Feature: Improved 'Permissions-Policy' broad checks.

Author: rfc-st

humble.py

@@ -878,6 +878,23 @@ def csp_print_details(csp_values, csp_title, csp_desc, csp_refs):
     print_detail(f'{csp_refs}')
 
 
+def permissions_analyze_content(perm_header, i_cnt):
+    perm_broad_dir = [
+        dir.split('=')[0].strip() for dir in perm_header.split(',')
+        if any(broadp in dir.split('=')[1].strip() for broadp in t_per_broad)]
+    if perm_broad_dir:
+        permissions_print_broad(perm_broad_dir, i_cnt)
+
+
+def permissions_print_broad(perm_broad_dir, i_cnt):
+    print_detail_r('[ifpol_h]', is_red=True)
+    if not args.brief:
+        print_detail_l('[icsp_s]' if len(perm_broad_dir) > 1 else '[icsp_si]')
+        print(f" {', '.join(f"'{dir}'" for dir in perm_broad_dir)}.")
+        print_detail('[ifpol]', num_lines=2)
+    i_cnt[0] += 1
+
+
 def delete_lines(reliable=True):
     if not reliable:
         sys.stdout.write(DELETED_LINES)
@@ -2257,6 +2274,7 @@ def custom_help_formatter(prog):
 
 # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy
 # https://github.com/w3c/webappsec-permissions-policy/blob/main/features.md
+t_per_broad = ('*', ' * ')
 t_per_dep = ('document-domain', 'window-placement')
 t_per_ft = ('accelerometer', 'all-screens-capture', 'ambient-light-sensor',
             'attribution-reporting', 'autoplay', 'battery', 'bluetooth',
@@ -2604,8 +2622,7 @@ def custom_help_formatter(prog):
     perm_header = headers_l['permissions-policy']
     if not any(elem in perm_header for elem in t_per_ft):
         print_details('[ifpoln_h]', '[ifpoln]', 'm', i_cnt)
-    if '*' in perm_header:
-        print_details('[ifpol_h]', '[ifpol]', 'd', i_cnt)
+    permissions_analyze_content(perm_header, i_cnt)
     if 'none' in perm_header:
         print_details('[ifpoli_h]', '[ifpoli]', 'd', i_cnt)
     if any(elem in perm_header for elem in t_per_dep):

l10n/details.txt

@@ -1070,7 +1070,7 @@ HTTP Response Headers
  Ref: https://csplite.com/fp/
 
 [ifpol]
- The value '(*)' allows the feature in this document and iframes, regardless of their origin.
+ '*' allows the directive in any source, regardless of their origin.
  Ref: https://developer.chrome.com/en/docs/privacy-sandbox/permissions-policy/
 
 [ifpoli]

l10n/details_es.txt

@@ -1075,7 +1075,7 @@ Cabeceras de respuesta HTTP
  Ref: https://csplite.com/fp/
 
 [ifpol]
- El valor '(*)' permite el uso de la funcionalidad independientemente de su origen.
+ '*' permite la directiva en cualquier fuente, independientemente de su origen.
  Ref: https://developer.chrome.com/en/docs/privacy-sandbox/permissions-policy/
 
 [ifpoli]