fileoverview author lwe google license import * as csp from '../csp' ; import { Csp , Keyword } from '../csp' ; import { Finding , Severity , Type } from '../finding' ; param parsedCsp export function checkUnknownDirective ( parsedCsp ) { const findings = [ ] ; for ( const directive of Object . keys ( parsedCsp . directives ) ) { if ( csp . isDirective ( directive ) ) { continue ; } if ( directive . endsWith ( ':' ) ) { findings . push ( new Finding ( Type . UNKNOWN_DIRECTIVE , 'CSP directives don\'t end with a colon.' , Severity . SYNTAX , directive ) ) ; } else { findings . push ( new Finding ( Type . UNKNOWN_DIRECTIVE , 'Directive "' + directive + '" is not a known CSP directive.' , Severity . SYNTAX , directive ) ) ; } } return findings ; } param parsedCsp export function checkMissingSemicolon ( parsedCsp ) { const findings = [ ] ; for ( const [ directive , directiveValues ] of Object . entries ( parsedCsp . directives ) ) { if ( directiveValues === undefined ) { continue ; } for ( const value of directiveValues ) { if ( csp . isDirective ( value ) ) { findings . push ( new Finding ( Type . MISSING_SEMICOLON , 'Did you forget the semicolon? ' + '"' + value + '" seems to be a directive, not a value.' , Severity . SYNTAX , directive , value ) ) ; } } } return findings ; } param parsedCsp export function checkInvalidKeyword ( parsedCsp ) { const findings = [ ] ; const keywordsNoTicks = Object . values ( Keyword ) . map ( ( k ) => k . replace ( /'/g , '' ) ) ; for ( const [ directive , directiveValues ] of Object . entries ( parsedCsp . directives ) ) { if ( directiveValues === undefined ) { continue ; } for ( const value of directiveValues ) { if ( keywordsNoTicks . some ( ( k ) => k === value ) || value . startsWith ( 'nonce-' ) || value . match ( /^(sha256|sha384|sha512)-/ ) ) { findings . push ( new Finding ( Type . INVALID_KEYWORD , 'Did you forget to surround "' + value + '" with single-ticks?' , Severity . SYNTAX , directive , value ) ) ; continue ; } if ( ! value . startsWith ( '\'' ) ) { continue ; } if ( directive === csp . Directive . REQUIRE_TRUSTED_TYPES_FOR ) { if ( value === csp . TrustedTypesSink . SCRIPT ) { continue ; } } else if ( directive === csp . Directive . TRUSTED_TYPES ) { if ( value === '\'allow-duplicates\'' || value === '\'none\'' ) { continue ; } } else { if ( csp . isKeyword ( value ) || csp . isHash ( value ) || csp . isNonce ( value ) ) { continue ; } } findings . push ( new Finding ( Type . INVALID_KEYWORD , value + ' seems to be an invalid CSP keyword.' , Severity . SYNTAX , directive , value ) ) ; } } return findings ; }