From b27782dd26f3e2acf6334993e6066a88ec6ec38a Mon Sep 17 00:00:00 2001 From: Scott Date: Mon, 1 Feb 2016 00:47:08 -0500 Subject: [PATCH] Fix egregious typos in configuration. Now valid CSPs are generated. Tagging 1.3.0 --- src/CSPBuilder.php | 4 ++-- test/vectors/basic-csp-hash.out | 2 +- test/vectors/basic-csp-no-old.out | 2 +- test/vectors/basic-csp.json | 4 ++-- test/vectors/basic-csp.out | 2 +- 5 files changed, 7 insertions(+), 7 deletions(-) diff --git a/src/CSPBuilder.php b/src/CSPBuilder.php index 755acc9..9e83e16 100644 --- a/src/CSPBuilder.php +++ b/src/CSPBuilder.php @@ -18,8 +18,8 @@ class CSPBuilder 'base-uri', 'default-src', 'child-src', - 'connect-uri', - 'font-uri', + 'connect-src', + 'font-src', 'form-action', 'frame-ancestors', 'frame-src', diff --git a/test/vectors/basic-csp-hash.out b/test/vectors/basic-csp-hash.out index 201a902..e34105c 100644 --- a/test/vectors/basic-csp-hash.out +++ b/test/vectors/basic-csp-hash.out @@ -1 +1 @@ -base-uri 'self'; default-src 'self'; child-src https://www.youtube.com https://www.youtube-nocookie.com; connect-uri 'self'; font-uri 'self'; form-action 'self' https://example.com; frame-ancestors 'none'; img-src 'self' data:; media-src 'none'; object-src 'none'; plugin-types 'none'; script-src 'self' https://ajax.googleapis.com https://cdn.mathjax.org https://oss.maxcdn.com https://www.google-analytics.com 'sha256-qznLcsROx4GACP2dm0UCKCzCGHiZ1guq6ZZDob/Tng=' 'sha384-YlVjjxmBPFrOTrK8RYTXMzr/Pt2Tyv2yi4yMalWlUERx821L2qJpIJNvAnO6ouM/'; style-src 'self'; report-uri /csp_violation; upgrade-insecure-requests \ No newline at end of file +base-uri 'self'; default-src 'self'; child-src https://www.youtube.com https://www.youtube-nocookie.com; connect-src 'self'; font-src 'self'; form-action 'self' https://example.com; frame-ancestors 'none'; img-src 'self' data:; media-src 'none'; object-src 'none'; plugin-types 'none'; script-src 'self' https://ajax.googleapis.com https://cdn.mathjax.org https://oss.maxcdn.com https://www.google-analytics.com 'sha256-qznLcsROx4GACP2dm0UCKCzCGHiZ1guq6ZZDob/Tng=' 'sha384-YlVjjxmBPFrOTrK8RYTXMzr/Pt2Tyv2yi4yMalWlUERx821L2qJpIJNvAnO6ouM/'; style-src 'self'; report-uri /csp_violation; upgrade-insecure-requests \ No newline at end of file diff --git a/test/vectors/basic-csp-no-old.out b/test/vectors/basic-csp-no-old.out index df2b2a2..e107e43 100644 --- a/test/vectors/basic-csp-no-old.out +++ b/test/vectors/basic-csp-no-old.out @@ -1 +1 @@ -base-uri 'self'; default-src 'self'; child-src https://www.youtube.com https://www.youtube-nocookie.com; connect-uri 'self'; font-uri 'self'; form-action 'self' https://example.com; frame-ancestors 'none'; img-src 'self' ytimg.com data:; media-src 'none'; object-src 'none'; plugin-types 'none'; script-src 'self' https://ajax.googleapis.com https://cdn.mathjax.org https://oss.maxcdn.com https://www.google-analytics.com 'sha256-qznLcsROx4GACP2dm0UCKCzCGHiZ1guq6ZZDob/Tng='; style-src 'self'; report-uri /csp_violation; upgrade-insecure-requests \ No newline at end of file +base-uri 'self'; default-src 'self'; child-src https://www.youtube.com https://www.youtube-nocookie.com; connect-src 'self'; font-src 'self'; form-action 'self' https://example.com; frame-ancestors 'none'; img-src 'self' ytimg.com data:; media-src 'none'; object-src 'none'; plugin-types 'none'; script-src 'self' https://ajax.googleapis.com https://cdn.mathjax.org https://oss.maxcdn.com https://www.google-analytics.com 'sha256-qznLcsROx4GACP2dm0UCKCzCGHiZ1guq6ZZDob/Tng='; style-src 'self'; report-uri /csp_violation; upgrade-insecure-requests \ No newline at end of file diff --git a/test/vectors/basic-csp.json b/test/vectors/basic-csp.json index 10184e3..f9132b1 100644 --- a/test/vectors/basic-csp.json +++ b/test/vectors/basic-csp.json @@ -14,10 +14,10 @@ ], "self": false }, - "connect-uri": { + "connect-src": { "self": true }, - "font-uri": { + "font-src": { "self": true }, "form-action": { diff --git a/test/vectors/basic-csp.out b/test/vectors/basic-csp.out index f35e8e7..1645320 100644 --- a/test/vectors/basic-csp.out +++ b/test/vectors/basic-csp.out @@ -1 +1 @@ -base-uri 'self'; default-src 'self'; child-src https://www.youtube.com https://www.youtube-nocookie.com; connect-uri 'self'; font-uri 'self'; form-action 'self' https://example.com; frame-ancestors 'none'; img-src 'self' https://ytimg.com ytimg.com data:; media-src 'none'; object-src 'none'; plugin-types 'none'; script-src 'self' https://ajax.googleapis.com https://cdn.mathjax.org https://oss.maxcdn.com https://www.google-analytics.com 'sha256-qznLcsROx4GACP2dm0UCKCzCGHiZ1guq6ZZDob/Tng='; style-src 'self'; report-uri /csp_violation; upgrade-insecure-requests \ No newline at end of file +base-uri 'self'; default-src 'self'; child-src https://www.youtube.com https://www.youtube-nocookie.com; connect-src 'self'; font-src 'self'; form-action 'self' https://example.com; frame-ancestors 'none'; img-src 'self' https://ytimg.com ytimg.com data:; media-src 'none'; object-src 'none'; plugin-types 'none'; script-src 'self' https://ajax.googleapis.com https://cdn.mathjax.org https://oss.maxcdn.com https://www.google-analytics.com 'sha256-qznLcsROx4GACP2dm0UCKCzCGHiZ1guq6ZZDob/Tng='; style-src 'self'; report-uri /csp_violation; upgrade-insecure-requests \ No newline at end of file