This PR introduces the DirectiveSetBuilderInterface and the default implementationConfigurationDirectiveSetBuilder proposed in #347, to allow for runtime modification of the CSP directive sets. The major changes are:
Introduction of DirectiveSetBuilderInterface and ConfigurationDirectiveSetBuilder;
The ContentSecurityPolicyListener constructor now takes DirectiveSetBuilderInterface instead of the directive sets directly;
Changes to NelmioSecurityExtension to provide the configuration to the ConfigurationDirectiveSetBuilders, which in turn are injected into ContentSecurityPolicyListener (instead of the directive sets).
This adds a layer between the configuration (and the directive sets built from it) and ContentSecurityPolicyListener. This layer provides an integration point for application code to modify the directive sets based on the request (e.g., in a controller or a kernel event listener).
This PR introduces the
DirectiveSetBuilderInterface
and the default implementationConfigurationDirectiveSetBuilder
proposed in #347, to allow for runtime modification of the CSP directive sets. The major changes are:DirectiveSetBuilderInterface
andConfigurationDirectiveSetBuilder
;ContentSecurityPolicyListener
constructor now takesDirectiveSetBuilderInterface
instead of the directive sets directly;NelmioSecurityExtension
to provide the configuration to theConfigurationDirectiveSetBuilder
s, which in turn are injected intoContentSecurityPolicyListener
(instead of the directive sets).This adds a layer between the configuration (and the directive sets built from it) and
ContentSecurityPolicyListener
. This layer provides an integration point for application code to modify the directive sets based on the request (e.g., in a controller or a kernel event listener).