Repository navigation
Collect CSP violations in browser E2E with an optional strict policy - #34
Merged
Merged
Conversation
The current CSP allows inline scripts, styles and eval, so browsers never report those dependencies. Add CSP_POLICY=strict (report-only in test environments) and have the E2E harness record every securitypolicyviolation event, summarising them per directive and page. The default policy and production behaviour are unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Acceptance and browser E2E ran without CSP and the other security headers because only config/web.php registered the bootstrap, so the CSP violation collection had nothing to observe. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
改用強制 CSP 前的盤點工具，取代原規劃的 CSP 回報端點。回報端點需要一個免登入、免 CSRF 的 POST 網址，Checkmarx 可能列出 CSRF 停用與 Log Forging；改為在瀏覽器 E2E 收集，不新增任何對外網址。
目前的 CSP（compat）允許 inline script／style 與 eval，所以瀏覽器不會回報這些依賴。
修改：
CSP_POLICY=strict：script-src、style-src 只允許'self'，並加'report-sample'讓報告附上前 40 字。預設仍為compat，正式行為不變；strict 只供測試環境搭配CSP_MODE=report-only使用（只回報、不阻擋）。securitypolicyviolation監聽，結束時依指令列出摘要，並寫入tests/_output/e2e/csp-violations.json。違規只紀錄，不影響通過與否。config/test.php加入SecurityHeadersBootstrap。原本只有config/web.php載入，所以 acceptance 與 E2E 都在沒有 CSP 等安全標頭的情況下執行，與正式環境不同。.env.example、E2E README、CHANGELOG 已更新。盤點結果（測試伺服器
CSP_POLICY=strictreport-only，E2E 179 項）：registerJs的 inline script（jQuery(window).on('load'…、字型大小、krajee dialog 設定、ActiveForm 等）SetFont()（54 頁）、投票頁chkClick()、getQuestions()、voteRule()registerCss（.os-host > .os-padding、.header-pt等）style="..."屬性與套件動態加入的樣式驗證（dev6，PHP 8.2.35）：
SecurityHeadersBootstrapTest12 tests／25 assertions 通過。🤖 Generated with Claude Code