Use cspScriptNonce when it is available

markstory · markstory · commit 89ce62f9c765 · 2023-06-30T22:58:10.000-04:00
This allows debugkit to work in CSP controlled environments. Fixes #943
diff --git a/src/Middleware/DebugKitMiddleware.php b/src/Middleware/DebugKitMiddleware.php
@@ -69,6 +69,6 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface
             return $response;
         }
 
-        return $this->service->injectScripts($row, $response);
+        return $this->service->injectScripts($row, $request, $response);
     }
 }
diff --git a/src/ToolbarService.php b/src/ToolbarService.php
@@ -25,6 +25,7 @@
 use DebugKit\Panel\PanelRegistry;
 use PDOException;
 use Psr\Http\Message\ResponseInterface;
+use Psr\Http\Message\ServerRequestInterface;
 
 /**
  * Used to create the panels and inject a toolbar into
@@ -337,10 +338,11 @@ public function getToolbarUrl()
      * contains HTML and there is a </body> tag.
      *
      * @param \DebugKit\Model\Entity\Request $row The request data to inject.
+     * @param \Psr\Http\Message\ServerRequestInterface $request The request to augment.
      * @param \Psr\Http\Message\ResponseInterface $response The response to augment.
      * @return \Psr\Http\Message\ResponseInterface The modified response
      */
-    public function injectScripts($row, ResponseInterface $response)
+    public function injectScripts($row, ServerRequestInterface $request, ResponseInterface $response)
     {
         $response = $response->withHeader('X-DEBUGKIT-ID', (string)$row->id);
         if (strpos($response->getHeaderLine('Content-Type'), 'html') === false) {
@@ -357,13 +359,18 @@ public function injectScripts($row, ResponseInterface $response)
         if ($pos === false) {
             return $response;
         }
+        $nonce = $request->getAttribute('cspScriptNonce');
+        if ($nonce) {
+            $nonce = sprintf(' nonce="%s"', $nonce);
+        }
 
         $url = Router::url('/', true);
         $script = sprintf(
-            '<script id="__debug_kit_script" data-id="%s" data-url="%s" type="module" src="%s"></script>',
+            '<script id="__debug_kit_script" data-id="%s" data-url="%s" type="module" src="%s"%s></script>',
             $row->id,
             $url,
-            Router::url($this->getToolbarUrl())
+            Router::url($this->getToolbarUrl()),
+            $nonce
         );
         $contents = substr($contents, 0, $pos) . $script . substr($contents, $pos);
         $body->rewind();
diff --git a/tests/TestCase/Middleware/DebugKitMiddlewareTest.php b/tests/TestCase/Middleware/DebugKitMiddlewareTest.php
@@ -50,7 +50,6 @@ public function setUp(): void
         parent::setUp();
 
         $connection = ConnectionManager::get('test');
-        $this->skipIf($connection->getDriver() instanceof Sqlite, 'Schema insertion/removal breaks SQLite');
         $this->oldConfig = Configure::read('DebugKit');
         $this->restore = $GLOBALS['__PHPUNIT_BOOTSTRAP'];
         unset($GLOBALS['__PHPUNIT_BOOTSTRAP']);
@@ -132,6 +131,38 @@ public function testInvokeSaveData()
         $this->assertTextEquals($expected, $body);
     }
 
+    /**
+     * Ensure data is saved for HTML requests
+     *
+     * @return void
+     */
+    public function testInvokeInjectCspNonce()
+    {
+        $request = new ServerRequest([
+            'url' => '/articles',
+            'environment' => ['REQUEST_METHOD' => 'GET'],
+        ]);
+        $request = $request->withAttribute('cspScriptNonce', 'csp-nonce');
+
+        $response = new Response([
+            'statusCode' => 200,
+            'type' => 'text/html',
+            'body' => '<html><title>test</title><body><p>some text</p></body>',
+        ]);
+
+        $handler = $this->handler();
+        $handler->expects($this->once())
+            ->method('handle')
+            ->willReturn($response);
+
+        $middleware = new DebugKitMiddleware();
+        $response = $middleware->process($request, $handler);
+        $this->assertInstanceOf(Response::class, $response, 'Should return the response');
+
+        $body = (string)$response->getBody();
+        $this->assertStringContainsString('nonce="csp-nonce"', $body);
+    }
+
     /**
      * Ensure that streaming results are tracked, but not modified.
      *

Original file line number	Diff line number	Diff line change
`@@ -69,6 +69,6 @@ public function process(ServerRequestInterface $request, RequestHandlerInterface`
`69`	`69`	`return $response;`
`70`	`70`	`}`
`71`	`71`
`72`		`- return $this->service->injectScripts($row, $response);`
	`72`	`+ return $this->service->injectScripts($row, $request, $response);`
`73`	`73`	`}`
`74`	`74`	`}`