Use Twig2 RuntimeLoader about nelmiosecuritybundle HOT 5 CLOSED

currently, does the twig extension gets loaded all the time?

from nelmiosecuritybundle.

@cordoval Yes it does. Looking at the current implementation, it's possible to change this.

The ShaComputer is injected so you can pre-compute the hash if the content is static text.
So you would have to remove this optimization (although this dependency is not to heavy).

The ContentSecurityPolicyListener can easily be loaded using a RuntimeLoader, make the Function require the Twig context so you can access the RuntimeLoaders and no need for a custom Node 👍

public function getFunctions()
{
    return array(
        new \Twig_SimpleFunction('csp_nonce', array($this, 'getCSPNonce'), , array('needs_environment' => true)),
    );
}

public function getCSPNonce(Twig_Environment $env, $usage = null)
{
    // This requires a runtime-loader is registered for the provided class
    $listener = $env->getRuntime('ContentSecurityPolicyListenerNelmio\SecurityBundle\EventListener\ContentSecurityPolicyListener');

    if (null === $nonce = $this->listener->getNonce($usage)) {
        throw new \RuntimeException('You must enable nonce to use this feature');
    }
    
    return $nonce;
}

from nelmiosecuritybundle.

Well, it would be much better to move the definition of getCSPNonce to a runtime class instead, and let Twig compile the call to the function to use this runtime, instead of using $env->getRuntime yourselves in the extension method (which is not the intended way to use this feature).

The ShaComputer is indeed not a heavy dependency, so it may not be worth avoiding its instantiation at the cost of removing an optimization.

from nelmiosecuritybundle.

however, note that the listener is a kernel.request and kernel.response listener anyway. So avoiding to instantiate it for the Twig extension may not be worth it. The event dispatcher will instantiate it for all requests anyway (so the benefit would be for the CLI only)

from nelmiosecuritybundle.

oops, I didn't see this issue when implementing #283, closing since it was moved to a runtime class.

from nelmiosecuritybundle.