paragonie/csp-builder

What's Changed

• Add getPolicies method to CSPBuilder class by @jahidulpabelislam in #80
• Upgrade actions/checkout to 7.x by @jahidulpabelislam in #82
• add "wasm-unsafe-eval" directive to CSPBuilder by @cliffordvickrey in #81
• Fix CI, add PHP 8.5 to build matrix by @paragonie-security in #83

New Contributors

• @jahidulpabelislam made their first contribution in #80

Full Changelog: v3.0.2...v3.1.0

What's Changed

• add updates for PHP 8.4 by @cliffordvickrey in #78

New Contributors

• @cliffordvickrey made their first contribution in #78

Full Changelog: v3.0.1...v3.0.2

• #77 - prevent duplicate policies
• Updated dependencies

What's Changed

• PHP <7.4 is not supported in this new major version!
  • The changes in #70 created a dependency conflict with PHP <7.4.
• Add a CSP header parser (CSPBuilder::fromHeader) by @fritzmg in #74
• un-deprecate frame-src by @fritzmg in #76
• Generate nonce also when only default-src policy is applied by @fritzmg in #65
• Add PoC of report-to header by @Firesphere in #70

Full Changelog: v2.9.0...v3.0.0

What's Changed

• Add support for psr/http-message v2 by @internalsystemerror in #73
• Fix support for script-src-{elem|attr}, Add support for style-src-{elem|attr} by @internalsystemerror in #71

New Contributors

• @internalsystemerror made their first contribution in #73

Full Changelog: v2.8.1...v2.9.0

What's Changed

• Add 'url' type value for report-uri by @danieltott in #61
• Fix plugin-types generation by @fritzmg in #69
• report-uri should not be encoded at all by @Firesphere in #64
• Ignore PHPUnit result cache by @fritzmg in #67
• Allow 'unsafe-hashed-attributes' to be set by @fritzmg in #68
• Remove trailing semicolon by @fritzmg in #66

New Contributors

• @danieltott made their first contribution in #61
• @fritzmg made their first contribution in #69
• @Firesphere made their first contribution in #64

Full Changelog: v2.8.0...v2.8.1

Prevent semicolon or CLRF injection. See 1a1a85f for details.

CSP-Builder is a developer tool. It is not meant to be used with user input.

However, the ability to inject CSP directives or additional headers violates the principle of least astonishment.

This was reported via user demonia on HackerOne.

• CI: Build/test on PHP 8.2
• Add support for "unsafe-hashes" directive

• #56 You can now save policies as JSON strings or to disk (reported in #39)
• #55 Allow hooks before writing output to disk
• #54 Allow https: scheme sources
• #51 Allow sample report directive
• Fixed #23 -- duplicate directives are now prevented
• Implemented #52

• Consistently invalidate the compiled CSP cache.
• Update PHPUnit, etc.
• Dropped support for PHP 7.0. You can continue to install 2.4.0, but we will not be backporting patches into the old version. PHP 7.0 is EOL, please upgrade to 7.4 or newer.