search

paragonie / csp-builder

Build Content-Security-Policy headers from a JSON file (or build them programmatically)
https://paragonie.com/projects
MIT License
544 stars 39 forks source link

Remove trailing semicolon #66

Closed fritzmg closed 1 year ago

fritzmg commented 1 year ago

Currently a CSP like this:

$csp = (new CSPBuilder())
    ->setSelfAllowed('default-src', true)
    ->addSource('img-src', 'ytimg.com')
    ->disableOldBrowserSupport()
;

will produce a header like this:

default-src 'self'; img-src ytimg.com;

i.e. if you do not have directives like upgrade-insecure-requests then there will always be a trailing semicolon (and space). While this does not lead to any issues if you use this header as is, it is still inconsistent and unexpected imho. This PR would always remove the trailing semicolon and space.