File Coverage

blib/lib/Mojolicious/Plugin/CSPHeader.pm

Criterion	Covered	Total	%
statement	15	33	45.4
branch	3	18	16.6
condition	0	3	0.0
subroutine	3	3	100.0
pod	1	1	100.0
total	22	58	37.9

package Mojolicious::Plugin::CSPHeader;
use Mojo::Base 'Mojolicious::Plugin';

our $VERSION = '0.05';

sub register {
    my ($self, $app, $conf) = @_;

    my @directives   = qw/base-uri block-all-mixed-content connect-src default-src font-src form-action frame-ancestors frame-src img-src manifest-src media-src object-src plugin-types report-to sandbox script-src strict-dynamic style-src upgrade-insecure-requests worker-src/;
    my @deprecated   = qw/child-src referrer report-uri/;
    my @experimental = qw/disown-opener navigation-to report-sample require-sri-for/;

    for my $key (@deprecated) {
        $app->log->info("You're using a deprecated CSP directive: $key") if $conf->{directives}->{$key};
    }
    for my $key (@experimental) {
        $app->log->info("You're using an experimental CSP directive: $key") if $conf->{directives}->{$key};
    }

    $app->hook(before_dispatch => sub {
        my $c = shift;

        if ($conf->{csp}) {
            return $c->res->headers->content_security_policy($conf->{csp});
        }

        if ($conf->{directives} || $conf->{extra}) {
            my @csp;
            for my $key (@directives, @deprecated, @experimental) {
                if ($conf->{directives}->{$key}) {
                    if (ref($conf->{directives}->{$key}) eq 'HASH') {
                        my $value = $conf->{directives}->{$key}->{base};
                        if ($conf->{directives}->{$key}->{ws}) {
                            my $url = $c->req->url->to_abs
                                         ->path('/')
                                         ->scheme(($c->req->url->protocol =~ m/https|wss/) ? 'wss' : 'ws')
                                         ->to_string;
                            $url =~ s#/$##;
                            $value .= ' '.$url;
                        }
                        push @csp, "$key ".$value;
                    } else {
                        push @csp, "$key ".$conf->{directives}->{$key};
                    }
                }
            }

            if ($conf->{extra}) {
                for my $key (keys %{$conf->{extra}}) {
                    push @csp, "$key ".$conf->{extra}->{$key};
                }
            }

            my $csp_header = join('; ', @csp);

            return $c->res->headers->content_security_policy($csp_header);
        }
    });
}

1;
__END__