Csp Builder Laravel Package

What's Changed

• add updates for PHP 8.4 by @cliffordvickrey in https://github.com/paragonie/csp-builder/pull/78

New Contributors

• @cliffordvickrey made their first contribution in https://github.com/paragonie/csp-builder/pull/78

Full Changelog: https://github.com/paragonie/csp-builder/compare/v3.0.1...v3.0.2

• #77 - prevent duplicate policies
• Updated dependencies

What's Changed

• PHP <7.4 is not supported in this new major version!
  • The changes in #70 created a dependency conflict with PHP <7.4.
• Add a CSP header parser (CSPBuilder::fromHeader) by @fritzmg in https://github.com/paragonie/csp-builder/pull/74
• un-deprecate frame-src by @fritzmg in https://github.com/paragonie/csp-builder/pull/76
• Generate nonce also when only default-src policy is applied by @fritzmg in https://github.com/paragonie/csp-builder/pull/65
• Add PoC of report-to header by @Firesphere in https://github.com/paragonie/csp-builder/pull/70

Full Changelog: https://github.com/paragonie/csp-builder/compare/v2.9.0...v3.0.0

What's Changed

• Add support for psr/http-message v2 by @internalsystemerror in https://github.com/paragonie/csp-builder/pull/73
• Fix support for script-src-{elem|attr}, Add support for style-src-{elem|attr} by @internalsystemerror in https://github.com/paragonie/csp-builder/pull/71

New Contributors

• @internalsystemerror made their first contribution in https://github.com/paragonie/csp-builder/pull/73

Full Changelog: https://github.com/paragonie/csp-builder/compare/v2.8.1...v2.9.0

What's Changed

• Add 'url' type value for report-uri by @danieltott in https://github.com/paragonie/csp-builder/pull/61
• Fix plugin-types generation by @fritzmg in https://github.com/paragonie/csp-builder/pull/69
• report-uri should not be encoded at all by @Firesphere in https://github.com/paragonie/csp-builder/pull/64
• Ignore PHPUnit result cache by @fritzmg in https://github.com/paragonie/csp-builder/pull/67
• Allow 'unsafe-hashed-attributes' to be set by @fritzmg in https://github.com/paragonie/csp-builder/pull/68
• Remove trailing semicolon by @fritzmg in https://github.com/paragonie/csp-builder/pull/66

New Contributors

• @danieltott made their first contribution in https://github.com/paragonie/csp-builder/pull/61
• @fritzmg made their first contribution in https://github.com/paragonie/csp-builder/pull/69
• @Firesphere made their first contribution in https://github.com/paragonie/csp-builder/pull/64

Full Changelog: https://github.com/paragonie/csp-builder/compare/v2.8.0...v2.8.1

Prevent semicolon or CLRF injection. See https://github.com/paragonie/csp-builder/commit/1a1a85fcf115400d7753af842403ec6e846319de for details.

CSP-Builder is a developer tool. It is not meant to be used with user input.

However, the ability to inject CSP directives or additional headers violates the principle of least astonishment.

This was reported via user demonia on HackerOne.

• CI: Build/test on PHP 8.2
• Add support for "unsafe-hashes" directive

• #56 You can now save policies as JSON strings or to disk (reported in #39)
• #55 Allow hooks before writing output to disk
• #54 Allow https: scheme sources
• #51 Allow sample report directive
• Fixed #23 -- duplicate directives are now prevented
• Implemented #52

• Consistently invalidate the compiled CSP cache.
• Update PHPUnit, etc.
• Dropped support for PHP 7.0. You can continue to install 2.4.0, but we will not be backporting patches into the old version. PHP 7.0 is EOL, please upgrade to 7.4 or newer.

• #42 - In Chrome 76, this library's behavior with report-to does not work. Specifically, you cannot pass a URL as a report-to directive or Chrome will never send CSP reports, even if there is also a report-uri fallback. @iangcarroll provided a pull request that fixes this behavior.

• #21 - Add always clause to nginx header. Thanks @alainwolf
• #17 - Add support for blob:, filesystem:, and data: URIs.
• Added CSPBuilder::fromArray() because its absence seemed confusing if you're not familiar with the constructor.
• Minor documentation improvements. Not nearly enough to close #18, though.

• Add dedicated API method for setting report-to/report-uri directives.
• Add support for 'strict-dynamic' and 'unsafe-hashed-attributes'

Contains a year of bugfixes and tweaks from the v2 branch, backported for PHP 5 support.

• Added several helper methods, e.g. setDataAllowed() and setSelfAllowed(), for programatically allowing self and data: URIs for a specific directive.
• CSP-Builder is now type-safe! This can be verified by Psalm. In future releases, this will be enforced by Travis CI.
• Docblock and unit test cleanup.

Allow CSPBuilder instances to be instantiated from a JSON string. Thanks [@renanmpimentel](https://github.com/renanmpimentel)

Version 1.3.2 broke somewhere in the git chain, so v1.3.3 it is.

Version 2.0.0 requires PHP 7.

This allows us to use strict typing and drop random_compat as a dependency.

• Minor (some annoying) bug fixes
• Fix whitespace in unsafe-eval directives

Full list here: https://github.com/paragonie/csp-builder/compare/v1.3.0...v1.3.1

A lot of bugfixes since 1.2.0.

BC break: Changed our erroneous connect-uri and font-uri directives to connect-src and font-src respectively.

• README
• Changes since v1.2.0

Before version 1.4, I'd like to improve the documentation and unit test coverage. Feel free to open any issues for bugs you encounter or feature requests you might have.

Use normal Base64 encoding for CSP hashes.

It turns out that the hash directive just needs to be sha256-blah not hash-sha256-blah.

Add preHash(), which allows users to precalculate a hash of a resource and store it directly in the CSP. (Mostly useful for locally caching the hashes of remote resources.)

• Fix hash()
• Confirmed that CSP headers work as expected with report-uri.io

• BC break: Adopted random_compat instead of openssl for generating a nonce
• BC break: Established PHP 5.5 as the minimum version. Previously, this was undefined.
• Added method for getting the headers as an array (see #5)
• Added method to inject headers into a PSR-7 message (see #5)
• Added support for the plugin-types directive (see #4)

Thanks @Ocramius and @Lewiscowles1986 for their feedback and assistance. (If it weren't for the possibly BC-breaking changes, this would have simply been 1.1.1.)

General improvements, especially with older Webkit browsers.

Thanks to @timoh6 and @ScottHelme for their feedback.

Initial release.