Skip to content

fix: Hardcoded CSP Nonce Tags in ResponseTrait - #9937

Merged
paulbalandan merged 15 commits into
codeigniter4:developfrom
patel-vansh:fix/hardcoded-csp-tags
Feb 15, 2026
Merged

fix: Hardcoded CSP Nonce Tags in ResponseTrait#9937
paulbalandan merged 15 commits into
codeigniter4:developfrom
patel-vansh:fix/hardcoded-csp-tags

Conversation

@patel-vansh

@patel-vanshpatel-vansh commented Feb 8, 2026

Copy link
Copy Markdown
Contributor

Description
This PR fixes#9935.

Created one method in system/HTTP/ContentSecurityPolicy.php to clear all nonce placeholders.

Checklist:

  • Securely signed commits
  • Component(s) with PHPDoc blocks, only if necessary or adds value (without duplication)
  • Unit testing, with >80% coverage
  • User guide updated
  • Conforms to style guide

@michalsnmichalsn added the bug Verified issues on the current code behavior or pull requests that will fix them label Feb 8, 2026
paulbalandan
paulbalandan reviewed Feb 8, 2026
View reviewed changes

@paulbalandanpaulbalandan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The tests don't make sense. You should be testing instead the behavior when the response is sent when CSP is not enabled.

Comment threadsystem/HTTP/ContentSecurityPolicy.php Outdated
Comment threadtests/system/HTTP/ContentSecurityPolicyTest.php Outdated
@patel-vansh@paulbalandan
Apply code suggestions
65b1a04
Co-authored-by: John Paul E. Balandan, CPA <paulbalandan@gmail.com>
@michalsn

michalsn commented Feb 10, 2026

Copy link
Copy Markdown
Member

@patel-vansh Please rebase to resolve conflicts.

@patel-vansh

patel-vansh commented Feb 11, 2026

Copy link
Copy Markdown
ContributorAuthor

@michalsn Done.

paulbalandan
paulbalandan reviewed Feb 11, 2026
View reviewed changes
Comment threadtests/system/HTTP/ResponseTest.php Outdated
Comment threadtests/system/HTTP/ResponseTest.php Outdated
Comment threadtests/system/HTTP/ResponseTest.php Outdated
Comment threadtests/system/HTTP/ResponseTest.php Outdated
Comment threadtests/system/HTTP/ResponseTest.php Outdated
Comment threadtests/system/HTTP/ResponseTest.php Outdated
Comment threadtests/system/HTTP/ResponseTest.php Outdated
Comment threadsystem/HTTP/ResponseTrait.php
paulbalandan
paulbalandan reviewed Feb 14, 2026
View reviewed changes
Comment threadtests/system/HTTP/ResponseTest.php Outdated
Comment threadtests/system/HTTP/ResponseTest.php Outdated
paulbalandan
paulbalandan approved these changes Feb 15, 2026
View reviewed changes

@paulbalandanpaulbalandan left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks a lot!

michalsn
michalsn approved these changes Feb 15, 2026
View reviewed changes

@michalsnmichalsn left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

@paulbalandan
paulbalandan merged commit 615ef4d into codeigniter4:developFeb 15, 2026
50 checks passed
@paulbalandan

paulbalandan commented Feb 15, 2026

Copy link
Copy Markdown
Member

Thank you, @patel-vansh

@patel-vansh
patel-vansh deleted the fix/hardcoded-csp-tags branch February 16, 2026 13:08
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@michalsnmichalsnmichalsn approved these changes
@paulbalandanpaulbalandanpaulbalandan approved these changes

Assignees

No one assigned

Labels

bugVerified issues on the current code behavior or pull requests that will fix them

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Bug: Hardcoded CSP Nonce Tags in ResponseTrait

3 participants

@patel-vansh@michalsn@paulbalandan