diff options
Diffstat (limited to 'src/lib')
-rw-r--r-- | src/lib/CSP.js | 15 |
1 files changed, 15 insertions, 0 deletions
diff --git a/src/lib/CSP.js b/src/lib/CSP.js index 666f4a1..f5a2161 100644 --- a/src/lib/CSP.js +++ b/src/lib/CSP.js @@ -21,3 +21,18 @@ class CSP { CSP.isEmbedType = type => /\b(?:application|video|audio)\b/.test(type) && type !== "application/xhtml+xml"; CSP.headerName = "content-security-policy"; +CSP.patchDataURI = (uri, blocker) => { + let parts = /^data:(?:[^,;]*ml)(;[^,]*)?,/i.exec(uri); + if (!(blocker && parts)) { + // not an interesting data: URI, return as it is + return uri; + } + if (parts[1]) { + // extra encoding info, let's bailout (better safe than sorry) + return "data:"; + } + // It's a HTML/XML page, let's prepend our CSP blocker to the document + let patch = parts[0] + encodeURIComponent( + `<meta http-equiv="${CSP.headerName}" content="${blocker}">`); + return uri.startsWith(patch) ? uri : patch + uri.substring(parts[0].length); +} |