|
1 | 1 | import Vapor |
| 2 | +import Foundation |
2 | 3 |
|
3 | 4 | public struct ContentSecurityPolicyConfiguration: SecurityHeaderConfiguration { |
4 | | - |
5 | 5 | private let value: String |
6 | 6 |
|
7 | 7 | public init(value: String) { |
8 | 8 | self.value = value |
9 | 9 | } |
10 | 10 |
|
| 11 | + public init(value: ContentSecurityPolicy) { |
| 12 | + self.value = value.value |
| 13 | + } |
| 14 | + |
11 | 15 | func setHeader(on response: Response, from request: Request) { |
12 | 16 | if let requestCSP = request.contentSecurityPolicy { |
13 | 17 | response.http.headers.replaceOrAdd(name: .contentSecurityPolicy, value: requestCSP.value) |
@@ -38,3 +42,174 @@ extension Request { |
38 | 42 | } |
39 | 43 | } |
40 | 44 | } |
| 45 | + |
| 46 | +public struct CSPReportTo: Codable { |
| 47 | + private let group: String? |
| 48 | + private let max_age: Int |
| 49 | + private let endpoints: [CSPReportToEndpoint] |
| 50 | + private let include_subdomains: Bool? |
| 51 | + |
| 52 | + public init(group: String? = nil, max_age: Int, |
| 53 | + endpoints: [CSPReportToEndpoint], include_subdomains: Bool? = nil) { |
| 54 | + self.group = group |
| 55 | + self.max_age = max_age |
| 56 | + self.endpoints = endpoints |
| 57 | + self.include_subdomains = include_subdomains |
| 58 | + } |
| 59 | +} |
| 60 | + |
| 61 | +public struct CSPReportToEndpoint: Codable { |
| 62 | + private let url: String |
| 63 | + |
| 64 | + public init(url: String) { |
| 65 | + self.url = url |
| 66 | + } |
| 67 | +} |
| 68 | + |
| 69 | +extension CSPReportToEndpoint: Equatable { |
| 70 | + public static func == (lhs: CSPReportToEndpoint, rhs: CSPReportToEndpoint) -> Bool { |
| 71 | + return lhs.url == rhs.url |
| 72 | + } |
| 73 | +} |
| 74 | + |
| 75 | +extension CSPReportTo: Equatable { |
| 76 | + public static func == (lhs: CSPReportTo, rhs: CSPReportTo) -> Bool { |
| 77 | + return lhs.group == rhs.group && |
| 78 | + lhs.max_age == rhs.max_age && |
| 79 | + lhs.endpoints == rhs.endpoints && |
| 80 | + lhs.include_subdomains == rhs.include_subdomains |
| 81 | + } |
| 82 | +} |
| 83 | + |
| 84 | +public struct CSPKeywords { |
| 85 | + public static let all = "*" |
| 86 | + public static let none = "'none'" |
| 87 | + public static let `self` = "'self'" |
| 88 | + public static let strictDynamic = "'strict-dynamic'" |
| 89 | + public static let unsafeEval = "'unsafe-eval'" |
| 90 | + public static let unsafeHashedAttributes = "'unsafe-hashed-attributes'" |
| 91 | + public static let unsafeInline = "'unsafe-inline'" |
| 92 | +} |
| 93 | + |
| 94 | +public class ContentSecurityPolicy { |
| 95 | + private var policy: [String] = [] |
| 96 | + |
| 97 | + var value: String { |
| 98 | + return policy.joined(separator: "; ") |
| 99 | + } |
| 100 | + |
| 101 | + public func set(value: String) -> ContentSecurityPolicy { |
| 102 | + policy.append(value) |
| 103 | + return self |
| 104 | + } |
| 105 | + |
| 106 | + public func baseUri(sources: String...) -> ContentSecurityPolicy { |
| 107 | + policy.append("base-uri \(sources.joined(separator: " "))") |
| 108 | + return self |
| 109 | + } |
| 110 | + |
| 111 | + public func blockAllMixedContent() -> ContentSecurityPolicy { |
| 112 | + policy.append("block-all-mixed-content") |
| 113 | + return self |
| 114 | + } |
| 115 | + |
| 116 | + public func connectSrc(sources: String...) -> ContentSecurityPolicy { |
| 117 | + policy.append("connect-src \(sources.joined(separator: " "))") |
| 118 | + return self |
| 119 | + } |
| 120 | + |
| 121 | + public func defaultSrc(sources: String...) -> ContentSecurityPolicy { |
| 122 | + policy.append("default-src \(sources.joined(separator: " "))") |
| 123 | + return self |
| 124 | + } |
| 125 | + |
| 126 | + public func fontSrc(sources: String...) -> ContentSecurityPolicy { |
| 127 | + policy.append("font-src \(sources.joined(separator: " "))") |
| 128 | + return self |
| 129 | + } |
| 130 | + |
| 131 | + public func formAction(sources: String...) -> ContentSecurityPolicy { |
| 132 | + policy.append("form-action \(sources.joined(separator: " "))") |
| 133 | + return self |
| 134 | + } |
| 135 | + |
| 136 | + public func frameAncestors(sources: String...) -> ContentSecurityPolicy { |
| 137 | + policy.append("frame-ancestors \(sources.joined(separator: " "))") |
| 138 | + return self |
| 139 | + } |
| 140 | + |
| 141 | + public func frameSrc(sources: String...) -> ContentSecurityPolicy { |
| 142 | + policy.append("frame-src \(sources.joined(separator: " "))") |
| 143 | + return self |
| 144 | + } |
| 145 | + |
| 146 | + public func imgSrc(sources: String...) -> ContentSecurityPolicy { |
| 147 | + policy.append("img-src \(sources.joined(separator: " "))") |
| 148 | + return self |
| 149 | + } |
| 150 | + |
| 151 | + public func manifestSrc(sources: String...) -> ContentSecurityPolicy { |
| 152 | + policy.append("manifest-src \(sources.joined(separator: " "))") |
| 153 | + return self |
| 154 | + } |
| 155 | + |
| 156 | + public func mediaSrc(sources: String...) -> ContentSecurityPolicy { |
| 157 | + policy.append("media-src \(sources.joined(separator: " "))") |
| 158 | + return self |
| 159 | + } |
| 160 | + |
| 161 | + public func objectSrc(sources: String...) -> ContentSecurityPolicy { |
| 162 | + policy.append("object-src \(sources.joined(separator: " "))") |
| 163 | + return self |
| 164 | + } |
| 165 | + |
| 166 | + public func pluginTypes(types: String...) -> ContentSecurityPolicy { |
| 167 | + policy.append("plugin-types \(types.joined(separator: " "))") |
| 168 | + return self |
| 169 | + } |
| 170 | + |
| 171 | + public func requireSriFor(values: String...) -> ContentSecurityPolicy { |
| 172 | + policy.append("require-sri-for \(values.joined(separator: " "))") |
| 173 | + return self |
| 174 | + } |
| 175 | + |
| 176 | + public func reportTo(reportToObject: CSPReportTo) -> ContentSecurityPolicy { |
| 177 | + let encoder = JSONEncoder() |
| 178 | + guard let data = try? encoder.encode(reportToObject) else { return self } |
| 179 | + guard let jsonString = String(data: data, encoding: .utf8) else { return self } |
| 180 | + policy.append("report-to \(String(describing: jsonString))") |
| 181 | + return self |
| 182 | + } |
| 183 | + |
| 184 | + public func reportUri(uri: String) -> ContentSecurityPolicy { |
| 185 | + policy.append("report-uri \(uri)") |
| 186 | + return self |
| 187 | + } |
| 188 | + |
| 189 | + public func sandbox(values: String...) -> ContentSecurityPolicy { |
| 190 | + policy.append("sandbox \(values.joined(separator: " "))") |
| 191 | + return self |
| 192 | + } |
| 193 | + |
| 194 | + public func scriptSrc(sources: String...) -> ContentSecurityPolicy { |
| 195 | + policy.append("script-src \(sources.joined(separator: " "))") |
| 196 | + return self |
| 197 | + } |
| 198 | + |
| 199 | + public func styleSrc(sources: String...) -> ContentSecurityPolicy { |
| 200 | + policy.append("style-src \(sources.joined(separator: " "))") |
| 201 | + return self |
| 202 | + } |
| 203 | + |
| 204 | + public func upgradeInsecureRequests() -> ContentSecurityPolicy { |
| 205 | + policy.append("upgrade-insecure-requests") |
| 206 | + return self |
| 207 | + } |
| 208 | + |
| 209 | + public func workerSrc(sources: String...) -> ContentSecurityPolicy { |
| 210 | + policy.append("worker-src \(sources.joined(separator: " "))") |
| 211 | + return self |
| 212 | + } |
| 213 | + |
| 214 | + public init() {} |
| 215 | +} |
0 commit comments