summaryrefslogtreecommitdiff
path: root/src/lib
diff options
context:
space:
mode:
Diffstat (limited to 'src/lib')
-rw-r--r--src/lib/CSP.js15
1 files changed, 15 insertions, 0 deletions
diff --git a/src/lib/CSP.js b/src/lib/CSP.js
index 666f4a1..f5a2161 100644
--- a/src/lib/CSP.js
+++ b/src/lib/CSP.js
@@ -21,3 +21,18 @@ class CSP {
CSP.isEmbedType = type => /\b(?:application|video|audio)\b/.test(type) && type !== "application/xhtml+xml";
CSP.headerName = "content-security-policy";
+CSP.patchDataURI = (uri, blocker) => {
+ let parts = /^data:(?:[^,;]*ml)(;[^,]*)?,/i.exec(uri);
+ if (!(blocker && parts)) {
+ // not an interesting data: URI, return as it is
+ return uri;
+ }
+ if (parts[1]) {
+ // extra encoding info, let's bailout (better safe than sorry)
+ return "data:";
+ }
+ // It's a HTML/XML page, let's prepend our CSP blocker to the document
+ let patch = parts[0] + encodeURIComponent(
+ `<meta http-equiv="${CSP.headerName}" content="${blocker}">`);
+ return uri.startsWith(patch) ? uri : patch + uri.substring(parts[0].length);
+}