PR: https://github.com/mantisbt/mantisbt/pull/2178

Example usage for Viz.js

File graphviz_api.php:

...
require_api( 'utility_api.php' );

# Viz.js WebAssembly CSP headers
http_csp_add( 'script-src', "'wasm-unsafe-eval'" );
http_csp_emit_header();

# Include Viz.js
if( config_get_global( 'cdn_enabled' ) == ON ) {
    require_js( [ 'src' => 'https://cdn.jsdelivr.net/npm/@viz-js/viz@' . VIZJS_VERSION . '/dist/viz-global.min.js', 'integrity' => VIZJS_HASH ] );
} else {
    require_js( [ 'src' => helper_mantis_url( 'js/viz-global.min.js' ), 'integrity' => VIZJS_HASH ] );
}

/**
 * Base class for graph creation and manipulation.
 *
 * Generates undirected graphs are generated.
 * For directed graphs, use {@see Digraph} class.
 */
class Graph {
...

File manage_config_workflow_graph_page.php:

...
define( 'MANTIS_DEFERRED_HEADERS', true );

require_once( 'core.php' );
require_api( 'graphviz_api.php' );
...

Why isn't MANTIS_DEFERRED_HEADERS enabled by default for all pages? In MantisBT, a dozen pages silently assume that loading core.php causes headers to be output. That's not counting plugins.

@raspopov Great minds think alike... This is the review comment for the http_csp_add() call in PR 2175 I drafted yesterday but forgot to send...

To minimize the exposure and potential security risk, don't you think we should only allow this for the few pages where GraphViz is actually used and not for every single MantisBT script ?

I realize this may not be as easy as it seems to implement, since http_all_headers() is called from core.

I reworked the PR and managed to avoid adding global constants. Now, PHP can handle all the header work. The main thing is to make sure that CSP headers can be overwritten.

The PR was split into two parts. This one introduces convenient work with CSP headers, and the second one improves the require_js() and require_css() functions: 0036874.