Documentation
¶
Index ¶
- Variables
- func PatchCspConnectSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)
- func PatchCspFrameSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)
- func PatchCspImageSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, urls ...*url.URL)
- func PatchCspSourceDirective[T any, PT sourceDirectivePointer[T]](contentSecurityPolicy *csp.ContentSecurityPolicy, sources ...csp.SourceI)
- func PatchCspStyleSrcWithHash(contentSecurityPolicy *csp.ContentSecurityPolicy, values ...string) error
- func PatchCspStyleSrcWithKeyword(contentSecurityPolicy *csp.ContentSecurityPolicy, keywords ...string)
- func PatchCspStyleSrcWithNonce(contentSecurityPolicy *csp.ContentSecurityPolicy, nonces ...string)
- func PatchCspTrustedTypes(contentSecurityPolicy *csp.ContentSecurityPolicy, policies ...string)
Constants ¶
This section is empty.
Variables ¶
var ChromeXmlViewerStyleHashes = []string{
"sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=",
"sha256-p08VBe6m5i8+qtXWjnH/AN3klt1l4uoOLsjNn8BjdQo=",
"sha256-FP2rLIq2SXli/a2p8OSS/CTcCw1LqqWUbEfuSDVBWxc=",
}
ChromeXmlViewerStyleHashes are the styles Chrome's XML viewer applies to the document tree it renders an XML response as. They are the bodies of style elements, which a hash source matches as it is. The first is the empty body the viewer inserts the element with, before it is filled.
Chrome edits that stylesheet from one version to the next, and a body that no longer matches is blocked -- so a version's hash is added here rather than replacing the one before it, the older ones being what an older Chrome still applies. The last is what Chrome 152 applies; the one before it, what the versions before that did.
var EdgePdfViewerStyleHashes = []string{
"sha256-YBgjA+VjFtAXSIPo7m2n1vE7Z2+4KoNTMJRNxrNV1iE=",
"sha256-tbWZ4NP1341cpcrZVDn7B3o9bt/muXgduILAnC0Zbaw=",
}
EdgePdfViewerStyleHashes are the styles Edge's PDF viewer applies to the document it renders a PDF response in. They are style attributes, which a hash source matches only where 'unsafe-hashes' is permitted with it.
Functions ¶
func PatchCspConnectSrcWithHostSrc ¶
func PatchCspConnectSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)
func PatchCspFrameSrcWithHostSrc ¶
func PatchCspFrameSrcWithHostSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, hostUrls ...*url.URL)
func PatchCspImageSrc ¶
func PatchCspImageSrc(contentSecurityPolicy *csp.ContentSecurityPolicy, urls ...*url.URL)
func PatchCspSourceDirective ¶
func PatchCspSourceDirective[T any, PT sourceDirectivePointer[T]]( contentSecurityPolicy *csp.ContentSecurityPolicy, sources ...csp.SourceI, )
PatchCspSourceDirective merges sources into the source directive of type T, deduplicating by serialized value. If the policy has no directive of that type one is created and appended; otherwise the existing directive is extended in place. If a directive with the same name is present but is not of type T (e.g. an unparsed fallback), the policy is left untouched.
T is the concrete source-directive type; the pointer type is inferred. For example, to allow a blob: Worker:
PatchCspSourceDirective[csp.WorkerSrcDirective](
policy,
&csp.KeywordSource{Keyword: "self"},
&csp.SchemeSource{Scheme: "blob"},
)
func PatchCspStyleSrcWithHash ¶
func PatchCspStyleSrcWithHash(contentSecurityPolicy *csp.ContentSecurityPolicy, values ...string) error
func PatchCspStyleSrcWithKeyword ¶
func PatchCspStyleSrcWithKeyword(contentSecurityPolicy *csp.ContentSecurityPolicy, keywords ...string)
PatchCspStyleSrcWithKeyword merges the keyword sources into style-src, deduplicating by serialized value.
func PatchCspStyleSrcWithNonce ¶
func PatchCspStyleSrcWithNonce(contentSecurityPolicy *csp.ContentSecurityPolicy, nonces ...string)
func PatchCspTrustedTypes ¶
func PatchCspTrustedTypes(contentSecurityPolicy *csp.ContentSecurityPolicy, policies ...string)
PatchCspTrustedTypes requires the named trusted types policies of the scripts the document runs: the policies are merged into trusted-types, and require-trusted-types-for is ensured for the script sink group, which is what makes the requirement take effect rather than merely be stated.
Types ¶
This section is empty.
Source Files