_xss[csp][script-src]' => '',
+ 'seckit_xss[csp][object-src]' => '',
+ 'seckit_xss[csp][img-src]' => '',
+ 'seckit_xss[csp][media-src]' => '',
+ 'seckit_xss[csp][style-src]' => '',
+ 'seckit_xss[csp][frame-src]' => '',
+ 'seckit_xss[csp][child-src]' => '',
+ 'seckit_xss[csp][font-src]' => '',
'seckit_xss[csp][connect-src]' => '',
- 'seckit_xss[csp][report-uri]' => $this->report_path,
- 'seckit_xss[csp][policy-uri]' => '',
+ 'seckit_xss[csp][report-uri]' => $this->reportPath,
+ 'seckit_xss[csp][policy-uri]' => '',
);
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $expected = "default-src self; report-uri " . base_path() . $this->report_path;
- $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'),
- t('Content-Security-Policy has default directive (Official).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'),
- t('X-Content-Security-Policy has default directive (Mozilla and IE10).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'),
- t('X-WebKit-CSP has default directive (Chrome and Safari).'));
+ $expected = "default-src self; report-uri " . base_path() . $this->reportPath;
+ $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'), t('Content-Security-Policy has default directive (Official).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'), t('X-Content-Security-Policy has default directive (Mozilla and IE10).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'), t('X-WebKit-CSP has default directive (Chrome and Safari).'));
}
}
diff --git a/src/Tests/SecKitTestCaseTest.php b/src/Tests/SecKitTestCaseTest.php
index e501393..cd93151 100644
--- a/src/Tests/SecKitTestCaseTest.php
+++ b/src/Tests/SecKitTestCaseTest.php
@@ -1,13 +1,8 @@
getRouteByName('seckit.report');
// Need to remove trailing slash so it is not escapted in string.
$path = $route->getPath();
- $this->report_path = ltrim($path, '/');
-
+ $this->reportPath = ltrim($path, '/');
}
/**
* Tests disabled Content Security Policy.
*/
- public function testDisabledCSP() {
+ public function testDisabledCsp() {
$form['seckit_xss[csp][checkbox]'] = FALSE;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertFalse($this->drupalGetHeader('Content-Security-Policy'),
- t('Content Security Policy is disabled (Official).'));
- $this->assertFalse($this->drupalGetHeader('X-Content-Security-Policy'),
- t('Content Security Policy is disabled (Mozilla and IE10).'));
- $this->assertFalse($this->drupalGetHeader('X-WebKit-CSP'),
- t('Content Security Policy is disabled (Chrome and Safari).'));
+ $this->assertFalse($this->drupalGetHeader('Content-Security-Policy'), t('Content Security Policy is disabled (Official).'));
+ $this->assertFalse($this->drupalGetHeader('X-Content-Security-Policy'), t('Content Security Policy is disabled (Mozilla and IE10).'));
+ $this->assertFalse($this->drupalGetHeader('X-WebKit-CSP'), t('Content Security Policy is disabled (Chrome and Safari).'));
}
/**
* Tests Content Security Policy with all enabled directives.
*/
- public function testCSPHasAllDirectives() {
+ public function testCspHasAllDirectives() {
$form = array(
'seckit_xss[csp][checkbox]' => TRUE,
'seckit_xss[csp][default-src]' => '*',
@@ -89,53 +89,56 @@ class SecKitTestCaseTest extends WebTestBase {
'seckit_xss[csp][child-src]' => '*',
'seckit_xss[csp][font-src]' => '*',
'seckit_xss[csp][connect-src]' => '*',
- 'seckit_xss[csp][report-uri]' => $this->report_path,
+ 'seckit_xss[csp][report-uri]' => $this->reportPath,
);
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; child-src *; font-src *; connect-src *; report-uri ' . base_path() . $this->report_path;
- $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'),
- t('Content-Security-Policy has all the directives (Official).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'),
- t('X-Content-Security-Policy has all the directives (Mozilla and IE10).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'),
- t('X-WebKit-CSP has all the directives (Chrome and Safari).'));
+ $expected = 'default-src *; script-src *; object-src *; style-src *; img-src *; media-src *; frame-src *; child-src *; font-src *; connect-src *; report-uri ' . base_path() . $this->reportPath;
+ $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'), t('Content-Security-Policy has all the directives (Official).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'), t('X-Content-Security-Policy has all the directives (Mozilla and IE10).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'), t('X-WebKit-CSP has all the directives (Chrome and Safari).'));
}
/**
* Tests Content Security Policy with policy-uri directive.
+ *
* In this case, only policy-uri directive should be present.
- *//*
+ */
+ /*
public function testCSPPolicyUriDirectiveOnly() {
- $form = array(
- 'seckit_xss[csp][checkbox]' => TRUE,
- 'seckit_xss[csp][default-src]' => '*',
- 'seckit_xss[csp][script-src]' => '*',
- 'seckit_xss[csp][object-src]' => '*',
- 'seckit_xss[csp][style-src]' => '*',
- 'seckit_xss[csp][img-src]' => '*',
- 'seckit_xss[csp][media-src]' => '*',
- 'seckit_xss[csp][frame-src]' => '*',
- 'seckit_xss[csp][child-src]' => '*',
- 'seckit_xss[csp][font-src]' => '*',
- 'seckit_xss[csp][connect-src]' => '*',
- 'seckit_xss[csp][report-uri]' => SECKIT_CSP_REPORT_URL,
- 'seckit_xss[csp][policy-uri]' => 'http://mysite.com/csp.xml',
- );
- $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $expected = 'policy-uri http://mysite.com/csp.xml';
- $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'),
- t('Content-Security-Policy has only policy-uri (Official).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'),
- t('X-Content-Security-Policy has only policy-uri (Mozilla and IE10).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'),
- t('X-WebKit-CSP has only policy-uri(Chrome and Safari).'));
- }*/
+ $form = array(
+ 'seckit_xss[csp][checkbox]' => TRUE,
+ 'seckit_xss[csp][default-src]' => '*',
+ 'seckit_xss[csp][script-src]' => '*',
+ 'seckit_xss[csp][object-src]' => '*',
+ 'seckit_xss[csp][style-src]' => '*',
+ 'seckit_xss[csp][img-src]' => '*',
+ 'seckit_xss[csp][media-src]' => '*',
+ 'seckit_xss[csp][frame-src]' => '*',
+ 'seckit_xss[csp][child-src]' => '*',
+ 'seckit_xss[csp][font-src]' => '*',
+ 'seckit_xss[csp][connect-src]' => '*',
+ 'seckit_xss[csp][report-uri]' => SECKIT_CSP_REPORT_URL,
+ 'seckit_xss[csp][policy-uri]' => 'http://mysite.com/csp.xml',
+ );
+ $this->drupalPostForm('admin/config/system/seckit', $form,
+ t('Save configuration'));
+ $expected = 'policy-uri http://mysite.com/csp.xml';
+ $this->assertEqual($expected,
+ $this->drupalGetHeader('Content-Security-Policy'),
+ t('Content-Security-Policy has only policy-uri (Official).'));
+ $this->assertEqual($expected,
+ $this->drupalGetHeader('X-Content-Security-Policy'),
+ t('X-Content-Security-Policy has only policy-uri (Mozilla and IE10).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'),
+ t('X-WebKit-CSP has only policy-uri(Chrome and Safari).'));
+ } */
/**
* Tests Content Security Policy with all directives empty.
+ *
* In this case, we should revert back to default values.
*/
- public function testCSPAllDirectivesEmpty() {
+ public function testCspAllDirectivesEmpty() {
$form = array(
'seckit_xss[csp][checkbox]' => TRUE,
'seckit_xss[csp][default-src]' => 'self',
@@ -148,92 +151,86 @@ class SecKitTestCaseTest extends WebTestBase {
'seckit_xss[csp][child-src]' => '',
'seckit_xss[csp][font-src]' => '',
'seckit_xss[csp][connect-src]' => '',
- 'seckit_xss[csp][report-uri]' => $this->report_path,
+ 'seckit_xss[csp][report-uri]' => $this->reportPath,
'seckit_xss[csp][policy-uri]' => '',
);
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $expected = "default-src self; report-uri " . base_path() . $this->report_path;
- $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'),
- t('Content-Security-Policy has default directive (Official).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'),
- t('X-Content-Security-Policy has default directive (Mozilla and IE10).'));
- $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'),
- t('X-WebKit-CSP has default directive (Chrome and Safari).'));
+ $expected = "default-src self; report-uri " . base_path() . $this->reportPath;
+ $this->assertEqual($expected, $this->drupalGetHeader('Content-Security-Policy'), t('Content-Security-Policy has default directive (Official).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-Content-Security-Policy'), t('X-Content-Security-Policy has default directive (Mozilla and IE10).'));
+ $this->assertEqual($expected, $this->drupalGetHeader('X-WebKit-CSP'), t('X-WebKit-CSP has default directive (Chrome and Safari).'));
}
/**
* Tests Content Security Policy in report-only mode.
- *//*
+ */
+ /*
public function testReportOnlyCSP() {
- $form['seckit_xss[csp][checkbox]'] = TRUE;
- $form['seckit_xss[csp][report-only]'] = TRUE;
- $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertTrue($this->drupalGetHeader('Content-Security-Policy-Report-Only'),
- t('Content Security Policy is in report-only mode (Official).'));
- $this->assertTrue($this->drupalGetHeader('X-Content-Security-Policy-Report-Only'),
- t('Content Security Policy is in report-only mode (Mozilla and IE10).'));
- $this->assertTrue($this->drupalGetHeader('X-WebKit-CSP-Report-Only'),
- t('Content Security Policy is in report-only mode (Chrome and Safari).'));
+ $form['seckit_xss[csp][checkbox]'] = TRUE;
+ $form['seckit_xss[csp][report-only]'] = TRUE;
+ $this->drupalPostForm('admin/config/system/seckit', $form,
+ t('Save configuration'));
+ $this->assertTrue($this->drupalGetHeader('Content-Security-Policy-Report-Only'),
+ t('Content Security Policy is in report-only mode (Official).'));
+ $this->assertTrue($this->drupalGetHeader('X-Content-Security-Policy-Report-Only'),
+ t('Content Security Policy is in report-only mode (Mozilla and IE10).'));
+ $this->assertTrue($this->drupalGetHeader('X-WebKit-CSP-Report-Only'),
+ t('Content Security Policy is in report-only mode (Chrome and Safari).'));
}
-*/
+ */
+
/**
* Tests disabled X-XSS-Protection HTTP response header.
*/
- public function testXXSSProtectionIsDisabled() {
+ public function testXxssProtectionIsDisabled() {
$form['seckit_xss[x_xss][select]'] = SECKIT_X_XSS_DISABLE;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertFalse($this->drupalGetHeader('X-XSS-Protection'),
- t('X-XSS-Protection is disabled.'));
+ $this->assertFalse($this->drupalGetHeader('X-XSS-Protection'), t('X-XSS-Protection is disabled.'));
}
/**
* Tests set to 0 X-XSS-Protection HTTP response header.
*/
- public function testXXSSProtectionIs0() {
+ public function testXxssProtectionIs0() {
$form['seckit_xss[x_xss][select]'] = SECKIT_X_XSS_0;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertEqual(0, $this->drupalGetHeader('X-XSS-Protection'),
- t('X-XSS-Protection is set to 0.'));
+ $this->assertEqual(0, $this->drupalGetHeader('X-XSS-Protection'), t('X-XSS-Protection is set to 0.'));
}
/**
* Tests set to 1 X-XSS-Protection HTTP response header.
*/
- public function testXXSSProtectionIs1() {
+ public function testXxssProtectionIs1() {
$form['seckit_xss[x_xss][select]'] = SECKIT_X_XSS_1;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertEqual('1', $this->drupalGetHeader('X-XSS-Protection'),
- t('X-XSS-Protection is set to 1.'));
+ $this->assertEqual('1', $this->drupalGetHeader('X-XSS-Protection'), t('X-XSS-Protection is set to 1.'));
}
/**
* Tests set to 1; mode=block X-XSS-Protection HTTP response header.
*/
- public function testXXSSProtectionIs1Block() {
+ public function testXxssProtectionIs1Block() {
$form['seckit_xss[x_xss][select]'] = SECKIT_X_XSS_1_BLOCK;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertEqual('1; mode=block', $this->drupalGetHeader('X-XSS-Protection'),
- t('X-XSS-Protection is set to 1; mode=block.'));
+ $this->assertEqual('1; mode=block', $this->drupalGetHeader('X-XSS-Protection'), t('X-XSS-Protection is set to 1; mode=block.'));
}
/**
* Tests disabled X-Content-Type-Options HTTP response header.
*/
- public function testDisabledXContentTypeOptions() {
+ public function testDisabledXcontentTypeOptions() {
$form['seckit_xss[x_content_type][checkbox]'] = FALSE;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertFalse($this->drupalGetHeader('X-Content-Type-Options'),
- t('X-Content-Type-Options is disabled.'));
+ $this->assertFalse($this->drupalGetHeader('X-Content-Type-Options'), t('X-Content-Type-Options is disabled.'));
}
/**
* Tests enabled X-Content-Type-Options HTTP response header.
*/
- public function testEnabledXContentTypeOptions() {
+ public function testEnabledXcontentTypeOptions() {
$form['seckit_xss[x_content_type][checkbox]'] = TRUE;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertEqual('nosniff', $this->drupalGetHeader('X-Content-Type-Options'),
- t('X-Content-Type-Options is enabled and set to nosniff.'));
+ $this->assertEqual('nosniff', $this->drupalGetHeader('X-Content-Type-Options'), t('X-Content-Type-Options is enabled and set to nosniff.'));
}
/**
@@ -243,10 +240,8 @@ class SecKitTestCaseTest extends WebTestBase {
global $base_url;
$form['seckit_csrf[origin]'] = TRUE;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'),
- array(), array('Origin: ' . $base_url));
- $this->assertResponse(200,
- t('Request is allowed.'));
+ $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'), array(), array('Origin: ' . $base_url));
+ $this->assertResponse(200, t('Request is allowed.'));
}
/**
@@ -258,10 +253,8 @@ class SecKitTestCaseTest extends WebTestBase {
'seckit_csrf[origin_whitelist]' => 'http://www.example.com',
);
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'),
- array(), array('Origin: http://www.example.com'));
- $this->assertResponse(200,
- t('Whitelisted request is allowed.'));
+ $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'), array(), array('Origin: http://www.example.com'));
+ $this->assertResponse(200, t('Whitelisted request is allowed.'));
}
/**
@@ -270,59 +263,52 @@ class SecKitTestCaseTest extends WebTestBase {
public function testOriginDeny() {
$form['seckit_csrf[origin]'] = TRUE;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'),
- array(), array('Origin: http://www.example.com'));
- $this->assertEqual(array(), $_POST,
- t('POST is empty.'));
- $this->assertResponse(403,
- t('Request is denied.'));
+ $this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'), array(), array('Origin: http://www.example.com'));
+ $this->assertEqual(array(), $_POST, t('POST is empty.'));
+ $this->assertResponse(403, t('Request is denied.'));
}
/**
* Tests disabled X-Frame-Options HTTP response header.
*/
- public function testXFrameOptionsIsDisabled() {
+ public function testXframeOptionsIsDisabled() {
$form['seckit_clickjacking[x_frame]'] = SECKIT_X_FRAME_DISABLE;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertFalse($this->drupalGetHeader('X-Frame-Options'),
- t('X-Frame-Options is disabled.'));
+ $this->assertFalse($this->drupalGetHeader('X-Frame-Options'), t('X-Frame-Options is disabled.'));
}
/**
* Tests set to SameOrigin X-Frame-Options HTTP response header.
*/
- public function testXFrameOptionsIsSameOrigin() {
+ public function testXframeOptionsIsSameOrigin() {
$form['seckit_clickjacking[x_frame]'] = SECKIT_X_FRAME_SAMEORIGIN;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertEqual('SameOrigin', $this->drupalGetHeader('X-Frame-Options'),
- t('X-Frame-Options is set to SameOrigin.'));
+ $this->assertEqual('SameOrigin', $this->drupalGetHeader('X-Frame-Options'), t('X-Frame-Options is set to SameOrigin.'));
}
/**
* Tests set to Deny X-Frame-Options HTTP response header.
*/
- public function testXFrameOptionsIsDeny() {
+ public function testXframeOptionsIsDeny() {
$form['seckit_clickjacking[x_frame]'] = SECKIT_X_FRAME_DENY;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertEqual('Deny', $this->drupalGetHeader('X-Frame-Options'),
- t('X-Frame-Options is set to Deny.'));
+ $this->assertEqual('Deny', $this->drupalGetHeader('X-Frame-Options'), t('X-Frame-Options is set to Deny.'));
}
/**
* Tests set to Allow-From X-Frame-Options HTTP response header.
*/
- public function testXFrameOptionsIsAllowFrom() {
+ public function testXframeOptionsIsAllowFrom() {
$form['seckit_clickjacking[x_frame]'] = SECKIT_X_FRAME_ALLOW_FROM;
$form['seckit_clickjacking[x_frame_allow_from]'] = 'http://www.google.com';
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertEqual('Allow-From: http://www.google.com', $this->drupalGetHeader('X-Frame-Options'),
- t('X-Frame-Options is set to Allow-From.'));
+ $this->assertEqual('Allow-From: http://www.google.com', $this->drupalGetHeader('X-Frame-Options'), t('X-Frame-Options is set to Allow-From.'));
}
/**
* Tests JS + CSS + Noscript protection.
*/
- public function testJSCSSNoscript() {
+ public function testJsCssNoscript() {
$form['seckit_clickjacking[js_css_noscript]'] = TRUE;
$form['seckit_clickjacking[noscript_message]'] = 'Sorry, your JavaScript is disabled.';
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
@@ -331,8 +317,8 @@ class SecKitTestCaseTest extends WebTestBase {
// @TODO this was duplicated from the Event subscriber, move to function
// in .module file?
$noscript_message = $noscript_message ?
- $noscript_message :
- $this->config->get('seckit_clickjacking.noscript_message');
+ $noscript_message :
+ $this->config->get('seckit_clickjacking.noscript_message');
$path = base_path() . drupal_get_path('module', 'seckit');
$code = <<< EOT
@@ -345,24 +331,22 @@ class SecKitTestCaseTest extends WebTestBase {
EOT;
- $this->assertRaw($code,
- t('JavaScript + CSS + Noscript protection is loaded.'));
+ $this->assertRaw($code, t('JavaScript + CSS + Noscript protection is loaded.'));
}
/**
* Tests disabled HTTP Strict Transport Security.
*/
- public function testDisabledHSTS() {
+ public function testDisabledHsts() {
$form['seckit_ssl[hsts]'] = FALSE;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertFalse($this->drupalGetHeader('Strict-Transport-Security'),
- t('HTTP Strict Transport Security is disabled.'));
+ $this->assertFalse($this->drupalGetHeader('Strict-Transport-Security'), t('HTTP Strict Transport Security is disabled.'));
}
/**
* Tests HTTP Strict Transport Security has all directives.
*/
- public function testHSTSAllDirectves() {
+ public function testHstsAllDirectves() {
$form = array(
'seckit_ssl[hsts]' => TRUE,
'seckit_ssl[hsts_max_age]' => 1000,
@@ -370,8 +354,7 @@ EOT;
);
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
$expected = 'max-age=1000; includeSubDomains';
- $this->assertEqual($expected, $this->drupalGetHeader('Strict-Transport-Security'),
- t('HTTP Strict Transport Security has all the directives.'));
+ $this->assertEqual($expected, $this->drupalGetHeader('Strict-Transport-Security'), t('HTTP Strict Transport Security has all the directives.'));
}
/**
@@ -380,8 +363,7 @@ EOT;
public function testDisabledFromOrigin() {
$form['seckit_various[from_origin]'] = FALSE;
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertFalse($this->drupalGetHeader('From-Origin'),
- t('From-Origin is disabled.'));
+ $this->assertFalse($this->drupalGetHeader('From-Origin'), t('From-Origin is disabled.'));
}
/**
@@ -393,8 +375,7 @@ EOT;
'seckit_various[from_origin_destination]' => 'same',
);
$this->drupalPostForm('admin/config/system/seckit', $form, t('Save configuration'));
- $this->assertEqual('same', $this->drupalGetHeader('From-Origin'),
- t('From-Origin is enabled and set to same.'));
+ $this->assertEqual('same', $this->drupalGetHeader('From-Origin'), t('From-Origin is enabled and set to same.'));
}
}