Crate content_security_policy
source ·Expand description
Parse and validate Web Content-Security-Policy level 3
Example
extern crate content_security_policy;
use content_security_policy::*;
fn main() {
let csp_list = CspList::parse("script-src *.notriddle.com", PolicySource::Header, PolicyDisposition::Enforce);
let (check_result, _) = csp_list.should_request_be_blocked(&Request {
url: Url::parse("https://www.notriddle.com/script.js").unwrap(),
origin: Origin::Tuple("https".to_string(), url::Host::Domain("notriddle.com".to_owned()), 443),
redirect_count: 0,
destination: Destination::Script,
initiator: Initiator::None,
nonce: String::new(),
integrity_metadata: String::new(),
parser_metadata: ParserMetadata::None,
});
assert_eq!(check_result, CheckResult::Allowed);
let (check_result, _) = csp_list.should_request_be_blocked(&Request {
url: Url::parse("https://www.evil.example/script.js").unwrap(),
origin: Origin::Tuple("https".to_string(), url::Host::Domain("notriddle.com".to_owned()), 443),
redirect_count: 0,
destination: Destination::Script,
initiator: Initiator::None,
nonce: String::new(),
integrity_metadata: String::new(),
parser_metadata: ParserMetadata::None,
});
assert_eq!(check_result, CheckResult::Blocked);
}
Re-exports
pub extern crate percent_encoding;
pub extern crate url;
Modules
Structs
- https://www.w3.org/TR/CSP/#csp-list
- https://www.w3.org/TR/CSP/#directives
- https://www.w3.org/TR/SRI/#integrity-metadata
- A single parsed content security policy.
- request to be validated
- response to be validated
- A parsed URL record.
- violation information
Enums
- Many algorithms are allowed to return either “Allowed” or “Blocked”. The spec describes these as strings.
- The valid values for type are “script”, “script attribute”, “style”, and “style attribute”.
- https://www.w3.org/TR/CSP/#match-element-to-source-list
- The origin of an URL
- https://www.w3.org/TR/CSP/#policy-disposition
- https://www.w3.org/TR/CSP/#policy-source
- https://www.w3.org/TR/SRI/#parse-metadata
- https://www.w3.org/TR/CSP/#does-request-violate-policy
- violation information
Functions
- https://www.w3.org/TR/SRI/#parse-metadata