diff --git a/composer.json b/composer.json index d73e90b..f89834c 100644 --- a/composer.json +++ b/composer.json @@ -21,6 +21,7 @@ "knplabs/knp-menu-bundle": "^3.2", "knplabs/knp-paginator-bundle": "^6.2", "liip/imagine-bundle": "^2.11", + "nelmio/security-bundle": "^3.0", "nesbot/carbon": "^2.70", "oneup/uploader-bundle": "^4.0", "phpdocumentor/reflection-docblock": "^5.3", diff --git a/composer.lock b/composer.lock index 3c3073e..3ee0783 100644 --- a/composer.lock +++ b/composer.lock @@ -4,7 +4,7 @@ "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies", "This file is @generated automatically" ], - "content-hash": "a8cff958b7f2a068c8187b04e541adb9", + "content-hash": "78e56675252a12b859ccf75a9ccda8e2", "packages": [ { "name": "beberlei/doctrineextensions", @@ -63,6 +63,82 @@ }, "time": "2020-11-29T07:37:23+00:00" }, + { + "name": "composer/ca-bundle", + "version": "1.3.7", + "source": { + "type": "git", + "url": "https://github.com/composer/ca-bundle.git", + "reference": "76e46335014860eec1aa5a724799a00a2e47cc85" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/composer/ca-bundle/zipball/76e46335014860eec1aa5a724799a00a2e47cc85", + "reference": "76e46335014860eec1aa5a724799a00a2e47cc85", + "shasum": "" + }, + "require": { + "ext-openssl": "*", + "ext-pcre": "*", + "php": "^5.3.2 || ^7.0 || ^8.0" + }, + "require-dev": { + "phpstan/phpstan": "^0.12.55", + "psr/log": "^1.0", + "symfony/phpunit-bridge": "^4.2 || ^5", + "symfony/process": "^2.5 || ^3.0 || ^4.0 || ^5.0 || ^6.0" + }, + "type": "library", + "extra": { + "branch-alias": { + "dev-main": "1.x-dev" + } + }, + "autoload": { + "psr-4": { + "Composer\\CaBundle\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Jordi Boggiano", + "email": "j.boggiano@seld.be", + "homepage": "http://seld.be" + } + ], + "description": "Lets you find a path to the system CA bundle, and includes a fallback to the Mozilla CA bundle.", + "keywords": [ + "cabundle", + "cacert", + "certificate", + "ssl", + "tls" + ], + "support": { + "irc": "irc://irc.freenode.org/composer", + "issues": "https://github.com/composer/ca-bundle/issues", + "source": "https://github.com/composer/ca-bundle/tree/1.3.7" + }, + "funding": [ + { + "url": "https://packagist.com", + "type": "custom" + }, + { + "url": "https://github.com/composer", + "type": "github" + }, + { + "url": "https://tidelift.com/funding/github/packagist/composer/composer", + "type": "tidelift" + } + ], + "time": "2023-08-30T09:31:38+00:00" + }, { "name": "doctrine/cache", "version": "2.2.0", @@ -2007,6 +2083,79 @@ ], "time": "2023-06-21T08:46:11+00:00" }, + { + "name": "nelmio/security-bundle", + "version": "v3.0.0", + "source": { + "type": "git", + "url": "https://github.com/nelmio/NelmioSecurityBundle.git", + "reference": "34699d40d81b58b6bd256e34489c799620dff2a4" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/nelmio/NelmioSecurityBundle/zipball/34699d40d81b58b6bd256e34489c799620dff2a4", + "reference": "34699d40d81b58b6bd256e34489c799620dff2a4", + "shasum": "" + }, + "require": { + "php": "^7.4 || ^8.0", + "symfony/framework-bundle": "^4.4 || ^5.4 || ^6.0", + "symfony/http-kernel": "^4.4 || ^5.4 || ^6.0", + "symfony/security-core": "^4.4 || ^5.4 || ^6.0", + "symfony/security-csrf": "^4.4 || ^5.4 || ^6.0", + "symfony/security-http": "^4.4 || ^5.4 || ^6.0", + "symfony/yaml": "^4.4 || ^5.4 || ^6.0", + "ua-parser/uap-php": "^3.4.4" + }, + "require-dev": { + "phpstan/phpstan": "^1.4", + "phpstan/phpstan-deprecation-rules": "^1.0", + "phpstan/phpstan-phpunit": "^1.0", + "phpstan/phpstan-strict-rules": "^1.1", + "phpstan/phpstan-symfony": "^1.1", + "phpunit/phpunit": "^9.5", + "psr/cache": "^1.0 || ^2.0 || ^3.0", + "symfony/browser-kit": "^4.4 || ^5.4 || ^6.0", + "symfony/cache": "^4.4 || ^5.4 || ^6.0", + "symfony/phpunit-bridge": "^6.0", + "symfony/twig-bundle": "^4.4 || ^5.4 || ^6.0", + "twig/twig": "^2.10 || ^3.0" + }, + "type": "symfony-bundle", + "extra": { + "branch-alias": { + "dev-master": "3.x-dev" + } + }, + "autoload": { + "psr-4": { + "Nelmio\\SecurityBundle\\": "src/" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Nelmio", + "homepage": "http://nelm.io" + }, + { + "name": "Symfony Community", + "homepage": "https://github.com/nelmio/NelmioSecurityBundle/contributors" + } + ], + "description": "Extra security-related features for Symfony: signed/encrypted cookies, HTTPS/SSL/HSTS handling, cookie session storage, ...", + "keywords": [ + "security" + ], + "support": { + "issues": "https://github.com/nelmio/NelmioSecurityBundle/issues", + "source": "https://github.com/nelmio/NelmioSecurityBundle/tree/v3.0.0" + }, + "time": "2022-03-17T07:30:15+00:00" + }, { "name": "nesbot/carbon", "version": "2.71.0", @@ -8805,6 +8954,69 @@ ], "time": "2023-08-28T11:09:02+00:00" }, + { + "name": "ua-parser/uap-php", + "version": "v3.9.14", + "source": { + "type": "git", + "url": "https://github.com/ua-parser/uap-php.git", + "reference": "b796c5ea5df588e65aeb4e2c6cce3811dec4fed6" + }, + "dist": { + "type": "zip", + "url": "https://api.github.com/repos/ua-parser/uap-php/zipball/b796c5ea5df588e65aeb4e2c6cce3811dec4fed6", + "reference": "b796c5ea5df588e65aeb4e2c6cce3811dec4fed6", + "shasum": "" + }, + "require": { + "composer/ca-bundle": "^1.1", + "php": "^7.2 || ^8.0" + }, + "require-dev": { + "phpstan/phpstan": "^0.12.33", + "phpunit/phpunit": "^8 || ^9", + "symfony/console": "^3.4 || ^4.2 || ^4.3 || ^5.0", + "symfony/filesystem": "^3.4 || ^4.2 || ^4.3 || ^5.0", + "symfony/finder": "^3.4 || ^4.2 || ^4.3 || ^5.0", + "symfony/yaml": "^3.4 || ^4.2 || ^4.3 || ^5.0", + "vimeo/psalm": "^3.12" + }, + "suggest": { + "symfony/console": "Required for CLI usage - ^3.4 || ^4.3 || ^5.0", + "symfony/filesystem": "Required for CLI usage - ^3.4 || ^4.3 || ^5.0", + "symfony/finder": "Required for CLI usage - ^3.4 || ^4.3 || ^5.0", + "symfony/yaml": "Required for CLI usage - ^3.4 || ^4.3 || ^5.0" + }, + "bin": [ + "bin/uaparser" + ], + "type": "library", + "autoload": { + "psr-4": { + "UAParser\\": "src" + } + }, + "notification-url": "https://packagist.org/downloads/", + "license": [ + "MIT" + ], + "authors": [ + { + "name": "Dave Olsen", + "email": "dmolsen@gmail.com" + }, + { + "name": "Lars Strojny", + "email": "lars@strojny.net" + } + ], + "description": "A multi-language port of Browserscope's user agent parser.", + "support": { + "issues": "https://github.com/ua-parser/uap-php/issues", + "source": "https://github.com/ua-parser/uap-php/tree/v3.9.14" + }, + "time": "2020-10-02T23:36:20+00:00" + }, { "name": "webmozart/assert", "version": "1.11.0", diff --git a/config/bundles.php b/config/bundles.php index 2be0c77..22b4f0d 100644 --- a/config/bundles.php +++ b/config/bundles.php @@ -17,4 +17,5 @@ return [ Oneup\UploaderBundle\OneupUploaderBundle::class => ['all' => true], Liip\ImagineBundle\LiipImagineBundle::class => ['all' => true], Knp\Bundle\PaginatorBundle\KnpPaginatorBundle::class => ['all' => true], + Nelmio\SecurityBundle\NelmioSecurityBundle::class => ['all' => true], ]; diff --git a/config/packages/nelmio_security.yaml b/config/packages/nelmio_security.yaml new file mode 100644 index 0000000..7f08c29 --- /dev/null +++ b/config/packages/nelmio_security.yaml @@ -0,0 +1,45 @@ +nelmio_security: + # prevents framing of the entire site + clickjacking: + paths: + '^/.*': DENY + + # disables content type sniffing for script resources + content_type: + nosniff: true + + # forces Microsoft's XSS-Protection with + # its block mode + xss_protection: + enabled: true + mode_block: true + + # Send a full URL in the `Referer` header when performing a same-origin request, + # only send the origin of the document to secure destination (HTTPS->HTTPS), + # and send no header to a less secure destination (HTTPS->HTTP). + # If `strict-origin-when-cross-origin` is not supported, use `no-referrer` policy, + # no referrer information is sent along with requests. + referrer_policy: + enabled: true + policies: + - 'no-referrer' + - 'strict-origin-when-cross-origin' + + forced_ssl: + hsts_max_age: 31536000 + hsts_preload: true + csp: + enabled: true + enforce: + default-src: + - 'self' + img-src: + - 'self' + - 'data:' + style-src: + - 'self' + - 'unsafe-inline' + form-action: + - 'self' + object-src: + - 'none' diff --git a/symfony.lock b/symfony.lock index d4e29f3..7ec562f 100644 --- a/symfony.lock +++ b/symfony.lock @@ -45,6 +45,18 @@ "config/routes/liip_imagine.yaml" ] }, + "nelmio/security-bundle": { + "version": "3.0", + "recipe": { + "repo": "github.com/symfony/recipes", + "branch": "main", + "version": "2.4", + "ref": "65726efb67ff51d89de38195bc0d230fa811f64d" + }, + "files": [ + "config/packages/nelmio_security.yaml" + ] + }, "oneup/uploader-bundle": { "version": "4.0", "recipe": {