Method Clean

pkg/webui/csp.go:56–90

Clean de-duplicates and removes empty entries from the policy.

()

// Clean de-duplicates and removes empty entries from the policy.
func (csp ContentSecurityPolicy) Clean() ContentSecurityPolicy {
	cleanDirective := func(contents []string) []string {
		added := map[string]struct{}{}
		cleanContents := []string{}
		for _, entry := range contents {
			if entry == "" || strings.HasPrefix(entry, "/") {
				continue // Skip empty and relative locations.
			}
			if strings.HasPrefix(entry, "http://") || strings.HasPrefix(entry, "https://") {
				if parsed, err := url.Parse(entry); err == nil {
					entry = parsed.Host
				}
			}
			if strings.HasPrefix(entry, "ws://") || strings.HasPrefix(entry, "wss://") {
				if parsed, err := url.Parse(entry); err == nil {
					parsed.Path, parsed.RawPath = "", ""
					entry = parsed.String()
				}
			}
			if _, ok := added[entry]; ok {
				continue // Skip already added locations.
			}
			added[entry] = struct{}{}
			cleanContents = append(cleanContents, entry)
		}
		return cleanContents
	}
	derived := csp
	derived.ConnectionSource = cleanDirective(csp.ConnectionSource)
	derived.StyleSource = cleanDirective(csp.StyleSource)
	derived.ScriptSource = cleanDirective(csp.ScriptSource)
	derived.BaseURI = cleanDirective(csp.BaseURI)
	derived.FrameAncestors = cleanDirective(csp.FrameAncestors)
	return derived
}

// Merge merges the provided policies into the existing one.
func (csp ContentSecurityPolicy) Merge(others ...ContentSecurityPolicy) ContentSecurityPolicy {