[FrameworkBundle] Add support to set BinaryFileResponse::trustXSendfileTypeHeader over config

Author: alexander-schranz

CHANGELOG.md

@@ -9,6 +9,7 @@ CHANGELOG
  * Add `cache:pool:invalidate-tags` command
  * Add `xliff` support in addition to `xlf` for `XliffFileDumper`
  * Deprecate the `reset_on_message` config option. It can be set to `true` only and does nothing now
+ * Add `trust_x_sendfile_type_header` option
 
 6.0
 ---

DependencyInjection/Configuration.php

@@ -81,6 +81,10 @@ public function getConfigTreeBuilder(): TreeBuilder
                     ->info("Set true to enable support for the '_method' request parameter to determine the intended HTTP method on POST requests. Note: When using the HttpCache, you need to call the method in your front controller instead")
                     ->defaultTrue()
                 ->end()
+                ->scalarNode('trust_x_sendfile_type_header')
+                    ->info('Set true to enable support for xsendfile in binary file responses.')
+                    ->defaultFalse()
+                ->end()
                 ->scalarNode('ide')->defaultValue('%env(default::SYMFONY_IDE)%')->end()
                 ->booleanNode('test')->end()
                 ->scalarNode('default_locale')->defaultValue('en')->end()

DependencyInjection/FrameworkExtension.php

@@ -330,6 +330,7 @@ public function load(array $configs, ContainerBuilder $container)
         }
 
         $container->setParameter('kernel.http_method_override', $config['http_method_override']);
+        $container->setParameter('kernel.trust_x_sendfile_type_header', $config['trust_x_sendfile_type_header']);
         $container->setParameter('kernel.trusted_hosts', $config['trusted_hosts']);
         $container->setParameter('kernel.default_locale', $config['default_locale']);
         $container->setParameter('kernel.enabled_locales', $config['enabled_locales']);

FrameworkBundle.php

@@ -45,6 +45,7 @@
 use Symfony\Component\EventDispatcher\DependencyInjection\RegisterListenersPass;
 use Symfony\Component\Form\DependencyInjection\FormPass;
 use Symfony\Component\HttpClient\DependencyInjection\HttpClientPass;
+use Symfony\Component\HttpFoundation\BinaryFileResponse;
 use Symfony\Component\HttpFoundation\Request;
 use Symfony\Component\HttpKernel\Bundle\Bundle;
 use Symfony\Component\HttpKernel\DependencyInjection\ControllerArgumentValueResolverPass;
@@ -95,6 +96,10 @@ public function boot()
         if ($this->container->getParameter('kernel.http_method_override')) {
             Request::enableHttpMethodParameterOverride();
         }
+
+        if ($this->container->getParameter('kernel.trust_x_sendfile_type_header')) {
+            BinaryFileResponse::trustXSendfileTypeHeader();
+        }
     }
 
     public function build(ContainerBuilder $container)

Resources/config/schema/symfony-1.0.xsd

@@ -42,6 +42,7 @@
         </xsd:choice>
 
         <xsd:attribute name="http-method-override" type="xsd:boolean" />
+        <xsd:attribute name="trust-x-sendfile-type-header" type="xsd:boolean" />
         <xsd:attribute name="ide" type="xsd:string" />
         <xsd:attribute name="secret" type="xsd:string" />
         <xsd:attribute name="default-locale" type="xsd:string" />

Tests/DependencyInjection/ConfigurationTest.php

@@ -369,6 +369,7 @@ protected static function getBundleDefaultConfig()
     {
         return [
             'http_method_override' => true,
+            'trust_x_sendfile_type_header' => false,
             'ide' => '%env(default::SYMFONY_IDE)%',
             'default_locale' => 'en',
             'enabled_locales' => [],

Tests/DependencyInjection/Fixtures/php/full.php

@@ -11,6 +11,7 @@
         ],
     ],
     'http_method_override' => false,
+    'trust_x_sendfile_type_header' => true,
     'esi' => [
         'enabled' => true,
     ],

Tests/DependencyInjection/Fixtures/xml/full.xml

@@ -6,7 +6,7 @@
     xsi:schemaLocation="http://symfony.com/schema/dic/services https://symfony.com/schema/dic/services/services-1.0.xsd
                         http://symfony.com/schema/dic/symfony https://symfony.com/schema/dic/symfony/symfony-1.0.xsd">
 
-    <framework:config secret="s3cr3t" ide="file%%link%%format" default-locale="fr" http-method-override="false">
+    <framework:config secret="s3cr3t" ide="file%%link%%format" default-locale="fr" http-method-override="false" trust-x-sendfile-type-header="true">
         <framework:enabled-locale>fr</framework:enabled-locale>
         <framework:enabled-locale>en</framework:enabled-locale>
         <framework:csrf-protection />

Tests/DependencyInjection/Fixtures/yml/full.yml

@@ -7,6 +7,7 @@ framework:
         csrf_protection:
             field_name: _csrf
     http_method_override: false
+    trust_x_sendfile_type_header: true
     esi:
         enabled: true
     ssi:

Tests/DependencyInjection/FrameworkExtensionTest.php

@@ -179,6 +179,13 @@ public function testHttpMethodOverride()
         $this->assertFalse($container->getParameter('kernel.http_method_override'));
     }
 
+    public function testTrustXSendfileTypeHeader()
+    {
+        $container = $this->createContainerFromFile('full');
+
+        $this->assertTrue($container->getParameter('kernel.trust_x_sendfile_type_header'));
+    }
+
     public function testEsi()
     {
         $container = $this->createContainerFromFile('full');