Read cspScriptNonce from latest request

Use Router::getRequest() to access the request from before controllers
were dispatched and after middleware have been run. This should ensure
that the CSP script nonce is present in the request.

Refs #943

Author: markstory

src/ToolbarService.php

@@ -25,7 +25,6 @@
 use DebugKit\Panel\PanelRegistry;
 use PDOException;
 use Psr\Http\Message\ResponseInterface;
-use Psr\Http\Message\ServerRequestInterface;
 
 /**
  * Used to create the panels and inject a toolbar into
@@ -338,11 +337,10 @@ public function getToolbarUrl()
      * contains HTML and there is a </body> tag.
      *
      * @param \DebugKit\Model\Entity\Request $row The request data to inject.
-     * @param \Psr\Http\Message\ServerRequestInterface $request The request to augment.
      * @param \Psr\Http\Message\ResponseInterface $response The response to augment.
      * @return \Psr\Http\Message\ResponseInterface The modified response
      */
-    public function injectScripts($row, ServerRequestInterface $request, ResponseInterface $response)
+    public function injectScripts($row, ResponseInterface $response)
     {
         $response = $response->withHeader('X-DEBUGKIT-ID', (string)$row->id);
         if (strpos($response->getHeaderLine('Content-Type'), 'html') === false) {
@@ -359,9 +357,14 @@ public function injectScripts($row, ServerRequestInterface $request, ResponseInt
         if ($pos === false) {
             return $response;
         }
-        $nonce = $request->getAttribute('cspScriptNonce');
-        if ($nonce) {
-            $nonce = sprintf(' nonce="%s"', $nonce);
+        // Use Router to get the request so that we can see the
+        // state after other middleware have been applied.
+        $request = Router::getRequest();
+        if ($request) {
+            $nonce = $request->getAttribute('cspScriptNonce');
+            if ($nonce) {
+                $nonce = sprintf(' nonce="%s"', $nonce);
+            }
         }
 
         $url = Router::url('/', true);

tests/TestCase/ToolbarServiceTest.php

@@ -22,6 +22,7 @@
 use Cake\Http\Response;
 use Cake\Http\ServerRequest as Request;
 use Cake\Log\Log;
+use Cake\Routing\Router;
 use Cake\TestSuite\TestCase;
 use DebugKit\Model\Entity\Request as RequestEntity;
 use DebugKit\ToolbarService;
@@ -294,6 +295,7 @@ public function testInjectScriptsLastBodyTag()
             'url' => '/articles',
             'environment' => ['REQUEST_METHOD' => 'GET'],
         ]);
+        Router::setRequest($request);
         $response = new Response([
             'statusCode' => 200,
             'type' => 'text/html',
@@ -303,7 +305,7 @@ public function testInjectScriptsLastBodyTag()
         $bar = new ToolbarService($this->events, []);
         $bar->loadPanels();
         $row = $bar->saveData($request, $response);
-        $response = $bar->injectScripts($row, $request, $response);
+        $response = $bar->injectScripts($row, response);
 
         $timeStamp = filemtime(Plugin::path('DebugKit') . 'webroot' . DS . 'js' . DS . 'main.js');
 
@@ -322,10 +324,6 @@ public function testInjectScriptsLastBodyTag()
      */
     public function testInjectScriptsFileBodies()
     {
-        $request = new Request([
-            'url' => '/articles',
-            'params' => ['plugin' => null],
-        ]);
         $response = new Response([
             'statusCode' => 200,
             'type' => 'text/html',
@@ -335,7 +333,7 @@ public function testInjectScriptsFileBodies()
         $bar = new ToolbarService($this->events, []);
         $row = new RequestEntity(['id' => 'abc123']);
 
-        $result = $bar->injectScripts($row, $request, $response);
+        $result = $bar->injectScripts($row, $response);
         $this->assertInstanceOf('Cake\Http\Response', $result);
         $this->assertSame(file_get_contents(__FILE__), '' . $result->getBody());
         $this->assertTrue($result->hasHeader('X-DEBUGKIT-ID'), 'Should have a tracking id');
@@ -348,10 +346,6 @@ public function testInjectScriptsFileBodies()
      */
     public function testInjectScriptsStreamBodies()
     {
-        $request = new Request([
-            'url' => '/articles',
-            'params' => ['plugin' => null],
-        ]);
         $response = new Response([
             'statusCode' => 200,
             'type' => 'text/html',
@@ -361,7 +355,7 @@ public function testInjectScriptsStreamBodies()
         $bar = new ToolbarService($this->events, []);
         $row = new RequestEntity(['id' => 'abc123']);
 
-        $result = $bar->injectScripts($row, $request, $response);
+        $result = $bar->injectScripts($row, $response);
         $this->assertInstanceOf('Cake\Http\Response', $result);
         $this->assertSame('I am a teapot!', (string)$response->getBody());
     }
@@ -373,8 +367,6 @@ public function testInjectScriptsStreamBodies()
      */
     public function testInjectScriptsNoModifyResponse()
     {
-        $request = new Request(['url' => '/articles']);
-
         $response = new Response([
             'statusCode' => 200,
             'type' => 'application/json',
@@ -385,7 +377,7 @@ public function testInjectScriptsNoModifyResponse()
         $bar->loadPanels();
 
         $row = $bar->saveData($request, $response);
-        $response = $bar->injectScripts($row, $request, $response);
+        $response = $bar->injectScripts($row, $response);
         $this->assertTextEquals('{"some":"json"}', (string)$response->getBody());
         $this->assertTrue($response->hasHeader('X-DEBUGKIT-ID'), 'Should have a tracking id');
     }