2

今天，我实现了Content-Security-Policy (CSP)。我还包括了，report-uri所以它发送一个POST请求到myserver.com/csp-report.php. 正如 MDN 在他们的网站上解释的那样，POST请求是这样的：

{
  "csp-report": {
    "document-uri": "http://example.com/signup.html",
    "referrer": "http://evil.example.net/haxor.html",
    "blocked-uri": "http://evil.example.net/injected.png",
    "violated-directive": "img-src *.example.com",
    "original-policy": "default-src 'self'; img-src 'self' *.example.com; report-uri /_/csp-reports",
  }
}

我想通过电子邮件将此信息发送至reports@myserver.com。目前，我有这个代码，但它只是通过电子邮件发送“Array() Array()”

<?php
$tars = Array("reports@myserver.com", "webm@myserver.com");
$from = "notify@myserver.com";
$subject = "CSP Report";
$text = print_r($_POST, true);
$text = (isSet($_GET["text"]) ? $_GET["text"] : $text);
foreach($tars as $tar){
    $e = mail($tar,$subject,$text,"From: $from");
}
if($e){
    header("Content-type: text/javascript"); 
    echo 'console.log("Email Sent");';
    exit();
}
?>
4

1 回答 1

6 
<?php
#
# Set vars for mail sender and recipient
$sender  = $_SERVER['SERVER_ADMIN'];
$recipient = $_SERVER['SERVER_ADMIN'];
$subject = $_SERVER['SERVER_NAME'] . ' CSP Report';
$smtp_headers = 'From: ' . $_SERVER['SERVER_ADMIN'] . "\r\n" .
    'Reply-To: ' . $_SERVER['SERVER_ADMIN']  . "\r\n" .
    'X-Mailer: PHP/' . phpversion();
#
# Get the report content
$json = file_get_contents('php://input');
if ($json === false) {
    throw new Exception('Bad Request');
}
$message = 'The user agent "' . $_SERVER['HTTP_USER_AGENT'] . '" '
            . 'from ' . $_SERVER['REMOTE_HOST'] . ' '
            . '(IP ' . $_SERVER['REMOTE_ADDR'] . ') '
            . 'reported the following content security policy (CSP) violation:' . "\n\n";
$csp = json_decode($json, true);
if (is_null($csp)) {
    throw new Exception('Bad JSON Violation');
}

# Parse
foreach ($csp['csp-report'] as $key => $value) {
    $message .= '    ' . $key . ": " . $value ."\n";
}

#
# Send the report
$reported = mail( $recipient, $subject, $message, $smtp_headers );

#
# Log in client?
if ( $reported ) {
    header("Content-type: text/javascript"); 
    echo 'console.log("Email Sent");';
    exit();
}
?>
于 2013-02-22T17:16:02.260 回答