Invalid Content Security Policy check [#3014523]

Inside http_response_headers.install file, in the line 24, this if operation is wrong:
$strict_transport_security instanceof ResponseHeaderInterface
Is wrong because according PHP documentation http://php.net/manual/en/internals2.opcodes.instanceof.php, When checking instanceof against a class that implements a interface, it will return true.

inside ResponseHeader.php, the class ResponseHeader implements ResponseHeaderInterface

Comment	File	Size	Author
#4	invalid-content-security-policy-check--3014523.patch	945 bytes	MykolaVeryha

Comments

Comment #1

17 November 2018 at 21:50

pierre@edumobi.com.br created an issue. See original summary.

Comment #2

pierre@edumobi.com.br commented 17 November 2018 at 21:55

This bug still presents in 8.x-2.x version as well

Comment #3

gapple

he/they

English

commented 8 January 2019 at 20:11

Issue tags:

-Content Security Policy, -http header

It looks like the intent of the if statement is to 1. check that a header is configured 2. that it implements the expected interface and 3. that it has a non-empty value.

Checking against the interface is correct, but in this case should be negated: !($strict_transport_security instanceof ResponseHeaderInterface). It is probably superfluous though, since the entity manager should only return entities of the expected type.