blob: f5a2161570ebff1bb8d37c57df9b385b565bcce3 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
|
"use strict";
class CSP {
build(...directives) {
return directives.join(';');
}
buildBlocker(...types) {
return this.build(...(types.map(type => `${type.name || type}-src ${type.value || "'none'"}`)));
}
blocks(header, type) {
return `;${header};`.includes(`;${type}-src 'none';`)
}
asHeader(value) {
return {name: CSP.headerName, value};
}
}
CSP.isEmbedType = type => /\b(?:application|video|audio)\b/.test(type) && type !== "application/xhtml+xml";
CSP.headerName = "content-security-policy";
CSP.patchDataURI = (uri, blocker) => {
let parts = /^data:(?:[^,;]*ml)(;[^,]*)?,/i.exec(uri);
if (!(blocker && parts)) {
// not an interesting data: URI, return as it is
return uri;
}
if (parts[1]) {
// extra encoding info, let's bailout (better safe than sorry)
return "data:";
}
// It's a HTML/XML page, let's prepend our CSP blocker to the document
let patch = parts[0] + encodeURIComponent(
`<meta http-equiv="${CSP.headerName}" content="${blocker}">`);
return uri.startsWith(patch) ? uri : patch + uri.substring(parts[0].length);
}
|