MC-30971: CSP policies must be defined in a single header

Author: Oleksandr Gorkun

app/code/Magento/Csp/Model/Policy/Renderer/SimplePolicyHeaderRenderer.php

@@ -45,7 +45,7 @@ public function render(PolicyInterface $policy, HttpResponse $response): void
             $header = 'Content-Security-Policy';
         }
         $value = $policy->getId() .' ' .$policy->getValue() .';';
-        if ($config->getReportUri()) {
+        if ($config->getReportUri() && !$response->getHeader('Report-To')) {
             $reportToData = [
                 'group' => 'report-endpoint',
                 'max_age' => 10886400,
@@ -57,7 +57,10 @@ public function render(PolicyInterface $policy, HttpResponse $response): void
             $value .= ' report-to '. $reportToData['group'] .';';
             $response->setHeader('Report-To', json_encode($reportToData), true);
         }
-        $response->setHeader($header, $value, false);
+        if ($existing = $response->getHeader($header)) {
+            $value = $existing->getFieldValue() .' ' .$value;
+        }
+        $response->setHeader($header, $value, true);
     }
 
     /**

dev/tests/integration/testsuite/Magento/Csp/CspAwareActionTest.php

@@ -31,15 +31,13 @@ public function testAwareAction(): void
     {
         $this->getRequest()->setMethod('GET');
         $this->dispatch('csputil/csp/aware');
-        $headers = '';
-        foreach ($this->getResponse()->getHeaders() as $header) {
-            $headers .= $header->getFieldName() .': ' .$header->getFieldValue() .PHP_EOL;
-        }
+        $header = $this->getResponse()->getHeader('Content-Security-Policy');
+        $this->assertNotEmpty($header);
 
         $this->assertContains(
-            'Content-Security-Policy: script-src https://controller.magento.com'
+            'script-src https://controller.magento.com'
                 .' \'self\' \'sha256-H4RRnauTM2X2Xg/z9zkno1crqhsaY3uKKu97uwmnXXE=\'',
-            $headers
+            $header->getFieldValue()
         );
     }
 }

dev/tests/integration/testsuite/Magento/Csp/CspUtilTest.php

@@ -20,6 +20,7 @@ class CspUtilTest extends AbstractController
      * Test that CSP helper for templates works.
      *
      * @return void
+     * @magentoConfigFixture default_store csp/mode/storefront/report_only 0
      */
     public function testPhtmlHelper(): void
     {
@@ -29,11 +30,9 @@ public function testPhtmlHelper(): void
 
         $this->assertContains('<script src="http://my.magento.com/static/script.js" />', $content);
         $this->assertContains("<script>\n    let myVar = 1;\n</script>", $content);
-        $headers = '';
-        foreach ($this->getResponse()->getHeaders() as $header) {
-            $headers .= $header->getFieldName() .': ' .$header->getFieldValue() .PHP_EOL;
-        }
-        $this->assertContains('http://my.magento.com', $headers);
-        $this->assertContains('\'sha256-H4RRnauTM2X2Xg/z9zkno1crqhsaY3uKKu97uwmnXXE=\'', $headers);
+        $header = $this->getResponse()->getHeader('Content-Security-Policy');
+        $this->assertNotEmpty($header);
+        $this->assertContains('http://my.magento.com', $header->getFieldValue());
+        $this->assertContains('\'sha256-H4RRnauTM2X2Xg/z9zkno1crqhsaY3uKKu97uwmnXXE=\'', $header->getFieldValue());
     }
 }

lib/internal/Magento/Framework/HTTP/PhpEnvironment/Response.php

@@ -28,6 +28,9 @@ public function getHeader($name)
         $headers = $this->getHeaders();
         if ($headers->has($name)) {
             $header = $headers->get($name);
+            if (is_iterable($header)) {
+                $header = $header[0];
+            }
         }
         return $header;
     }
@@ -94,8 +97,13 @@ public function clearHeader($name)
     {
         $headers = $this->getHeaders();
         if ($headers->has($name)) {
-            $header = $headers->get($name);
-            $headers->removeHeader($header);
+            $headerValues = $headers->get($name);
+            if (!is_iterable($headerValues)) {
+                $headerValues = [$headerValues];
+            }
+            foreach ($headerValues as $headerValue) {
+                $headers->removeHeader($headerValue);
+            }
         }
 
         return $this;