Press n or j to go to the next uncovered block, b, p or k for the previous block.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 | 1x 1x 60x 1x 4x 4x 4x 4x 4x 48x 4x 4x 2x 4x 2x 6x 6x 4x 4x 12x | // Local imports const crunchHeaderValue = require('./crunchHeaderValue.js') const devDirectives = { 'connect-src': ['webpack://*'], 'script-src': ["'unsafe-eval'"], 'style-src': ["'unsafe-inline'"], } function getCSPDirective(value, defaultValue) { return [value || defaultValue].flat() } module.exports = function buildCSPHeaders(options = {}) { const { contentSecurityPolicy = {}, isDev, } = options Iif (contentSecurityPolicy === false) { return [] } // Content Security Policy const directives = { 'base-uri': getCSPDirective(contentSecurityPolicy['base-uri'], "'none'"), 'child-src': getCSPDirective(contentSecurityPolicy['child-src'], "'none'"), 'connect-src': getCSPDirective(contentSecurityPolicy['connect-src'], "'self'"), 'default-src': getCSPDirective(contentSecurityPolicy['default-src'], "'self'"), 'font-src': getCSPDirective(contentSecurityPolicy['font-src'], "'self'"), 'form-action': getCSPDirective(contentSecurityPolicy['form-action'], "'self'"), 'frame-ancestors': getCSPDirective(contentSecurityPolicy['frame-ancestors'], "'none'"), 'frame-src': getCSPDirective(contentSecurityPolicy['frame-src'], "'none'"), 'img-src': getCSPDirective(contentSecurityPolicy['img-src'], "'self'"), 'manifest-src': getCSPDirective(contentSecurityPolicy['manifest-src'], "'self'"), 'object-src': getCSPDirective(contentSecurityPolicy['object-src'], "'none'"), 'prefetch-src': getCSPDirective(contentSecurityPolicy['prefetch-src'], "'self'"), 'script-src': getCSPDirective(contentSecurityPolicy['script-src'], "'self'"), 'style-src': getCSPDirective(contentSecurityPolicy['style-src'], "'self'"), 'worker-src': getCSPDirective(contentSecurityPolicy['worker-src'], "'self'"), } const optionalDirectives = [ 'block-all-mixed-content', 'plugin-types', 'navigate-to', 'require-sri-for', 'require-trusted-types-for', 'sandbox', 'script-src-attr', 'script-src-elem', 'style-src-attr', 'style-src-elem', 'trusted-types', 'upgrade-insecure-requests', ] optionalDirectives.forEach(optionalDirective => { Iif (contentSecurityPolicy[optionalDirective]) { directives[optionalDirective] = getCSPDirective(contentSecurityPolicy[optionalDirective]) } }) Iif (contentSecurityPolicy['report-to'] || contentSecurityPolicy['report-uri']) { const reportDirectiveValue = getCSPDirective(contentSecurityPolicy['report-to'] || contentSecurityPolicy['report-uri']) directives['report-uri'] = reportDirectiveValue directives['report-to'] = reportDirectiveValue } Object.entries(contentSecurityPolicy).forEach(([key, value]) => { Iif (value === false) { delete directives[key] } }) if (isDev) { Object.entries(devDirectives).forEach(([key, value]) => { Eif (directives[key]) { directives[key] = directives[key].concat(value) } else { directives[key] = [...value] } }) } const cspString = crunchHeaderValue(directives) const cspHeaderNames = [ `Content-Security-Policy${contentSecurityPolicy.reportOnly ? '-Report-Only' : ''}`, `X-Content-Security-Policy${contentSecurityPolicy.reportOnly ? '-Report-Only' : ''}`, 'X-WebKit-CSP', ] return cspHeaderNames.map(headerName => ({ key: headerName, value: cspString, })) } |