symfony · co3k · Jul 18, 2013 · Jul 18, 2013 · GromNaN · Jul 18, 2013
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/Configuration.php
@@ -82,6 +82,7 @@ public function getConfigTreeBuilder()
         $this->addValidationSection($rootNode);
         $this->addAnnotationsSection($rootNode);
         $this->addSerializerSection($rootNode);
+        $this->addResponseSection($rootNode);
 
         return $treeBuilder;
     }
@@ -414,4 +415,40 @@ private function addSerializerSection(ArrayNodeDefinition $rootNode)
             ->end()
         ;
     }
+
+    private function addResponseSection(ArrayNodeDefinition $rootNode)
+    {
+        $default = array(
+            'X-Content-Type-Options' => 'nosniff',
+        );
+
+        $example = array(
+            'X-Content-Type-Options' => 'nosniff',
+            'X-XSS-Protection'       => '1; mode=block',
+            'X-Frame-Options'        => 'SAMEORIGIN',
+        );
+
+        $rootNode
+            ->children()
+                ->arrayNode('response')
+                    ->info('response configuration')
+                    ->addDefaultsIfNotSet()
+                    ->fixXmlConfig('default_header')
+                    ->children()
+                        ->arrayNode('default_headers')
+                            ->normalizeKeys(false)
+                            ->useAttributeAsKey('name')
+                            ->example($example)
+                            ->defaultValue($default)
+                            ->beforeNormalization()
+                                ->ifNull()
+                                ->then(function($v) use ($default) { return $default; })
+                            ->end()
+                            ->prototype('scalar')->end()
+                        ->end()
+                    ->end()
+                ->end()
+            ->end()
+        ;
+    }
 }
diff --git a/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php b/src/Symfony/Bundle/FrameworkBundle/DependencyInjection/FrameworkExtension.php
@@ -73,6 +73,10 @@ public function load(array $configs, ContainerBuilder $container)
         $container->setParameter('kernel.trusted_proxies', $config['trusted_proxies']);
         $container->setParameter('kernel.default_locale', $config['default_locale']);
 
+        if (isset($config['response'])) {
+            $container->setParameter('kernel.default_response_headers', $config['response']['default_headers']);
+        }
+
         if (!empty($config['test'])) {
             $loader->load('test.xml');
         }

diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd b/src/Symfony/Bundle/FrameworkBundle/Resources/config/schema/symfony-1.0.xsd
@@ -20,6 +20,7 @@
             <xsd:element name="translator" type="translator" minOccurs="0" maxOccurs="1" />
             <xsd:element name="validation" type="validation" minOccurs="0" maxOccurs="1" />
             <xsd:element name="annotations" type="annotations" minOccurs="0" maxOccurs="1" />
+            <xsd:element name="response" type="response" minOccurs="0" maxOccurs="1" />
         </xsd:all>
 
         <xsd:attribute name="http-method-override" type="xsd:boolean" />
@@ -30,6 +31,16 @@
         <xsd:attribute name="test" type="xsd:boolean" />
     </xsd:complexType>
 
+    <xsd:complexType name="response">
+        <xsd:sequence>
+            <xsd:element name="default-header" type="default-header" minOccurs="0" maxOccurs="unbounded" />
+        </xsd:sequence>
+    </xsd:complexType>
+
+    <xsd:complexType name="default-header" mixed="true">
+        <xsd:attribute name="name" type="xsd:string" />
+    </xsd:complexType>
+
     <xsd:complexType name="form">
         <xsd:attribute name="enabled" type="xsd:boolean" />
     </xsd:complexType>

diff --git a/src/Symfony/Bundle/FrameworkBundle/Resources/config/web.xml b/src/Symfony/Bundle/FrameworkBundle/Resources/config/web.xml
@@ -28,6 +28,7 @@
         <service id="response_listener" class="%response_listener.class%">
             <tag name="kernel.event_subscriber" />
             <argument>%kernel.charset%</argument>
+            <argument>%kernel.default_response_headers%</argument>
         </service>
 
         <service id="streamed_response_listener" class="%streamed_response_listener.class%">

diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/ConfigurationTest.php
@@ -129,7 +129,12 @@ protected static function getBundleDefaultConfig()
             ),
             'serializer'          => array(
                 'enabled' => false
-            )
+            ),
+            'response'            => array(
+                'default_headers' => array(
+                    'X-Content-Type-Options' => 'nosniff',
+                ),
+            ),
         );
     }
 }
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/full.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/php/full.php
@@ -70,5 +70,11 @@
         'debug' => true,
         'file_cache_dir' => '%kernel.cache_dir%/annotations',
     ),
-    'ide' => 'file%%link%%format'
+    'ide' => 'file%%link%%format',
+    'response' => array(
+        'default_headers' => array(
+            'X-Foo' => 'Bar',
+            'X-Bar' => 'Foo',
+        ),
+    ),
 ));
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/full.xml b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/xml/full.xml
@@ -36,5 +36,9 @@
         <framework:translator enabled="true" fallback="fr" />
         <framework:validation enabled="true" cache="apc" />
         <framework:annotations cache="file" debug="true" file-cache-dir="%kernel.cache_dir%/annotations" />
+        <framework:response>
+            <framework:default-header name="X-Foo">Bar</framework:default-header>
+            <framework:default-header name="X-Bar">Foo</framework:default-header>
+        </framework:response>
     </framework:config>
 </container>
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/full.yml b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/Fixtures/yml/full.yml
@@ -55,3 +55,7 @@ framework:
         debug:   true
         file_cache_dir: %kernel.cache_dir%/annotations
     ide: file%%link%%format
+    response:
+        default_headers:
+            "X-Foo" : "Bar"
+            "X-Bar" : "Foo"
diff --git a/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php b/src/Symfony/Bundle/FrameworkBundle/Tests/DependencyInjection/FrameworkExtensionTest.php
@@ -284,6 +284,17 @@ public function testValidationPaths()
         $this->assertStringEndsWith('TestBundle'.DIRECTORY_SEPARATOR.'Resources'.DIRECTORY_SEPARATOR.'config'.DIRECTORY_SEPARATOR.'validation.xml', $xmlArgs[1]);
     }
 
+    public function testDefaultResponseHeader()
+    {
+        $container = $this->createContainerFromFile('full');
+
+        $this->assertTrue($container->hasParameter('kernel.default_response_headers'), '->registerValidationConfiguration() loads validator.xml');
+        $this->assertEquals(array(
+            'X-Foo' => 'Bar',
+            'X-Bar' => 'Foo',
+        ), $container->getParameter('kernel.default_response_headers'), '->registerValidationConfiguration() loads validator.xml');
+    }
+
     protected function createContainer(array $data = array())
     {
         return new ContainerBuilder(new ParameterBag(array_merge(array(

diff --git a/src/Symfony/Component/HttpKernel/EventListener/ResponseListener.php b/src/Symfony/Component/HttpKernel/EventListener/ResponseListener.php
@@ -25,9 +25,12 @@ class ResponseListener implements EventSubscriberInterface
 {
     private $charset;
 
-    public function __construct($charset)
+    private $defaultHeaders = array();
+
+    public function __construct($charset, $defaultHeaders = array())
     {
         $this->charset = $charset;
+        $this->defaultHeaders = $defaultHeaders;
     }
 
     /**
@@ -42,6 +45,9 @@ public function onKernelResponse(FilterResponseEvent $event)
         }
 
         $response = $event->getResponse();
+        foreach ($this->defaultHeaders as $key => $value) {
+            $response->headers->set($key, $value, false);
+        }
 
         if (null === $response->getCharset()) {
             $response->setCharset($this->charset);

diff --git a/src/Symfony/Component/HttpKernel/Tests/EventListener/ResponseListenerTest.php b/src/Symfony/Component/HttpKernel/Tests/EventListener/ResponseListenerTest.php
@@ -96,4 +96,23 @@ public function testFiltersSetsNonDefaultCharsetIfNotOverriddenOnNonTextContentT
 
         $this->assertEquals('ISO-8859-15', $response->getCharset());
     }
+
+    public function testFiltersSetsDefaultHeaders()
+    {
+        $listener = new ResponseListener('UTF-8', array(
+            'X-Add'     => 'default-value',
+            'X-Not-Add' => 'default-value',
+        ));
+        $this->dispatcher->addListener(KernelEvents::RESPONSE, array($listener, 'onKernelResponse'), 1);
+
+        $response = new Response();
+        $response->headers->set('X-Not-Add', 'user-value');
+
+        $request = Request::create('/');
+        $event = new FilterResponseEvent($this->kernel, $request, HttpKernelInterface::MASTER_REQUEST, $response);
+        $this->dispatcher->dispatch(KernelEvents::RESPONSE, $event);
+
+        $this->assertEquals('default-value', $response->headers->get('X-Add'));
+        $this->assertEquals('user-value', $response->headers->get('X-Not-Add'));
+    }
 }