Bug: KINT d() visual error in debugging when activating CSP

[davidalmaraz]

PHP Version

7.4

CodeIgniter4 Version

4.1.5

CodeIgniter4 Installation Method

Manual (zip or tar.gz)

Which operating systems have you tested for this bug?

Windows

Which server did you use?

apache

Database

No response

What happened?

kint-rich-script and kint-rich-style in RichRenderer.php inside thirdparty KIN need to put {csp-style-nonce} and {csp-script-nonce} because when "CONTENT SECURITY POLICY" is activated it disables it for security for the same. What causes that being in debug mode with CSP activated disables its visual style.

Steps to Reproduce

Activate developer mode and CSP.

Use d('example'); in some controller to debug

Expected Output

Being able to see the theme used by kint in the web browser for debugging

Anything else?

into folder system/ThirdParty/Kint/Renderer/ in file RichRenderer.php into line 383 a 392

switch ($type) { case 'script': $output .= '<script class="kint-rich-script">'.$contents.'</script>'; break; case 'style': $output .= '<style class="kint-rich-style">'.$contents.'</style>'; break; default: $output .= $contents; }

replace by:

switch ($type) { case 'script': $output .= '<script {csp-script-nonce} class="kint-rich-script">'.$contents.'</script>'; break; case 'style': $output .= '<style {csp-style-nonce} class="kint-rich-style">'.$contents.'</style>'; break; default: $output .= $contents; }

To return the visual style of KINT when CSP is activated

[kenjis]

@davidalmaraz Thank you for reporitng.
I've confirm this behavior.

But Kint is a third party library, so we can't change files in it.

[kenjis]

The workaround is to use dd() instead of d().

[kenjis]

app/Common.php:

function d(...$vars)
{
    Kint::$aliases[] = 'd';

    ob_start();
    Kint::dump(...$vars);
    $output = ob_get_clean();

    /** @var \Config\App $config */
    $config = config('App');

    if ($config->CSPEnabled === true) {
        $output = str_replace('<script ', '<script {csp-script-nonce} ', $output);
        $output = str_replace('<style ', '<style {csp-style-nonce} ', $output);
    }

    echo $output;
}

[kenjis]

Kint has magical Modifiers:
https://kint-php.github.io/kint/advanced/

If you use the wrapper functions (or CI4 provides them), the Modifiers do not work.

This should be handled by Kint.

[kenjis]

@davidalmaraz
I created another PR. It works Kint Modifiers.
See #5501

[davidalmaraz]

@kenjis
Thank you very much, it worked for me to overwrite the function inside the common controller but I liked the one in
override RichRenderer :: preRender () #5501

[kenjis]

#5501 was merged into develop.