CspPolicy extends Policy { public String getPolicyForUri(String uri) { Collection<String[]> grants = super.getGrants(uri, null, null); Map<String, Set<String>> directives = new HashMap<>(); for (String[] grant : grants) { String directiveName = grant[1]; String[] directiveNames; if (directiveName.equals("default-src")) { directiveNames = DIRECTIVE_NAMES; } else { directiveNames = new String[] { directiveName }; } for (String name : directiveNames) { Set<String> values = directives.get(name); if (values == null) { values = new HashSet<String>(); directives.put(name, values); } values.add(grant[2]); } } StringBuilder sb = new StringBuilder(); for (String directiveName : DIRECTIVE_NAMES) { Set<String> directiveValues = directives.get(directiveName); if (directiveValues == null || directiveValues.size() == 0) { sb.append(directiveName).append(' ').append("'none'"); } else { List<String> sortedValues = new ArrayList<String>(directiveValues); Collections.sort(sortedValues); sb.append(directiveName); for (String value : sortedValues) { sb.append(' ').append(value); } } sb.append("; "); } sb.setLength(sb.length()-2); return sb.toString(); }  @Override String getName(); @Override FactMetaData getRootFactMetaData(); String getPolicyForUri(String uri); void logViolation(URI documentUri, String directive, String blockedHost);  }
@Test public void testGetPolicyForUri() throws IOException { JSONObject jsonPolicy = new JSONObject() .put("/a/b/**", new JSONObject() .put("default-src", new JSONObject() .put("a.b.c.com", new JSONObject()) ) .put("script-src", new JSONObject() .put("'self'", new JSONObject()) .put("b.c.com", new JSONObject()) ) .put("object-src", new JSONObject() .put("c.d.com", new JSONObject()) ) ) .put("/x/y/*", new JSONObject() .put("script-src", new JSONObject() .put("'unsafe-inline'", new JSONObject()) .put("'self'", new JSONObject()) .put("x.y.com", new JSONObject()) ) .put("style-src", new JSONObject() .put("'self'", new JSONObject()) ) ); CspPolicy policy = createPolicy(); policy.parsePolicy(new StringReader(jsonPolicy.toString())); Assert.assertEquals(policy.getPolicyForUri("/a/b/c/d"), "connect-src a.b.c.com; font-src a.b.c.com; frame-src a.b.c.com; img-src a.b.c.com; media-src a.b.c.com; " + "object-src a.b.c.com c.d.com; " + "script-src 'self' a.b.c.com b.c.com; " + "style-src a.b.c.com"); Assert.assertEquals(policy.getPolicyForUri("/x/y/z"), "connect-src 'none'; font-src 'none'; frame-src 'none'; img-src 'none'; media-src 'none'; object-src 'none'; " + "script-src 'self' 'unsafe-inline' x.y.com; " + "style-src 'self'"); Assert.assertEquals(policy.getPolicyForUri("/x/y/z/a"), "connect-src 'none'; font-src 'none'; frame-src 'none'; img-src 'none'; media-src 'none'; object-src 'none'; " + "script-src 'none'; style-src 'none'"); }
@Test public void testApplyDefault() throws IOException { JSONObject jsonPolicy = new JSONObject() .put("/**", new JSONObject() .put("default-src", new JSONObject() .put("'self'", new JSONObject()) ) ) .put("/a/b/**", new JSONObject() .put("script-src", new JSONObject() .put("b.c.com", new JSONObject()) ) ); CspPolicy policy = createPolicy(); policy.parsePolicy(new StringReader(jsonPolicy.toString())); Assert.assertEquals(policy.getPolicyForUri("/foo/bar"), "connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; script-src 'self'; style-src 'self'"); Assert.assertEquals(policy.getPolicyForUri("/a"), "connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; script-src 'self'; style-src 'self'"); Assert.assertEquals(policy.getPolicyForUri("/a/b"), "connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; script-src 'self'; style-src 'self'"); Assert.assertEquals(policy.getPolicyForUri("/a/b/c"), "connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; script-src 'self' b.c.com; style-src 'self'"); Assert.assertEquals(policy.getPolicyForUri("/a/b/c/d"), "connect-src 'self'; font-src 'self'; frame-src 'self'; img-src 'self'; media-src 'self'; object-src 'self'; script-src 'self' b.c.com; style-src 'self'"); }