Fix content security policy failure due to <script> tags without nonce generated by HtmlDumper #563
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Short Version:
This PR fixes csp errors caused by <script> tags without a nonce generated by HtmlDumper.
Long version:
JavaScriptRenderer::render()adds content usingJavaScriptRenderer::getAddDatasetCode()with data fromJavaScriptRenderer::getData(), which returns data fromJavaScriptRenderer::collect().JavaScriptRenderer::collect()essentially does this:For the both the request collector from maximebf/debugbar (default_request) and laravel-debugbar, the collect() function uses
$data[$key] = $this->getVarDumper()->renderVar($GLOBALS[$var]);to render the variables.getVarDumper()by default returns aDebugBarVarDumperinstance.DebugBarVarDumper->renderVar()returns the result fromDebugBarVarDumper->dump(), which, finally returns the result fromSymfony\Component\VarDumper\Dumper\HtmlDumper::dump, which callsparent::dump(AbstractDumper::dump), which callsdumpLine, which embeds the data within$this->dumpSuffix, which contains:...a <script> tag without a nonce!