Documentation
¶
Index ¶
- Variables
- func PatchCspConnectSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)
- func PatchCspFrameSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)
- func PatchCspImageSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, urls ...*url.URL)
- func PatchCspSourceDirective[T any, PT sourceDirectivePointer[T]](contentSecurityPolicy *csp.ContentSecurityPolicy, sources ...csp.SourceI)
- func PatchCspStyleSrcWithHash(contentSecurityPolicy *csp.ContentSecurityPolicy, values ...string) error
- func PatchCspStyleSrcWithKeyword(contentSecurityPolicy *csp.ContentSecurityPolicy, keywords ...string)
- func PatchCspStyleSrcWithNonce(contentSecurityPolicy *csp.ContentSecurityPolicy, nonces ...string)
- func PatchCspTrustedTypes(contentSecurityPolicy *csp.ContentSecurityPolicy, policies ...string)
Constants ¶
This section is empty.
Variables ¶
var ChromeXmlViewerStyleHashes = []string{
"sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=",
"sha256-p08VBe6m5i8+qtXWjnH/AN3klt1l4uoOLsjNn8BjdQo=",
}
ChromeXmlViewerStyleHashes are the styles Chrome's XML viewer applies to the document tree it renders an XML response as. They are the bodies of style elements, which a hash source matches as it is.
var EdgePdfViewerStyleHashes = []string{
"sha256-YBgjA+VjFtAXSIPo7m2n1vE7Z2+4KoNTMJRNxrNV1iE=",
"sha256-tbWZ4NP1341cpcrZVDn7B3o9bt/muXgduILAnC0Zbaw=",
}
EdgePdfViewerStyleHashes are the styles Edge's PDF viewer applies to the document it renders a PDF response in. They are style attributes, which a hash source matches only where 'unsafe-hashes' is permitted with it.
Functions ¶
func PatchCspConnectSrcWithHostSrc ¶
func PatchCspConnectSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)
func PatchCspFrameSrcWithHostSrc ¶
func PatchCspFrameSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)
func PatchCspImageSrc ¶
func PatchCspImageSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, urls ...*url.URL)
func PatchCspSourceDirective ¶
func PatchCspSourceDirective[T any, PT sourceDirectivePointer[T]]( contentSecurityPolicy *csp.ContentSecurityPolicy, sources ...csp.SourceI, )
PatchCspSourceDirective merges sources into the source directive of type T, deduplicating by serialized value. If the policy has no directive of that type one is created and appended; otherwise the existing directive is extended in place. If a directive with the same name is present but is not of type T (e.g. an unparsed fallback), the policy is left untouched.
T is the concrete source-directive type; the pointer type is inferred. For example, to allow a blob: Worker:
PatchCspSourceDirective[csp.WorkerSrcDirective](
policy,
&csp.KeywordSource{Keyword: "self"},
&csp.SchemeSource{Scheme: "blob"},
)
func PatchCspStyleSrcWithHash ¶
func PatchCspStyleSrcWithHash(contentSecurityPolicy *csp.ContentSecurityPolicy, values ...string) error
func PatchCspStyleSrcWithKeyword ¶ added in v1.16.0
func PatchCspStyleSrcWithKeyword(contentSecurityPolicy *csp.ContentSecurityPolicy, keywords ...string)
PatchCspStyleSrcWithKeyword merges the keyword sources into style-src, deduplicating by serialized value.
func PatchCspStyleSrcWithNonce ¶
func PatchCspStyleSrcWithNonce(contentSecurityPolicy *csp.ContentSecurityPolicy, nonces ...string)
func PatchCspTrustedTypes ¶ added in v1.16.0
func PatchCspTrustedTypes(contentSecurityPolicy *csp.ContentSecurityPolicy, policies ...string)
PatchCspTrustedTypes requires the named trusted types policies of the scripts the document runs: the policies are merged into trusted-types, and require-trusted-types-for is ensured for the script sink group, which is what makes the requirement take effect rather than merely be stated.
Types ¶
This section is empty.
Source Files