php - 如何使用 PHP 获取内容安全策略的违规报告(JSON 数据)？

Question

Content Security Policy 的一个有用功能能够检测违规并将其作为(违规报告)发送到特定的 URI。根据 CSP 1.1 Sec. 3.2.4 Reporting 的文档:

To send violation reports, the user agent must use an algorithm equivalent to the following:

• Fetch report URI from the origin of the protected resource, with the synchronous flag not set, using HTTP method POST, with a Content-Type header field of application/json with an entity body consisting of report body. If the origin of report URI is not the same as the origin of the protected resource, the block cookies flag must also be set. The user agent must not follow redirects when fetching this resource. (Note: The user agent ignores the fetched resource.)

然后，在 5.2 Sample Violation Report 部分提供了一个例子:

In the following example, the user agent rendered a representation of the resource http://example.org/page.html with the following CSP policy:

default-src 'self'; report-uri http://example.org/csp-report.cgi

The protected resource loaded an image from http://evil.example.com/image.png, violating the policy.

{
  "csp-report": {
    "document-uri": "http://example.org/page.html",
    "referrer": "http://evil.example.com/haxor.html",
    "blocked-uri": "http://evil.example.com/image.png",
    "violated-directive": "default-src 'self'",
    "effective-directive": "img-src",
    "original-policy": "default-src 'self'; report-uri http://example.org/csp-report.cgi"
  }
}

示例:

test.php

<?php
header("X-Content-Security-Policy: default-src 'self'; report-uri http://127.0.0.1/csp-report.php");
?>
<img src="http://evil.example.com/image.png">

csp-report.php

<?php
$content = "
Keys: ".implode("\n", array_keys($_POST))."\n
\n--------------------------\n\n
Values: ".implode("\n", $_POST)."\n
";
file_put_contents('csp-report.txt', $content, FILE_APPEND | LOCK_EX);
?>

csp-report.txt

Keys: 

--------------------------

Values: 

如您所见，该文件中没有保存任何内容!但是，使用 Firebug，似乎发送到该文件的报告:

注意:我希望分析性答案提到为什么正常的帖子不起作用，应该使用什么替代方法，为什么？另外，提供如何解码 JSON 是加分项。

Answer 1

我不是 PHP 专家，但是 POST 正文只是一大块 json，所以没有键值对。我假设 array_keys 是空的。我想你想要 json_decode($POST) http://php.net/manual/en/function.json-decode.php

此外，看起来您的问题已在以下位置得到回答:

JSON Post in PHP (CSP-Report)

Note: I expect analytical answer mentioning why normal post not working and what alternative should be used, and why?

我不确定你在问什么，但对于“正常”的 POST，规范中没有任何内容规定帖子正文的内容必须是键值对。此外，传统意义上的键/值对不是有效的 JSON。

另一个可能有用的页面:http://silex.sensiolabs.org/doc/cookbook/json_request_body.html