vendor/nelmio/security-bundle/EventListener/XssProtectionListener.php line 39

Open in your IDE?
  1. <?php
  3. /*
  4. * This file is part of the Nelmio SecurityBundle.
  5. *
  6. * (c) Nelmio <hello@nelm.io>
  7. *
  8. * For the full copyright and license information, please view the LICENSE
  9. * file that was distributed with this source code.
  10. */
  12. namespace Nelmio\SecurityBundle\EventListener;
  14. use Symfony\Component\HttpKernel\Event\FilterResponseEvent;
  15. use Symfony\Component\HttpKernel\Event\ResponseEvent;
  16. use Symfony\Component\HttpKernel\HttpKernelInterface;
  17. use Symfony\Component\EventDispatcher\EventSubscriberInterface;
  18. use Symfony\Component\HttpKernel\KernelEvents;
  20. /**
  21. * @final
  22. */
  23. class XssProtectionListener implements EventSubscriberInterface
  24. {
  25. private $enabled;
  26. private $modeBlock;
  27. private $reportUri;
  29. public function __construct($enabled, $modeBlock, $reportUri = null)
  30. {
  31. $this->enabled = $enabled;
  32. $this->modeBlock = $modeBlock;
  33. $this->reportUri = $reportUri;
  34. }
  36. /**
  37. * @param FilterResponseEvent|ResponseEvent $e
  38. */
  39. public function onKernelResponse($e)
  40. {
  41. // Compatibility with Symfony < 5 and Symfony >=5
  42. if (!$e instanceof FilterResponseEvent && !$e instanceof ResponseEvent) {
  43. throw new \InvalidArgumentException(\sprintf('Expected instance of type %s, %s given', \class_exists(ResponseEvent::class) ? ResponseEvent::class : FilterResponseEvent::class, \is_object($e) ? \get_class($e) : \gettype($e)));
  44. }
  46. if (HttpKernelInterface::MASTER_REQUEST !== $e->getRequestType()) {
  47. return;
  48. }
  50. $response = $e->getResponse();
  52. if ($response->isRedirection()) {
  53. return;
  54. }
  56. $value = '0';
  57. if ($this->enabled) {
  58. $value = '1';
  60. if ($this->modeBlock) {
  61. $value .= '; mode=block';
  62. }
  64. if ($this->reportUri) {
  65. $value .= '; report=' . $this->reportUri;
  66. }
  67. }
  69. $response->headers->set('X-XSS-Protection', $value);
  70. }
  72. /**
  73. * @return array
  74. */
  75. public static function getSubscribedEvents()
  76. {
  77. return array(KernelEvents::RESPONSE => 'onKernelResponse');
  78. }
  80. public static function fromConfig(array $config)
  81. {
  82. $enabled = $config['enabled'];
  83. $modeBlock = $config['mode_block'];
  84. $reportUri = $config['report_uri'];
  86. return new self($enabled, $modeBlock, $reportUri);
  87. }
  88. }