/**
* Fires the actual cURL request.
*
* @param string $url
*/
public function send(string $method, string $url)
{
// Reset our curl options so we're on a fresh slate.
$curl_options = [];
if (!empty($this->config['query']) && is_array($this->config['query'])) {
// This is likely too naive a solution.
// Should look into handling when $url already
// has query vars on it.
$url .= '?' . http_build_query($this->config['query']);
unset($this->config['query']);
}
$curl_options[CURLOPT_URL] = $url;
$curl_options[CURLOPT_RETURNTRANSFER] = true;
$curl_options[CURLOPT_HEADER] = true;
$curl_options[CURLOPT_FRESH_CONNECT] = true;
// Disable @file uploads in post data.
$curl_options[CURLOPT_SAFE_UPLOAD] = true;
$curl_options = $this->setCURLOptions($curl_options, $this->config);
$curl_options = $this->applyMethod($method, $curl_options);
$curl_options = $this->applyRequestHeaders($curl_options);
// Do we need to delay this request?
if ($this->delay > 0) {
sleep($this->delay);
}
$output = $this->sendRequest($curl_options);
// Split out our headers and body
$break = strpos($output, "\r\n\r\n");
if ($break !== false) {
// Our headers
$headers = explode("\n", substr($output, 0, $break));
$this->setResponseHeaders($headers);
// Our body
$body = substr($output, $break + 4);
$this->response->setBody($body);
} else {
$this->response->setBody($output);
}
return $this->response;
}
/**
* Scans the body of the request message and replaces any nonce
* placeholders with actual nonces, that we'll then add to our
* headers.
*
* @param ResponseInterface $response
*/
protected function generateNonces(ResponseInterface &$response)
{
$body = $response->getBody();
if (empty($body)) {
return;
}
if (!is_array($this->styleSrc)) {
$this->styleSrc = [$this->styleSrc];
}
if (!is_array($this->scriptSrc)) {
$this->scriptSrc = [$this->scriptSrc];
}
// Replace style placeholders with nonces
$body = preg_replace_callback('/{csp-style-nonce}/', function ($matches) {
$nonce = bin2hex(random_bytes(12));
$this->styleSrc[] = 'nonce-' . $nonce;
return 'nonce=' . $nonce;
}, $body);
// Replace script placeholders with nonces
$body = preg_replace_callback('/{csp-script-nonce}/', function ($matches) {
$nonce = bin2hex(random_bytes(12));
$this->scriptSrc[] = 'nonce-' . $nonce;
return 'nonce=' . $nonce;
}, $body);
$response->setBody($body);
}
