[WebProfilerBundle] Disable CSP if dumper was used #40441
Conversation
ab14e7d to
74315f0
Compare
| @@ -24,6 +24,7 @@ | |||
| service('router')->ignoreOnInvalid(), | |||
| abstract_arg('paths that should be excluded from the AJAX requests shown in the toolbar'), | |||
| service('web_profiler.csp.handler'), | |||
| service('data_collector.dump'), | |||
There was a problem hiding this comment.
please add ->ignoreOnInvalid() to stay compatible with cases where VarDumper is not installed and configured by DebugBundle (and so the panel is not configured)
There was a problem hiding this comment.
Thanks for the fast review stof, really appreciate it.
I saw that the WebProfilerBundle has symfony/http-kernel as dependency and thought that service will be always there then. Adapted.
src/Symfony/Bundle/WebProfilerBundle/EventListener/WebDebugToolbarListener.php
Show resolved
Hide resolved
|
I noticed that although the CSP is disabled and the header removed it still shows up in the profiler response page for that request which is kind of a lie. But on the other hand it should be there and is only removed temporarily because of the dumper. I'm not sure if this is a problem and should be addressed |
448ad6f to
5dc2637
Compare
|
Thank you @monojp. |
Disables a configured Content Security Policy if the dumper was used to avoid breaking the toolbar. This is a less invasive alternative to #29155 which fixes #29084 (there is a project with a test case linked there).