File Coverage

blib/lib/Plack/Middleware/CSP.pm

Criterion	Covered	Total	%
statement	37	37	100.0
branch	2	2	100.0
condition			n/a
subroutine	12	12	100.0
pod	2	4	50.0
total	53	55	96.3

use 5.014;

package Plack::Middleware::CSP 0.01 {
    use utf8;
    use strict;
    use warnings;
    use HTTP::CSPHeader;
    use parent "Plack::Middleware";
    use Plack::Util::Accessor qw( nonce_template_token );
    our $AUTHORITY = "cpan:ASHLEY";

    sub csp { +shift->{_csp} }
    sub nonce { +shift->csp->nonce }

    sub new {
        my $self = +shift->SUPER::new(@_);
        # TEST policy and nonces_for are properly formed and HTTP::CSPHeader object can be made.
        # Refer to HTTP::CSPHeader's tests?
        $self->{_csp} = HTTP::CSPHeader->new(
            policy => delete $self->{policy},
            nonces_for => delete $self->{nonces_for},
            );

        $self;
    }

    sub call {
        my ( $self, $env ) = @_;

        $env->{"CSP_NONCE"} = $self->nonce;
        my $res = $self->app->($env);

        Plack::Util::response_cb($res, sub {
            my $res = shift;
            $self->csp->reset; # Request is done, reset for response.
            my $h = Plack::Util::headers($res->[1]);
            if ( my $token = $self->nonce_template_token )
            {
                my $nonce = $self->nonce;
                # Content type?!? Restrict to… sane values? text, html…?
                s/\Q$token/$nonce/g for @{ $res->[2] };
            }
            $h->set("content-security-protocol" => $self->csp->header );
         });
    }
    1;
};

__DATA__