search

paragonie / csp-builder

Build Content-Security-Policy headers from a JSON file (or build them programmatically)
https://paragonie.com/projects
MIT License
544 stars 39 forks source link

Add 'url' type value for report-uri #61

Closed danieltott closed 1 year ago

danieltott commented 1 year ago

report-uri values are being incorrectly encoded. The enc() function takes a type parameter that was missing.

elliot-sawyer commented 1 year ago

This still doesn't work for me, using latest dev-master. I can see the 'url' parameter is used, but the value "https://localhost:8082/csp/enforce/1" still comes out as https%3A%2F%2Flocalhost%3A8082%2Fcsp%2Fenforce%2F1. If I remove the call to $this->enc(...) entirely, it works (obviously not desirable though)

Migrating back to 2.7.0 fixes my particular problem. Is there a reason the report-uri key needs to be sent through an extra encoding step?

paragonie-security commented 1 year ago

Is this fixed for you in v2.8.1? https://github.com/paragonie/csp-builder/releases/tag/v2.8.1