Skip to content

use object structure for CSP rules so config can be split into different files and correctly be merged #10

@fheinze

Description

@fheinze

Current behaviour when merging ...

# Settings.01.CSP.yaml
Flowpack:
  ContentSecurityPolicy:
    content-security-policy:
      script-src:
         - A
         - B
         - C
         - D

with this

# Settings.02.CSP.yaml
Flowpack:
  ContentSecurityPolicy:
    content-security-policy:
      script-src:
         - X
         - Y

leads to this

Flowpack:
  ContentSecurityPolicy:
    content-security-policy:
      script-src:
         - X
         - Y
         - C
         - D

Desired behaviour after merging ...

Flowpack:
  ContentSecurityPolicy:
    content-security-policy:
      script-src:
         - A
         - B
         - C
         - D
         - X
         - Y

However this will not be easily to implement as the SettingsLoader does not see to let us change the merging behaviour only for our config.

Proposed solution:

Change the CSP config to an object structure similar to the Neos constraints configuration.

# Settings.01.CSP.yaml
Flowpack:
  ContentSecurityPolicy:
    content-security-policy:
      script-src:
         'A': true
         'B': true
         'C': true
         'D': true

Merging this will work just fine ;)

# Settings.01.CSP.yaml
Flowpack:
  ContentSecurityPolicy:
    content-security-policy:
      script-src:
         'A': true
         'B': true
         'C': true
         'D': true
         'X': true
         'Y': true

We could even target rules more easily and deactivate them through a different config.

Other things to consider:

Could be useful to support both formats for now with deprecation warnings for now?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions