Class: Shugoi::Csp

Inherits:
Object
  • Object
show all
Defined in:
lib/shugoi/csp.rb

Constant Summary collapse

SHUGOI_ORIGIN = 
"https://shugoi.com".freeze

Class Method Summary collapse

Class Method Details

.build(site_key:, api_origin: nil, extra_directives: {}, split_render: true) ⇒ Object 



17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
 
# File 'lib/shugoi/csp.rb', line 17

def self.build(site_key:, api_origin: nil, extra_directives: {}, split_render: true)
  _ = site_key
  _ = split_render
  api = [SHUGOI_ORIGIN, api_origin].compact.uniq
  merged = {
    "default-src" => ["'self'"],
    "script-src" => ["'self'", "'unsafe-inline'", *api],
    "connect-src" => ["'self'", *api],
    "style-src" => ["'self'", "'unsafe-inline'", *api],
    "font-src" => ["'self'", *api, "data:"],
    "img-src" => ["'self'", *api, "data:", "blob:"],
    "frame-ancestors" => ["'self'"],
    "object-src" => ["'none'"],
    "base-uri" => ["'self'"],
    "form-action" => ["'self'"]
  }
  extra_directives.each do |key, values|
    merged[key] = ((merged[key] || []) + Array(values)).uniq
  end
  merged.map { |k, v| "#{k} #{v.join(' ')}" }.join("; ")
end

.merge(existing, added) ⇒ Object 



39
40
41
42
43
44
45
46
47
48
49
 
# File 'lib/shugoi/csp.rb', line 39

def self.merge(existing, added)
  return added if existing.to_s.empty?
  base = parse(existing)
  parse(added).each do |k, set|
    base[k] = (base[k] || Set.new) | set
  end
  base.each do |k, set|
    base[k] = Set.new(["'none'"]) if set.include?("'none'") && set.size > 1
  end
  base.map { |k, v| "#{k} #{v.to_a.join(' ')}" }.join("; ")
end

.origin_of(base_url) ⇒ Object 



6
7
8
9
10
11
12
13
14
15
 
# File 'lib/shugoi/csp.rb', line 6

def self.origin_of(base_url)
  return nil if base_url.to_s.empty?
  u = URI.parse(base_url)
  return nil unless %w[http https].include?(u.scheme)
  origin = "#{u.scheme}://#{u.host}"
  origin += ":#{u.port}" if u.port && u.port != u.default_port
  origin
rescue URI::InvalidURIError
  nil
end

.parse(csp) ⇒ Object 



51
52
53
54
55
56
57
58
59
 
# File 'lib/shugoi/csp.rb', line 51

def self.parse(csp)
  out = {}
  csp.to_s.split(";").each do |part|
    name, *vals = part.strip.split(/\s+/)
    next if name.nil? || name.empty?
    out[name] = (out[name] || Set.new) | vals
  end
  out
end