Transform paragonie/csp-builder to bepsvpt/csp-builder

composer.json

@@ -12,14 +12,14 @@
   ],
   "require": {
     "php": "^7.0",
+    "bepsvpt/csp-builder": "1.0.*",
     "illuminate/support": "^5.1",
-    "paragonie/csp-builder": "^2.0",
     "paragonie/hpkp-builder": "^0.1"
   },
   "require-dev": {
-    "codeclimate/php-test-reporter": "^0.4",
-    "orchestra/testbench": "^3.4",
-    "phpunit/phpunit": "^5.7"
+    "codeclimate/php-test-reporter": "0.4.*",
+    "orchestra/testbench": "3.4.*",
+    "phpunit/phpunit": "5.7.*"
   },
   "autoload": {
     "psr-4": {

src/SecureHeaders.php

@@ -3,7 +3,7 @@
 namespace Bepsvpt\SecureHeaders;
 
 use InvalidArgumentException;
-use ParagonIE\CSPBuilder\CSPBuilder;
+use Bepsvpt\CSPBuilder\CSPBuilder;
 use ParagonIE\HPKPBuilder\HPKPBuilder;
 use RuntimeException;
 
@@ -119,11 +119,10 @@ protected function csp()
         $csp = new CSPBuilder($this->config['csp']);
 
         if (! ($this->config['csp']['https-transform-on-https-connections'] ?? true)) {
-            /* @todo wait for upstream package releasing new version */
-            // $csp = $csp->disableHttpsTransformOnHttpsConnections();
+            $csp = $csp->disableHttpTransformOnHttpsConnection();
         }
 
-        return $csp->getHeaderArray(false);
+        return $csp->getHeaderArray();
     }
 
     /**

tests/SecureHeadersTest.php

@@ -92,4 +92,25 @@ public function test_hsts()
             'Strict-Transport-Security' => 'max-age=15552000; preload; includeSubDomains;',
         ], $headers, true);
     }
+
+    public function test_disable_https_transform()
+    {
+        $_SERVER['HTTPS'] = 'on';
+
+        $config = require $this->configPath;
+
+        $config['csp']['form-action']['allow'][] = 'http://example.com';
+
+        $headers = (new SecureHeaders($config))->headers();
+
+        $this->assertContains('https://example.com', $headers['Content-Security-Policy']);
+        $this->assertNotContains('http://example.com', $headers['Content-Security-Policy']);
+
+        $config['csp']['https-transform-on-https-connections'] = false;
+
+        $headers = (new SecureHeaders($config))->headers();
+
+        $this->assertContains('http://example.com', $headers['Content-Security-Policy']);
+        $this->assertNotContains('https://example.com', $headers['Content-Security-Policy']);
+    }
 }