search

nelmio / NelmioSecurityBundle

Adds extra security-related features in your Symfony application
https://symfony.com/bundles/NelmioSecurityBundle/
MIT License
651 stars 85 forks source link

CSP interferes with var-dumper #339

Open pauljura opened 6 months ago

pauljura commented 6 months ago

After installing this and setting a strict Content Security Policy, I noticed that the Twig dump() function no longer shows pretty HTML-formatted output. It still outputs, but it doesn't have any styling or javascript toggles, due to inline script and inline styles being blocked.

Is there some way to detect when a dump() is included in the response, and disable CSP just for the current request?

I found a similar issue here https://github.com/symfony/symfony/issues/29084 but the solution there doesn't seem to work when this bundle is installed.

Thanks

Seldaek commented 6 months ago

Right, it'd probably make sense to look at the DumpDataCollector in dev environment, and do something similar to https://github.com/symfony/symfony/commit/bbb4d9f26e1a04a695099d4272c52d079e6f04cd - if someone wants to PR this.. :)