process-datadog-csp-reports.php

<?php

/*	
 * Place a ddhq.csv file in the same directory.  This file is the export of CSP reports from DataDog	
 * Run this file	
 * This file will spit out the violated directive, site host, blocked host, blocked uri, and site uri	
 * However, it will limit it to one row per blocked host for brevity	
 */

$ddhq = fopen('ddhq.csv', 'r');
$result = fopen('csp-report.csv', 'w');
fputcsv($result, ['Type', 'Host', 'Blocked Domain', 'Blocked URI', 'Host Domain', 'Source File']);

$loggedHosts = [];

while($row = fgetcsv($ddhq)) {
    try {
        $data = json_decode($row[3], true, 512, JSON_THROW_ON_ERROR);
    } catch (Throwable) {
        continue;
    }

    if (!isset($data['csp-report']['blocked-uri_details']['host'])) {
        // No host - often chrome-extension
        continue;
    }
    $host = $data['csp-report']['blocked-uri_details']['host'];
    if (isset($loggedHosts[$host])) {
        continue;
    }
    $loggedHosts[$host] = true;

    fputcsv($result, [
        $data['csp-report']['violated-directive'] ?? '',
        $data['csp-report']['document-uri_details']['host'] ?? '',
        $host ?? '',
        $data['csp-report']['blocked-uri'] ?? '',
        $data['csp-report']['document-uri'] ?? '',
        $data['csp-report']['source-file'] ?? '',
    ]);
}

fclose($ddhq);
fclose($result);