*/ private array $hosts = []; /** * @param iterable $trusted hostnames, origins or URLs this site answers on or allows */ public function __construct(iterable $trusted) { foreach ($trusted as $value) { $host = self::hostOf(is_string($value) ? $value : ''); if ($host !== null) { $this->hosts[$host] = true; } } } public function allows(ServerRequestInterface $request): bool { if (!in_array(strtoupper($request->getMethod()), self::WRITE_METHODS, true)) { return true; } foreach (['Origin', 'Referer'] as $header) { $value = trim($request->getHeaderLine($header)); // A sandboxed or privacy-stripped page sends the literal "null". if ($value === '') { continue; } $host = $value === 'null' ? null : self::hostOf($value); return $host !== null && $this->trusts($request, $host); } return $this->formCannotSend($request); } private function trusts(ServerRequestInterface $request, string $host): bool { if (isset($this->hosts[$host])) { return true; } // The host this request was addressed to. A victim's browser fills it // in, so unlike a link we might email it is safe to take at its word. foreach ([$request->getUri()->getHost(), $request->getHeaderLine('Host')] as $own) { if (self::hostOf($own) === $host) { return true; } } return false; } private function formCannotSend(ServerRequestInterface $request): bool { foreach (self::CUSTOM_HEADERS as $header) { if ($request->getHeaderLine($header) !== '') { return true; } } $type = strtolower(trim(explode(';', $request->getHeaderLine('Content-Type'))[0])); return $type === 'application/json' || str_ends_with($type, '+json'); } private static function hostOf(string $value): ?string { $value = trim($value); if ($value === '' || $value === '*') { return null; } $host = parse_url(str_contains($value, '://') ? $value : '//' . $value, PHP_URL_HOST); if (!is_string($host) || $host === '') { return null; } return strtolower(rtrim($host, '.')); } }