Skip to content

Conversation

@Yannik
Copy link
Contributor

@Yannik Yannik commented Sep 19, 2023

Short Version:
This PR fixes csp errors caused by <script> tags without a nonce generated by HtmlDumper.

Long version:

JavaScriptRenderer::render() adds content using JavaScriptRenderer::getAddDatasetCode() with data from JavaScriptRenderer::getData(), which returns data from JavaScriptRenderer::collect().

JavaScriptRenderer::collect() essentially does this:

foreach ($this->collectors as $name => $collector) {
    $this->data[$name] = $collector->collect();
}

For the both the request collector from maximebf/debugbar (default_request) and laravel-debugbar, the collect() function uses $data[$key] = $this->getVarDumper()->renderVar($GLOBALS[$var]); to render the variables.

getVarDumper() by default returns a DebugBarVarDumper instance. DebugBarVarDumper->renderVar() returns the result from DebugBarVarDumper->dump(), which, finally returns the result from Symfony\Component\VarDumper\Dumper\HtmlDumper::dump, which calls parent::dump (AbstractDumper::dump), which calls dumpLine, which embeds the data within $this->dumpSuffix, which contains:

protected $dumpSuffix = '</pre><script>Sfdump(%s)</script>';

...a <script> tag without a nonce!

@barryvdh barryvdh merged commit 61d4cad into php-debugbar:master Sep 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants