ContentSecurityPolicy.php

Constructor. Stores our default values from the Config file.

Whether Content Security Policy is being enforced.

Get the nonce for the style tag.

Get the nonce for the script tag.

Compiles and sets the appropriate headers in the request. Should be called just prior to sending the response to the user agent.

If TRUE, nothing will be restricted. Instead all violations will be reported to the reportURI for monitoring. This is useful when you are just starting to implement the policy, and will help determine what errors need to be addressed before you turn on all filtering.

Adds a new baseURI value. Can be either a URI class or a simple string. baseURI restricts the URLs that can appear in a page's <base> element.

Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string. child-src lists the URLs for workers and embedded frame contents. For example: child-src https://youtube.com would enable embedding videos from YouTube but not from other origins.

Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string. connect-src limits the origins to which you can connect (via XHR, WebSockets, and EventSource).

Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string. default_src is the URI that is used for many of the settings when no other source has been set.

Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string. font-src specifies the origins that can serve web fonts.

Adds a new valid endpoint for a form's action. Can be either a URI class or a simple string.

Adds a new resource that should allow embedding the resource using <frame>, <iframe>, <object>, <embed>, or <applet>

Adds a new valid endpoint for valid frame sources. Can be either a URI class or a simple string.

Adds a new valid endpoint for valid image sources. Can be either a URI class or a simple string.

Adds a new valid endpoint for valid video and audio. Can be either a URI class or a simple string.

Adds a new valid endpoint for manifest sources. Can be either a URI class or simple string.

Adds a new valid endpoint for Flash and other plugin sources. Can be either a URI class or a simple string.

Limits the types of plugins that can be used. Can be either a URI class or a simple string.

Specifies a URL where a browser will send reports when a content security policy is violated. Can be either a URI class or a simple string. this directive at runtime.

specifies an HTML sandbox policy that the user agent applies to the protected resource.

Adds a new valid endpoint for javascript file sources. Can be either a URI class or a simple string.

Adds a new valid endpoint for CSS file sources. Can be either a URI class or a simple string.

Sets whether the user agents should rewrite URL schemes, changing HTTP to HTTPS.

DRY method to add an string or array to a class property.

Scans the body of the request message and replaces any nonce placeholders with actual nonces, that we'll then add to our headers.

Based on the current state of the elements, will add the appropriate Content-Security-Policy and Content-Security-Policy-Report-Only headers with their values to the response object.

Adds a directive and it's options to the appropriate header. The $values array might have options that are geared toward either the regular or the reportOnly header, since it's viable to have both simultaneously.

Clear the directive.