Software: Apache/2.4.41 (Ubuntu). PHP/8.0.30 

uname -a: Linux apirnd 5.4.0-204-generic #224-Ubuntu SMP Thu Dec 5 13:38:28 UTC 2024 x86_64 

uid=33(www-data) gid=33(www-data) groups=33(www-data) 

Safe-mode: OFF (not secure)

/usr/local/lib/node_modules/wonlog/node_modules/lusca/lib/   drwxr-xr-x
Free 13.15 GB of 57.97 GB (22.68%)
                            Encoder    Tools    Proc.    FTP brute    Sec.    SQL    PHP-code    Update    Self remove    Logout    

Viewing file:     csp.js (2.61 KB)      -rw-r--r--

'use strict';

/**
 * Content Security Policy (CSP)
 * https://www.owasp.org/index.php/Content_Security_Policy
 * @param {Object} options The CSP policy.
 */
module.exports = function (options) {
    var policyRules = options && options.policy,
        isReportOnly = options && options.reportOnly,
        reportUri = options && options.reportUri,
        styleNonce = options && options.styleNonce,
        scriptNonce = options && options.scriptNonce,
        value, name;

    name = 'content-security-policy';

    if (isReportOnly) {
        name += '-report-only';
    }

    if (policyRules && policyRules["default-src"]) {
        if (styleNonce && !policyRules["style-src"]) {
            policyRules["style-src"] = policyRules["default-src"];
        }
        
        if (scriptNonce && !policyRules["script-src"]) {
            policyRules["script-src"] = policyRules["default-src"];
        }
    }

    value = createPolicyString(policyRules);

    if (reportUri) {
        if (value !== '') {
            value += '; ';
        }
        value += 'report-uri ' + reportUri;
    }

    return function csp(req, res, next) {
        if (styleNonce) {
            var styleMatch = value.match(/style-src 'nonce-.{48}'/);
            if (styleMatch) {
                value = value.replace(styleMatch[0], 'style-src \'nonce-' + res.locals.nonce + '\'');
            }
            else {
                value = value.replace('style-src', 'style-src \'nonce-' + res.locals.nonce + '\'');
            }
        }
        if (scriptNonce) {
            var scriptMatch = value.match(/script-src 'nonce-.{48}'/);
            if (scriptMatch) {
                value = value.replace(scriptMatch[0], 'script-src \'nonce-' + res.locals.nonce + '\'');
            }
            else {
                value = value.replace('script-src', 'script-src \'nonce-' + res.locals.nonce + '\'');
            }
        }
        res.header(name, value);
        next();
    };
};

var createPolicyString = module.exports.createPolicyString = function (policy) {
    var entries;

    if (typeof policy === 'string') {
        return policy;
    }

    if (Array.isArray(policy)) {
        return policy.map(createPolicyString).join('; ');
    }

    if (typeof policy === 'object' && policy !== null) {
        entries = Object.keys(policy).map(function (directive) {
            if (policy[directive] === 0 || policy[directive]) {
                directive += ' ' + policy[directive];
            }
            return directive;
        });

        return createPolicyString(entries);
    }

    throw Error('invalid csp policy - must be array, string, or plain object');
};