content_security_policy

func PatchCspConnectSrcWithHostSrc ¶

func PatchCspConnectSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)

func PatchCspFrameSrcWithHostSrc ¶

func PatchCspFrameSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)

func PatchCspImageSrc ¶

func PatchCspImageSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, urls ...*url.URL)

func PatchCspSourceDirective ¶

func PatchCspSourceDirective[T any, PT sourceDirectivePointer[T]](
	contentSecurityPolicy *csp.ContentSecurityPolicy,
	sources ...csp.SourceI,
)

PatchCspSourceDirective merges sources into the source directive of type T, deduplicating by serialized value. If the policy has no directive of that type one is created and appended; otherwise the existing directive is extended in place. If a directive with the same name is present but is not of type T (e.g. an unparsed fallback), the policy is left untouched.

T is the concrete source-directive type; the pointer type is inferred. For example, to allow a blob: Worker:

PatchCspSourceDirective[csp.WorkerSrcDirective](
	policy,
	&csp.KeywordSource{Keyword: "self"},
	&csp.SchemeSource{Scheme: "blob"},
)

func PatchCspStyleSrcWithHash ¶

func PatchCspStyleSrcWithHash(contentSecurityPolicy *csp.ContentSecurityPolicy, values ...string) error

func PatchCspStyleSrcWithNonce ¶

func PatchCspStyleSrcWithNonce(contentSecurityPolicy *csp.ContentSecurityPolicy, nonces ...string)