vendor/nelmio/security-bundle/EventListener/ClickjackingListener.php line 43

Open in your IDE?
  1. <?php
  3. /*
  4. * This file is part of the Nelmio SecurityBundle.
  5. *
  6. * (c) Nelmio <hello@nelm.io>
  7. *
  8. * For the full copyright and license information, please view the LICENSE
  9. * file that was distributed with this source code.
  10. */
  12. namespace Nelmio\SecurityBundle\EventListener;
  14. use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
  15. use Symfony\Component\HttpKernel\Event\ResponseEvent;
  16. use Symfony\Component\HttpKernel\HttpKernelInterface;
  17. use Symfony\Component\HttpKernel\KernelEvents;
  19. /**
  20. * @final
  21. */
  22. class ClickjackingListener extends AbstractContentTypeRestrictableListener
  23. {
  24. private $paths;
  26. public function __construct(array $paths, array $contentTypes = array())
  27. {
  28. parent::__construct($contentTypes);
  29. $this->paths = $paths;
  30. }
  32. /**
  33. * @return array
  34. */
  35. public static function getSubscribedEvents()
  36. {
  37. return array(KernelEvents::RESPONSE => 'onKernelResponse');
  38. }
  40. /**
  41. * @param FilterResponseEvent|ResponseEvent $e
  42. */
  43. public function onKernelResponse($e)
  44. {
  45. // Compatibility with Symfony < 5 and Symfony >=5
  46. if (!$e instanceof FilterResponseEvent && !$e instanceof ResponseEvent) {
  47. throw new \InvalidArgumentException(\sprintf('Expected instance of type %s, %s given', \class_exists(ResponseEvent::class) ? ResponseEvent::class : FilterResponseEvent::class, \is_object($e) ? \get_class($e) : \gettype($e)));
  48. }
  50. if (HttpKernelInterface::MASTER_REQUEST !== $e->getRequestType()) {
  51. return;
  52. }
  54. if (!$this->isContentTypeValid($e->getResponse())) {
  55. return;
  56. }
  58. $response = $e->getResponse();
  60. if ($response->isRedirection()) {
  61. return;
  62. }
  64. $currentPath = $e->getRequest()->getRequestUri() ?: '/';
  66. foreach ($this->paths as $path => $options) {
  67. if (preg_match('{'.$path.'}i', $currentPath)) {
  68. if ('ALLOW' === $options['header']) {
  69. $response->headers->remove('X-Frame-Options');
  70. } else {
  71. $response->headers->set('X-Frame-Options', $options['header']);
  72. }
  74. return;
  75. }
  76. }
  77. }
  78. }