Crate csp_parse 

A pure-Rust parser for the Content Security Policy (CSP) directive grammar.

Phases 02-05 (see plan/): the generic top-level split (policy-list -> policy -> directive name/raw value), the serialized-source-list value grammar, and the CSP3 directive registry are implemented so far.

Structs

Directive

A single directive within a policy: a name and an optional raw value (CSP3 §2.3, serialized-directive).

HashExpression

A parsed hash-algorithm "-" base64-value pair.

HostSource

A parsed host-source (CSP3 §2.3.1).

Policy

A single serialized CSP policy: an ordered list of directives (CSP3 §2.2, serialized-policy).

PolicyList

A parsed list of CSP policies, as found in a Content-Security-Policy HTTP header (a comma-separated list of serialized-policy, CSP3 §2.2).

SourceListEntry

A single whitespace-separated token from a SourceList::Sources list, together with its recognized SourceExpression (if any).

Enums

DirectiveStatus

Whether a registered directive is CSP3-current or deprecated.

DirectiveValue

A directive’s value, interpreted according to its registered ValueGrammar (or DirectiveValue::Unknown if the directive name isn’t in the registry).

HashAlgorithm

One of the three hash algorithms CSP3 recognizes (hash-algorithm).

HostPart

A parsed host-part (CSP3 §2.3.1).

Keyword

All keyword-source values (CSP3 §2.3.1). See plan/03-source-list-grammar.md: this list was pulled from an automated spec fetch, not verified character-for-character against the current spec text – re-check before treating it as exhaustive.

PortPart

A parsed port-part (CSP3 §2.3.1). Kept as a digit string rather than a numeric type: the ABNF (1*DIGIT) does not bound the value to a valid 16-bit port number, and this crate does not normalize.

SourceExpression

One recognized source-expression alternative (CSP3 §2.3.1).

SourceList

A parsed serialized-source-list (CSP3 §2.3.1).

ValueGrammar

Which value grammar a directive’s raw value should be parsed with.

Functions

ancestor_source_list_is_valid

Whether list only contains expressions valid in frame-ancestors’ restricted ancestor-source-list: scheme-source, host-source, and 'self' – unlike a regular source-list, no 'unsafe-inline' (or any other keyword), no nonce-source, no hash-source. Unrecognized entries (expression: None) also make the list invalid.

parse_hash_expression

Parses hash-algorithm "-" base64-value (CSP3 §2.3.1) from input, without CSP’s surrounding '...' quotes – callers parsing a hash-source token strip the quotes first and pass the inner string here; callers parsing an SRI integrity="" hash token pass it as-is.

parse_policy_list

Parses a serialized CSP or comma-separated CSP list (as sent in the Content-Security-Policy HTTP header) into a PolicyList.

parse_source_list

Parses a directive’s raw value as a serialized-source-list.

registry_lookup

Looks up a directive name in the CSP3 directive registry. ASCII-case-insensitive, per CSP3’s directive-name matching rule (see plan/02-directive-splitting.md). Returns None for unregistered names – per CSP3’s forward-compatibility design, that is not itself a syntax error (see plan/DECISIONS.md, 2026-08-22).