Initial QSfera import

Server/vendor/github.com/unrolled/secure/cspbuilder/builder.go

@@ -0,0 +1,121 @@
+package cspbuilder
+
+import (
+	"sort"
+	"strings"
+)
+
+const (
+	// Fetch Directives.
+	ChildSrc      = "child-src"
+	ConnectSrc    = "connect-src"
+	DefaultSrc    = "default-src"
+	FontSrc       = "font-src"
+	FrameSrc      = "frame-src"
+	ImgSrc        = "img-src"
+	ManifestSrc   = "manifest-src"
+	MediaSrc      = "media-src"
+	ObjectSrc     = "object-src"
+	PrefetchSrc   = "prefetch-src"
+	ScriptSrc     = "script-src"
+	ScriptSrcAttr = "script-src-attr"
+	ScriptSrcElem = "script-src-elem"
+	StyleSrc      = "style-src"
+	StyleSrcAttr  = "style-src-attr"
+	StyleSrcElem  = "style-src-elem"
+	WorkerSrc     = "worker-src"
+
+	// Document Directives.
+	BaseURI = "base-uri"
+	Sandbox = "sandbox"
+
+	// Navigation directives.
+	FormAction     = "form-action"
+	FrameAncestors = "frame-ancestors"
+	NavigateTo     = "navigate-to"
+
+	// Reporting directives.
+	ReportURI = "report-uri"
+	ReportTo  = "report-to"
+
+	// Other directives.
+	RequireTrustedTypesFor  = "require-trusted-types-for"
+	TrustedTypes            = "trusted-types"
+	UpgradeInsecureRequests = "upgrade-insecure-requests"
+)
+
+type Builder struct {
+	Directives map[string]([]string)
+}
+
+// MustBuild is like Build but panics if an error occurs.
+func (builder *Builder) MustBuild() string {
+	policy, err := builder.Build()
+	if err != nil {
+		panic(err)
+	}
+
+	return policy
+}
+
+// Build creates a content security policy string from the specified directives.
+// If any directive contains invalid values, an error is returned instead.
+func (builder *Builder) Build() (string, error) {
+	var sb strings.Builder
+
+	// Pull the directive keys out.
+	directiveKeys := []string{}
+	for key := range builder.Directives {
+		directiveKeys = append(directiveKeys, key)
+	}
+
+	// Sort the policies: https://www.w3.org/TR/CSP3/#framework-policy
+	sort.Strings(directiveKeys)
+
+	for _, directive := range directiveKeys {
+		if sb.Len() > 0 {
+			sb.WriteString("; ")
+		}
+
+		switch directive {
+		case Sandbox:
+			err := buildDirectiveSandbox(&sb, builder.Directives[directive])
+			if err != nil {
+				return "", err
+			}
+		case FrameAncestors:
+			err := buildDirectiveFrameAncestors(&sb, builder.Directives[directive])
+			if err != nil {
+				return "", err
+			}
+		case ReportTo:
+			err := buildDirectiveReportTo(&sb, builder.Directives[directive])
+			if err != nil {
+				return "", err
+			}
+		case RequireTrustedTypesFor:
+			err := buildDirectiveRequireTrustedTypesFor(&sb, builder.Directives[directive])
+			if err != nil {
+				return "", err
+			}
+		case TrustedTypes:
+			err := buildDirectiveTrustedTypes(&sb, builder.Directives[directive])
+			if err != nil {
+				return "", err
+			}
+		case UpgradeInsecureRequests:
+			err := buildDirectiveUpgradeInsecureRequests(&sb, builder.Directives[directive])
+			if err != nil {
+				return "", err
+			}
+		default:
+			// no special handling of directive values needed
+			err := buildDirectiveDefault(&sb, directive, builder.Directives[directive])
+			if err != nil {
+				return "", err
+			}
+		}
+	}
+
+	return sb.String(), nil
+}