From cbd670f5afa2427b0bf5beb58c648418386e9b07 Mon Sep 17 00:00:00 2001 From: Massimiliano Arione Date: Sat, 11 Dec 2021 16:37:28 +0100 Subject: [PATCH 01/56] add nonces to profiler --- .../Controller/ProfilerController.php | 14 +++++++------- .../Resources/views/Profiler/base.html.twig | 4 ++-- .../Tests/Controller/ProfilerControllerTest.php | 2 ++ 3 files changed, 11 insertions(+), 9 deletions(-) diff --git a/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php b/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php index ac65e506f6e6b..5872a9e07c1ac 100644 --- a/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php +++ b/src/Symfony/Bundle/WebProfilerBundle/Controller/ProfilerController.php @@ -88,7 +88,7 @@ public function panelAction(Request $request, $token) } if (!$profile = $this->profiler->loadProfile($token)) { - return new Response($this->twig->render('@WebProfiler/Profiler/info.html.twig', ['about' => 'no_token', 'token' => $token, 'request' => $request]), 200, ['Content-Type' => 'text/html']); + return $this->renderWithCspNonces($request, '@WebProfiler/Profiler/info.html.twig', ['about' => 'no_token', 'token' => $token, 'request' => $request]); } if (null === $panel) { @@ -111,7 +111,7 @@ public function panelAction(Request $request, $token) throw new NotFoundHttpException(sprintf('Panel "%s" is not available for token "%s".', $panel, $token)); } - return new Response($this->twig->render($this->getTemplateManager()->getName($profile, $panel), [ + return $this->renderWithCspNonces($request, $this->getTemplateManager()->getName($profile, $panel), [ 'token' => $token, 'profile' => $profile, 'collector' => $profile->getCollector($panel), @@ -121,7 +121,7 @@ public function panelAction(Request $request, $token) 'templates' => $this->getTemplateManager()->getNames($profile), 'is_ajax' => $request->isXmlHttpRequest(), 'profiler_markup_version' => 2, // 1 = original profiler, 2 = Symfony 2.8+ profiler - ]), 200, ['Content-Type' => 'text/html']); + ]); } /** @@ -252,7 +252,7 @@ public function searchResultsAction(Request $request, $token) $end = $request->query->get('end', null); $limit = $request->query->get('limit'); - return new Response($this->twig->render('@WebProfiler/Profiler/results.html.twig', [ + return $this->renderWithCspNonces($request, '@WebProfiler/Profiler/results.html.twig', [ 'request' => $request, 'token' => $token, 'profile' => $profile, @@ -265,7 +265,7 @@ public function searchResultsAction(Request $request, $token) 'end' => $end, 'limit' => $limit, 'panel' => null, - ]), 200, ['Content-Type' => 'text/html']); + ]); } /** @@ -367,11 +367,11 @@ public function openAction(Request $request) throw new NotFoundHttpException(sprintf('The file "%s" cannot be opened.', $file)); } - return new Response($this->twig->render('@WebProfiler/Profiler/open.html.twig', [ + return $this->renderWithCspNonces($request, '@WebProfiler/Profiler/open.html.twig', [ 'filename' => $filename, 'file' => $file, 'line' => $line, - ]), 200, ['Content-Type' => 'text/html']); + ]); } /** diff --git a/src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base.html.twig b/src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base.html.twig index 0b13f57509a25..eee81b8311c76 100644 --- a/src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base.html.twig +++ b/src/Symfony/Bundle/WebProfilerBundle/Resources/views/Profiler/base.html.twig @@ -8,13 +8,13 @@ {% block head %} - {% endblock %} -