All files / lib buildCSPHeaders.js

75% Statements 21/28
62.5% Branches 15/24
100% Functions 6/6
74.07% Lines 20/27

Press n or j to go to the next uncovered block, b, p or k for the previous block.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99  1x     1x             60x     1x       4x   4x         4x                                   4x                             4x 48x         4x           4x 2x         4x 2x 6x 6x             4x 4x           12x          
// Local imports
const crunchHeaderValue = require('./crunchHeaderValue.js')
 
 
const devDirectives = {
	'connect-src': ['webpack://*'],
	'script-src': ["'unsafe-eval'"],
	'style-src': ["'unsafe-inline'"],
}
 
function getCSPDirective(value, defaultValue) {
	return [value || defaultValue].flat()
}
 
module.exports = function buildCSPHeaders(options = {}) {
	const {
		contentSecurityPolicy = {},
		isDev,
	} = options
 
	Iif (contentSecurityPolicy === false) {
		return []
	}
 
	// Content Security Policy
	const directives = {
		'base-uri': getCSPDirective(contentSecurityPolicy['base-uri'], "'none'"),
		'child-src': getCSPDirective(contentSecurityPolicy['child-src'], "'none'"),
		'connect-src': getCSPDirective(contentSecurityPolicy['connect-src'], "'self'"),
		'default-src': getCSPDirective(contentSecurityPolicy['default-src'], "'self'"),
		'font-src': getCSPDirective(contentSecurityPolicy['font-src'], "'self'"),
		'form-action': getCSPDirective(contentSecurityPolicy['form-action'], "'self'"),
		'frame-ancestors': getCSPDirective(contentSecurityPolicy['frame-ancestors'], "'none'"),
		'frame-src': getCSPDirective(contentSecurityPolicy['frame-src'], "'none'"),
		'img-src': getCSPDirective(contentSecurityPolicy['img-src'], "'self'"),
		'manifest-src': getCSPDirective(contentSecurityPolicy['manifest-src'], "'self'"),
		'object-src': getCSPDirective(contentSecurityPolicy['object-src'], "'none'"),
		'prefetch-src': getCSPDirective(contentSecurityPolicy['prefetch-src'], "'self'"),
		'script-src': getCSPDirective(contentSecurityPolicy['script-src'], "'self'"),
		'style-src': getCSPDirective(contentSecurityPolicy['style-src'], "'self'"),
		'worker-src': getCSPDirective(contentSecurityPolicy['worker-src'], "'self'"),
	}
 
	const optionalDirectives = [
		'block-all-mixed-content',
		'plugin-types',
		'navigate-to',
		'require-sri-for',
		'require-trusted-types-for',
		'sandbox',
		'script-src-attr',
		'script-src-elem',
		'style-src-attr',
		'style-src-elem',
		'trusted-types',
		'upgrade-insecure-requests',
	]
 
	optionalDirectives.forEach(optionalDirective => {
		Iif (contentSecurityPolicy[optionalDirective]) {
			directives[optionalDirective] = getCSPDirective(contentSecurityPolicy[optionalDirective])
		}
	})
 
	Iif (contentSecurityPolicy['report-to'] || contentSecurityPolicy['report-uri']) {
		const reportDirectiveValue = getCSPDirective(contentSecurityPolicy['report-to'] || contentSecurityPolicy['report-uri'])
		directives['report-uri'] = reportDirectiveValue
		directives['report-to'] = reportDirectiveValue
	}
 
	Object.entries(contentSecurityPolicy).forEach(([key, value]) => {
		Iif (value === false) {
			delete directives[key]
		}
	})
 
	if (isDev) {
		Object.entries(devDirectives).forEach(([key, value]) => {
			Eif (directives[key]) {
				directives[key] = directives[key].concat(value)
			} else {
				directives[key] = [...value]
			}
		})
	}
 
	const cspString = crunchHeaderValue(directives)
	const cspHeaderNames = [
		`Content-Security-Policy${contentSecurityPolicy.reportOnly ? '-Report-Only' : ''}`,
		`X-Content-Security-Policy${contentSecurityPolicy.reportOnly ? '-Report-Only' : ''}`,
		'X-WebKit-CSP',
	]
 
	return cspHeaderNames.map(headerName => ({
		key: headerName,
		value: cspString,
	}))
}