added support for Content Security Policy script-src: 'nonce-....' [C…

…loses #136]
nette · Jan 2, 2017 · f7ac7ed · f7ac7ed
1 parent 98b2717
commit f7ac7ed
Show file tree

Hide file tree

Showing 6 changed files with 24 additions and 8 deletions.
diff --git a/src/Tracy/Bar.php b/src/Tracy/Bar.php
@@ -106,6 +106,7 @@ public function render()
 		}
 
 		if (Helpers::isHtmlMode()) {
+			$nonce = Helpers::getNonce();
 			require __DIR__ . '/assets/Bar/loader.phtml';
 		}
 	}

diff --git a/src/Tracy/BlueScreen.php b/src/Tracy/BlueScreen.php
@@ -109,6 +109,7 @@ private function renderTemplate($exception, $template)
 				Dumper::LOCATION => Dumper::LOCATION_CLASS,
 			]);
 		};
+		$nonce = Helpers::getNonce();
 
 		require $template;
 	}

diff --git a/src/Tracy/Helpers.php b/src/Tracy/Helpers.php
@@ -238,4 +238,13 @@ public static function isAjax()
 		return isset($_SERVER['HTTP_X_TRACY_AJAX']) && preg_match('#^\w{10}\z#', $_SERVER['HTTP_X_TRACY_AJAX']);
 	}
 
+
+	/** @internal */
+	public static function getNonce()
+	{
+		return preg_match('#^Content-Security-Policy:.*\sscript-src\s+(?:[^;]+\s)?\'nonce-([\w/=+-]+)\'#m', implode("\n", headers_list()), $m)
+			? $m[1]
+			: NULL;
+	}
+
 }
diff --git a/src/Tracy/assets/Bar/bar.js b/src/Tracy/assets/Bar/bar.js
@@ -400,6 +400,7 @@
 		}
 		Debug.scriptElem = document.createElement('script');
 		Debug.scriptElem.src = url;
+		Debug.scriptElem.setAttribute('nonce', layer.dataset.nonce);
 		document.documentElement.appendChild(Debug.scriptElem);
 	};
 
@@ -408,6 +409,7 @@
 			if ((!script.hasAttribute('type') || script.type === 'text/javascript' || script.type === 'application/javascript') && !script.tracyEvaluated) {
 				var dolly = document.createElement('script');
 				dolly.textContent = script.textContent;
+				dolly.setAttribute('nonce', layer.dataset.nonce);
 				script.ownerDocument.body.appendChild(dolly);
 				script.tracyEvaluated = true;
 			}

diff --git a/src/Tracy/assets/Bar/loader.phtml b/src/Tracy/assets/Bar/loader.phtml
@@ -13,18 +13,19 @@ namespace Tracy;
 
 use Tracy;
 
+$nonceAttr = $nonce ? " nonce='$nonce' " : '';
 ?>
 
 
 
 
 <!-- Tracy Debug Bar -->
-<div id="tracy-debug" data-id="<?= htmlspecialchars($contentId) ?>"></div>
+<div id="tracy-debug" data-id="<?= htmlspecialchars($contentId) ?>" data-nonce="<?= $nonce ?>"></div>
 <?php if ($contentId): ?>
-<script src="?_tracy_bar=<?= urlencode("content.$contentId") ?>&amp;XDEBUG_SESSION_STOP=1"></script>
+<script<?= $nonceAttr ?> src="?_tracy_bar=<?= urlencode("content.$contentId") ?>&amp;XDEBUG_SESSION_STOP=1"></script>
 <?php else: ?>
-<script src="?_tracy_bar=js&amp;v=<?= urlencode(Debugger::VERSION) ?>&amp;XDEBUG_SESSION_STOP=1"></script>
-<script>
+<script<?= $nonceAttr ?> src="?_tracy_bar=js&amp;v=<?= urlencode(Debugger::VERSION) ?>&amp;XDEBUG_SESSION_STOP=1"></script>
+<script<?= $nonceAttr ?>>
 Tracy.Debug.init(<?= json_encode($content) ?>, <?= json_encode($dumps) ?>);
 </script>
 <?php endif ?>
diff --git a/src/Tracy/assets/BlueScreen/page.phtml b/src/Tracy/assets/BlueScreen/page.phtml
@@ -8,12 +8,14 @@
  *
  * @param  array $exception
  * @param  string $title
+ * @param  string $nonce
  * @return void
  */
 
 namespace Tracy;
 
 $code = $exception->getCode() ? ' #' . $exception->getCode() : '';
+$nonceAttr = $nonce ? " nonce='$nonce' " : '';
 
 ?><!DOCTYPE html><!-- "' --></script></style></pre></xmp></table></a></abbr></address></article></aside></audio></b></bdi></bdo></blockquote></button></canvas></caption></cite></code></datalist></del></details></dfn></div></dl></em></fieldset></figcaption></figure></footer></form></h1></h2></h3></h4></h5></h6></header></hgroup></i></iframe></ins></kbd></label></legend></map></mark></menu></meter></nav></noscript></object></ol></optgroup></output></progress></q></rp></rt></ruby></s></samp></section></select></small></span></strong></sub></summary></sup></textarea></time></title></tr></u></ul></var></video>
 <html>
@@ -30,14 +32,14 @@ $code = $exception->getCode() ? ' #' . $exception->getCode() : '';
 	<style type="text/css" class="tracy-debug">
 	<?= preg_replace('#[\r\n\t ]+#', ' ', file_get_contents(__DIR__ . '/bluescreen.css')) ?>
 	</style>
-	<script>document.documentElement.className+=' tracy-js'</script>
+	<script<?= $nonceAttr ?>>document.documentElement.className+=' tracy-js'</script>
 </head>
 
 
 <body>
 <?php require __DIR__ . '/content.phtml' ?>
 
-<script>
+<script<?= $nonceAttr ?>>
 (function() {
 	if (!document.documentElement.dataset) {
 		document.getElementById('tracy-bs-error').innerHTML += '<div id=tracy-bs-ie-warning>Warning: Tracy requires IE 11+<\/div>';
@@ -48,10 +50,10 @@ $code = $exception->getCode() ? ' #' . $exception->getCode() : '';
 	<?php readfile(__DIR__ . '/bluescreen.js') ?>
 })();
 </script>
-<script>
+<script<?= $nonceAttr ?>>
 Tracy && Tracy.Dumper.init(<?= json_encode(Dumper::fetchLiveData()) ?>);
 </script>
-<script>
+<script<?= $nonceAttr ?>>
 Tracy && Tracy.BlueScreen.init();
 </script>
 </body>