platform/src/Core/Framework/Routing/CoreSubscriber.php line 31

Open in your IDE?
  1. <?php declare(strict_types=1);
  3. namespace Shopware\Core\Framework\Routing;
  5. use Shopware\Core\PlatformRequest;
  6. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  7. use Symfony\Component\HttpKernel\Event\RequestEvent;
  8. use Symfony\Component\HttpKernel\Event\ResponseEvent;
  9. use Symfony\Component\HttpKernel\KernelEvents;
  11. class CoreSubscriber implements EventSubscriberInterface
  12. {
  13.     /**
  14.      * @var string[]
  15.      */
  16.     private array $cspTemplates;
  18.     public function __construct($cspTemplates)
  19.     {
  20.         $this->cspTemplates = (array) $cspTemplates;
  21.     }
  23.     public static function getSubscribedEvents()
  24.     {
  25.         return [
  26.             KernelEvents::REQUEST => 'initializeCspNonce',
  27.             KernelEvents::RESPONSE => 'setSecurityHeaders',
  28.         ];
  29.     }
  31.     public function initializeCspNonce(RequestEvent $event): void
  32.     {
  33.         $nonce = base64_encode(random_bytes(8));
  34.         $event->getRequest()->attributes->set(PlatformRequest::ATTRIBUTE_CSP_NONCE, $nonce);
  35.     }
  37.     public function setSecurityHeaders(ResponseEvent $event): void
  38.     {
  39.         if (!$event->getResponse()->isSuccessful()) {
  40.             return;
  41.         }
  43.         $response = $event->getResponse();
  44.         if ($event->getRequest()->isSecure()) {
  45.             $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
  46.         }
  47.         $response->headers->set('X-Frame-Options', 'deny');
  48.         $response->headers->set('X-Content-Type-Options', 'nosniff');
  49.         $response->headers->set('Referrer-Policy', 'strict-origin-when-cross-origin');
  51.         $cspTemplate = $this->cspTemplates['default'] ?? '';
  53.         $scope = $event->getRequest()->attributes->get(PlatformRequest::ATTRIBUTE_ROUTE_SCOPE);
  54.         if ($scope) {
  55.             foreach ($scope->getScopes() as $scope) {
  56.                 $cspTemplate = $this->cspTemplates[$scope] ?? $cspTemplate;
  57.             }
  58.         }
  60.         $cspTemplate = trim($cspTemplate);
  61.         if ($cspTemplate !== '' && !$response->headers->has('Content-Security-Policy')) {
  62.             $nonce = $event->getRequest()->attributes->get(PlatformRequest::ATTRIBUTE_CSP_NONCE);
  64.             if (\is_string($nonce)) {
  65.                 $csp = str_replace('%nonce%', $nonce, $cspTemplate);
  66.                 $csp = str_replace(["\n", "\r"], ' ', $csp);
  67.                 $response->headers->set('Content-Security-Policy', $csp);
  68.             }
  69.         }
  70.     }
  71. }