First commit

.gitignore

@@ -0,0 +1,7 @@
+._*
+.~lock.*
+phpunit.xml
+tmp/
+vendor/
+build/
+/.idea/

.phpunit.result.cache

@@ -0,0 +1 @@
+C:37:"PHPUnit\Runner\DefaultTestResultCache":4001:{a:2:{s:7:"defects";a:1:{s:68:"ZfrCorsTest\Service\CorsServiceTest::testEnsureVaryHeaderForNoOrigin";i:6;}s:5:"times";a:42:{s:64:"ZfrCorsTest\Factory\CorsOptionsFactoryTest::testCanCreateOptions";d:0.039;s:84:"ZfrCorsTest\Factory\CorsRequestListenerFactoryTest::testCanCreateCorsRequestListener";d:0.005;s:68:"ZfrCorsTest\Factory\CorsServiceFactoryTest::testCanCreateCorsService";d:0.002;s:37:"ZfrCorsTest\ModuleTest::testGetConfig";d:0.002;s:63:"ZfrCorsTest\ModuleTest::testAssertListenerIsCorrectlyRegistered";d:0.028;s:51:"ZfrCorsTest\Mvc\CorsRequestListenerTest::testAttach";d:0.001;s:75:"ZfrCorsTest\Mvc\CorsRequestListenerTest::testReturnNothingForNonCorsRequest";d:0.005;s:93:"ZfrCorsTest\Mvc\CorsRequestListenerTest::testImmediatelyReturnResponseForPreflightCorsRequest";d:0.012;s:88:"ZfrCorsTest\Mvc\CorsRequestListenerTest::testReturnNothingForNormalAuthorizedCorsRequest";d:0.001;s:103:"ZfrCorsTest\Mvc\CorsRequestListenerTest::testReturnUnauthorizedResponseForNormalUnauthorizedCorsRequest";d:0.006;s:107:"ZfrCorsTest\Mvc\CorsRequestListenerTest::testImmediatelyReturnBadRequestResponseForInvalidOriginHeaderValue";d:0.003;s:91:"ZfrCorsTest\Mvc\CorsRequestListenerTest::testOnCorsRequestCanHandleInvalidOriginHeaderValue";d:0;s:75:"ZfrCorsTest\Mvc\CorsRequestListenerTest::testPreflightWorksWithMethodRoutes";d:0.005;s:71:"ZfrCorsTest\Options\CorsOptionsTest::testCorsOptionsAreSecuredByDefault";d:0;s:57:"ZfrCorsTest\Options\CorsOptionsTest::testCanModifyOptions";d:0;s:61:"ZfrCorsTest\Options\CorsOptionsTest::testNormalizeHttpMethods";d:0;s:61:"ZfrCorsTest\Service\CorsServiceTest::testCanDetectCorsRequest";d:0.001;s:75:"ZfrCorsTest\Service\CorsServiceTest::testIsNotCorsRequestIfNotACrossRequest";d:0.001;s:66:"ZfrCorsTest\Service\CorsServiceTest::testCanDetectPreflightRequest";d:0.001;s:72:"ZfrCorsTest\Service\CorsServiceTest::testProperlyCreatePreflightResponse";d:0.002;s:81:"ZfrCorsTest\Service\CorsServiceTest::testDoesNotAddAllowCredentialsHeadersIfAsked";d:0.001;s:69:"ZfrCorsTest\Service\CorsServiceTest::testCanReturnWildCardAllowOrigin";d:0.001;s:78:"ZfrCorsTest\Service\CorsServiceTest::testCanReturnWildCardSubDomainAllowOrigin";d:0.001;s:88:"ZfrCorsTest\Service\CorsServiceTest::testCanReturnWildCardSubDomainWithSchemeAllowOrigin";d:0.001;s:88:"ZfrCorsTest\Service\CorsServiceTest::testReturnNullForMissMatchedWildcardSubDomainOrigin";d:0.001;s:89:"ZfrCorsTest\Service\CorsServiceTest::testReturnNullForRootDomainOnWildcardSubDomainOrigin";d:0.001;s:94:"ZfrCorsTest\Service\CorsServiceTest::testReturnNullForDifferentSchemeOnWildcardSubDomainOrigin";d:0.001;s:67:"ZfrCorsTest\Service\CorsServiceTest::testReturnNullForUnknownOrigin";d:0.001;s:68:"ZfrCorsTest\Service\CorsServiceTest::testEnsureVaryHeaderForNoOrigin";d:0.002;s:79:"ZfrCorsTest\Service\CorsServiceTest::testEnsureNoVaryHeaderWhenAcceptsAnyOrigin";d:0;s:69:"ZfrCorsTest\Service\CorsServiceTest::testCanPopulateNormalCorsRequest";d:0.001;s:78:"ZfrCorsTest\Service\CorsServiceTest::testRefuseNormalCorsRequestIfUnauthorized";d:0.001;s:69:"ZfrCorsTest\Service\CorsServiceTest::testAddVaryHeaderInNormalRequest";d:0.001;s:72:"ZfrCorsTest\Service\CorsServiceTest::testAppendVaryHeaderInNormalRequest";d:0.001;s:83:"ZfrCorsTest\Service\CorsServiceTest::testPopulatesAllowCredentialsNormalCorsRequest";d:0.001;s:89:"ZfrCorsTest\Service\CorsServiceTest::testCanDetectCorsRequestFromSameHostButDifferentPort";d:0.001;s:91:"ZfrCorsTest\Service\CorsServiceTest::testCanDetectCorsRequestFromSameHostButDifferentScheme";d:0.001;s:72:"ZfrCorsTest\Service\CorsServiceTest::testCanHandleUnconfiguredRouteMatch";d:0.001;s:70:"ZfrCorsTest\Service\CorsServiceTest::testCanHandleConfiguredRouteMatch";d:0.001;s:84:"ZfrCorsTest\Service\CorsServiceTest::testDoesNotCrashApplicationOnInvalidOriginValue";d:0.001;s:83:"ZfrCorsTest\Service\CorsServiceTest::testCanPopulateNormalCorsRequestWithRouteMatch";d:0.001;s:99:"ZfrCorsTest\Service\CorsServiceTest::testCanPopulateNormalCorsRequestWithRouteMatchRewriteException";d:0.001;}}}

.scrutinizer.yml

@@ -0,0 +1,38 @@
+before_commands:
+    - "composer install --dev --prefer-source"
+
+tools:
+    php_code_coverage:
+        enabled: true
+        test_command: ./vendor/bin/phpunit -c phpunit.xml.dist --group=Coverage
+    php_code_sniffer:
+        enabled: true
+        config:
+            standard: PSR2
+        filter:
+            paths: ["src/*", "tests/*"]
+    php_cpd:
+        enabled: true
+        excluded_dirs: ["build/*", "tests", "vendor"]
+    php_cs_fixer:
+        enabled: true
+        config:
+            level: all
+        filter:
+            paths: ["src/*", "tests/*"]
+    php_loc:
+        enabled: true
+        excluded_dirs: ["build", "tests", "vendor"]
+    php_mess_detector:
+        enabled: true
+        filter:
+            paths: ["src/*"]
+    php_pdepend:
+        enabled: true
+        excluded_dirs: ["build", "tests", "vendor"]
+    php_analyzer: true
+    php_analyzer:
+        filter:
+            paths: ["src/*", "tests/*"]
+    sensiolabs_security_checker: true
+

.travis.yml

@@ -0,0 +1,64 @@
+sudo: false
+
+language: php
+
+cache:
+  directories:
+    - $HOME/.composer/cache
+    - vendor
+
+env:
+  global:
+    - COMPOSER_ARGS="--no-interaction"
+
+matrix:
+  fast_finish: true
+  include:
+    - php: 7.1
+      env:
+        - DEPS=lowest
+    - php: 7.1
+      env:
+        - DEPS=latest
+        - TEST_COVERAGE=true
+    - php: 7.2
+      env:
+        - DEPS=lowest
+    - php: 7.2
+      env:
+        - DEPS=latest
+    - php: 7.3
+      env:
+        - DEPS=lowest
+    - php: 7.3
+      env:
+        - DEPS=latest
+        - CS_CHECK=true
+    - php: 7.4
+      env:
+        - DEPS=lowest
+    - php: 7.4
+      env:
+        - DEPS=latest
+
+before_install:
+  - if [[ $TEST_COVERAGE != 'true' ]]; then phpenv config-rm xdebug.ini || return 0 ; fi
+  - travis_retry composer self-update
+
+install:
+  - if [[ $DEPS == 'latest' ]]; then travis_retry composer update $COMPOSER_ARGS ; fi
+  - if [[ $DEPS == 'lowest' ]]; then travis_retry composer update --prefer-lowest --prefer-stable $COMPOSER_ARGS ; fi
+  - travis_retry composer install $COMPOSER_ARGS
+  - composer show
+
+script:
+  - if [[ $TEST_COVERAGE == 'true' ]]; then composer test-coverage ; fi
+  - if [[ $TEST_COVERAGE != 'true' ]]; then composer test ; fi
+  - if [[ $CS_CHECK == 'true' ]]; then composer cs-check ; fi
+
+after_script:
+  - if [[ $TEST_COVERAGE == 'true' ]]; then composer upload-coverage ; fi
+
+notifications:
+  irc: "irc.freenode.org#zftalk.modules"
+  email: false

CHANGELOG.md

@@ -0,0 +1,2 @@
+# CHANGELOG
+

LICENSE

@@ -0,0 +1,20 @@
+The MIT License (MIT)
+
+Copyright (c) 2013 Zfr
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of
+this software and associated documentation files (the "Software"), to deal in
+the Software without restriction, including without limitation the rights to
+use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of
+the Software, and to permit persons to whom the Software is furnished to do so,
+subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS
+FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR
+COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

README.md

@@ -0,0 +1,193 @@
+# LmcCors
+
+> This is work in progress to port ZfcCors to Laminas.
+> Only the latest master branch will be ported.  Older tags will not be copied to this version.
+
+
+
+[![Build Status](https://travis-ci.org/zf-fr/zfr-cors.png?branch=master)](https://travis-ci.org/zf-fr/zfr-cors)
+[![Scrutinizer Quality Score](https://scrutinizer-ci.com/g/zf-fr/zfr-cors/badges/quality-score.png?s=47504d5f5a04f88fb40aebbd524d9d241c2ae588)](https://scrutinizer-ci.com/g/zf-fr/zfr-cors/)
+[![Coverage Status](https://coveralls.io/repos/zf-fr/zfr-cors/badge.png?branch=master)](https://coveralls.io/r/zf-fr/zfr-cors?branch=master)
+[![Latest Stable Version](https://poser.pugx.org/zfr/zfr-cors/v/stable.png)](https://packagist.org/packages/zfr/zfr-cors)
+
+LmcCors is a simple Laminas MVC module that helps you to deal with Cross-Origin Resource Sharing (CORS).
+
+## What is ZfrCors ?
+
+ZfrCors is a Zend Framework 2 module that allow to easily configure your ZF 2 application so that it automatically
+builds HTTP responses that follow the CORS documentation.
+
+### Installation
+
+Install the module by typing (or add it to your `composer.json` file):
+
+```sh
+$ php composer.phar require zfr/zfr-cors
+```
+
+Then, enable it by adding "ZfrCors" in your `application.config.php` file.
+
+By default, ZfrCors is configured to deny every CORS requests. To change that, you need to copy
+the [`config/zfr_cors.global.php.dist`](config/zfr_cors.global.php.dist) file to your `autoload` folder
+(remove the `.dist` extension), and modify it to suit your needs.
+
+## Documentation
+
+### What is CORS ?
+
+CORS is a mechanism that allows to perform cross-origin requests from your browser.
+
+For instance, let's say that your website is hosted in the domain `http://example.com`.
+By default, user agents won't be allowed to perform AJAX requests to another domain for security
+reasons (for instance `http://funny-domain.com`).
+
+With CORS, you can allow your server to reply to such requests.
+
+You can find better documentation on how CORS works on the web:
+
+ * [Mozilla documentation about CORS](https://developer.mozilla.org/en-US/docs/HTTP/Access_control_CORS)
+ * [CORS server flowchart](http://www.html5rocks.com/static/images/cors_server_flowchart.png)
+
+### Event registration
+
+ZfrCors registers the `ZfrCors\Mvc\CorsRequestListener` with the `MvcEvent::EVENT_ROUTE` event, with a priority
+of -1. This means that this listener is executed AFTER the route has been matched.
+
+### Configuring the module
+
+As by default, all the various options are set globally for all routes:
+
+- `allowed_origins`: (array) List of allowed origins. To allow any origin, you can use the wildcard (`*`) character. If
+  multiple origins are specified, ZfrCors will automatically check the `"Origin"` header's value, and only return the
+  allowed domain (if any) in the `"Allow-Access-Control-Origin"` response header. To allow any sub-domain, you can prefix 
+  the domain with the wildcard character (i.e. `*.example.com`). Please note that you don't need to
+  add your host URI (so if your website is hosted as "example.com", "example.com" is automatically allowed.
+- `allowed_methods`: (array) List of allowed HTTP methods. Those methods will be returned for the preflight request to
+  indicate which methods are allowed to the user agent. You can even specify custom HTTP verbs.
+- `allowed_headers`: (array) List of allowed headers that will be returned for the preflight request. This indicates
+  to the user agent which headers are permitted to be sent when doing the actual request.
+- `max_age`: (int) Maximum age (seconds) the preflight request should be cached by the user agent. This prevents the
+  user agent from sending a preflight request for each request.
+- `exposed_headers`: (array) List of response headers that are allowed to be read in the user agent. Please note that
+  some browsers do not implement this feature correctly.
+- `allowed_credentials`: (boolean) If true, it allows the browser to send cookies along with the request.
+
+If you want to configure specific routes, you can add `ZfrCors\Options\CorsOptions::ROUTE_PARAM` to your route configuration:
+
+```php
+<?php
+
+return [
+    'zfr_cors' => [
+        'allowed_origins' => ['*'],
+        'allowed_methods' => ['GET', 'POST', 'DELETE'],
+    ],
+    'router' => [
+        'routes' => [
+            'readOnlyRoute' => [
+                'type' => 'literal',
+                'options' => [
+                    'route' => '/foo/bar',
+                    'defaults' => [
+                        // This will replace allowed_methods configuration to only allow GET requests
+                        // and only allow a specific origin instead of the wildcard origin
+                        ZfrCors\Options\CorsOptions::ROUTE_PARAM => [
+                            'allowed_origins' => ['http://example.org'],
+                            'allowed_methods' => ['GET'],
+                        ],
+                    ],
+                ],
+            ],
+            'someAjaxCalls' => [
+                'type' => 'literal',
+                'options' => [
+                    'route' => '/ajax',
+                    'defaults' => [
+                        // This overrides the wildcard origin
+                        ZfrCors\Options\CorsOptions::ROUTE_PARAM => [
+                            'allowed_origins' => ['http://example.org'],
+                        ],
+                    ],
+                ],
+                'may_terminate' => false,
+                'child_routes' => [
+                    'blog' => [
+                        'type' => 'literal',
+                        'options' => [
+                            'route' => '/blogpost',
+                            'defaults' => [
+                                // This would only allow `http://example.org` to GET this route
+                                \ZfrCors\Options\CorsOptions::ROUTE_PARAM => [
+                                    'allowed_methods' => ['GET'],
+                                ],
+                            ],
+                        ],
+                        'may_terminate' => true,
+                        'child_routes' => [
+                            'delete' => [
+                                'type' => 'segment',
+                                'options' => [
+                                    'route' => ':id',
+                                    // This would only allow origin `http://example.org` to apply DELETE on this route
+                                    'defaults' => [
+                                        \ZfrCors\Options\CorsOptions::ROUTE_PARAM => [
+                                            'allowed_methods' => ['DELETE'],
+                                        ],
+                                    ],
+                                ],
+                            ],
+                        ],
+                    ],
+                ],
+            ],
+        ],
+    ],
+];
+```
+
+### Preflight request
+
+If ZfrCors detects a preflight CORS request, a new HTTP response will be created, and ZfrCors will send the appropriate
+headers according to your configuration. The response will be always sent with a 200 status code (OK).
+
+Please note that this will also prevent further MVC steps from being executed, since all subsequent MVC steps are
+skipped till `Zend\Mvc\MvcEvent::EVENT_FINISH`, which is responsible for actually sending the response.
+
+### Actual request
+
+When an actual request is made, ZfrCors first checks it the origin is allowed. If it is not, then a new response with
+a 403 status code (Forbidden) is created and sent.
+
+Please note that this will also prevent further MVC steps from being executed, since all subsequent MVC steps are
+skipped till `Zend\Mvc\MvcEvent::EVENT_FINISH`, which is responsible for actually sending the response.
+
+If the origin is allowed, ZfrCors will just add the appropriate headers to the request produced by `Zend\Mvc`.
+
+### Security concerns
+
+Don't use this module to secure your application! You must use a proper authorization module, like
+[BjyAuthorize](https://github.com/bjyoungblood/BjyAuthorize), [ZfcRbac](https://github.com/ZF-Commons/ZfcRbac) or
+[SpiffyAuthorize](https://github.com/spiffyjr/spiffy-authorize).
+
+ZfrCors only allows to accept or refuse a cross-origin request.
+
+### Custom schemes
+
+Internally, ZfrCors uses `Zend\Uri\UriFactory` class. If you are using custom schemes (for instance if you are
+testing your API with some Google Chrome extensions), you need to add support for those schemes by adding them to
+the `UriFactory` config (please [refer to the doc](http://framework.zend.com/manual/2.2/en/modules/zend.uri.html#creating-a-new-custom-class-uri)).
+
+### Example
+To register the `chrome-extension` custom scheme in your API, simply add:
+
+```php
+UriFactory::registerScheme('chrome-extension', 'Zend\Uri\Uri');
+```
+
+to the `onBootstrap()` method in `module/Application/Module.php`. Do note that, if your IDE doesn't resolve this automatically, you should add the following `use` definition to the same file: 
+
+```php
+use Zend\Uri\UriFactory;
+```
+
+Registering the `chrome-extension` custom scheme like this allows you to use Google Chrome extensions for testing your API.