mirror of
https://github.com/vale981/tridactyl
synced 2025-03-10 20:56:37 -04:00
47 lines
2 KiB
TypeScript
47 lines
2 KiB
TypeScript
|
export function addurltocsp(response){
|
||
|
|
let headers = response["responseHeaders"]
|
||
|
|
let cspind = headers.findIndex(header => header.name == "Content-Security-Policy")
|
||
|
|
// if it's found
|
||
|
|
if (cspind > -1) {
|
||
|
|
|
||
|
|
// Split the csp header up so we can manage it individually.
|
||
|
|
let csparr = [headers[cspind]["value"].split("; ")][0]
|
||
|
|
|
||
|
|
// TODO: this was part of an attempt to add the extension to the allowed csp,
|
||
|
|
// never worked properly.
|
||
|
|
// Extension URL
|
||
|
|
//let ext_url = browser.extension.getURL("./").slice(0,-1)
|
||
|
|
|
||
|
|
// Lets clobber CSP
|
||
|
|
let i = 0;
|
||
|
|
for (i = 0; i < csparr.length; i++) {
|
||
|
|
// Add 'unsafe-inline' as a directive since we
|
||
|
|
if (csparr[i].indexOf("style-src") > -1) {
|
||
|
|
if (csparr[i].indexOf("'self'") > -1) {
|
||
|
|
csparr[i] = csparr[i].replace("'self'","'self' 'unsafe-inline'")
|
||
|
|
}
|
||
|
|
}
|
||
|
|
// Remove the element if it's a sandbox directive
|
||
|
|
if (csparr[i] === "sandbox") {
|
||
|
|
csparr.splice(i,1)
|
||
|
|
}
|
||
|
|
}
|
||
|
|
// Join the header up after clobberin'
|
||
|
|
headers[cspind]["value"] = csparr.join("; ")
|
||
|
|
}
|
||
|
|
// min version FF57
|
||
|
|
// headers is an array of objects with name, value
|
||
|
|
// name: content-security-policy
|
||
|
|
// example value: "style-src 'self'; report-uri https://sentry.mafiasi.de/api/15/csp-report/?sentry_key=30c7c96fda184c3981f2ee5aa7cf8fa9; default-src 'self'; script-src 'self' sentry.mafiasi.de 'nonce-GQTbfotsa2WChjMo' 'nonce-SnTfBGzkDF5ABVyG' 'nonce-04f00A0OQnOBQv5Q'; img-src 'self' data:"
|
||
|
|
|
||
|
|
// want to add ourselves to list of allowed scripts
|
||
|
|
|
||
|
|
// can be async and return promise - check whether that helps
|
||
|
|
|
||
|
|
// not very typescripty - this is a blockingResponse containing httpHeaders
|
||
|
|
return {responseHeaders: headers}
|
||
|
|
}
|
||
|
|
|
||
|
|
browser.webRequest.onHeadersReceived.addListener(addurltocsp,{urls:["<all_urls>"], types:["main_frame"]},["blocking","responseHeaders"])
|
||
|
|
// csp tends to be in method GET and type "main_frame"
|