class_docstr: WSGI middleware validating security on response.
  
  It validates:
  - responses have Content-Type
  - responses have X-Content-Type-Options: nosniff
  - text/html responses have CSP header. It also validates whether the CSP
    headers pass basic requirement. e.g., default-src should be present, cannot
    use "*" directive, and others. For more complete list, please refer to
    _validate_csp_policies.
  
  Instances of this class are WSGI applications (see PEP 3333).
code: def _validate_csp_policies(self, policies):
      has_default_src = False
      violations = []
  
      for directive in policies:
          name = directive.name
          for value in directive.value:
              has_default_src = (
                  has_default_src or name == _CSP_DEFAULT_SRC
              )
  
              if value in _CSP_IGNORE.get(name, []):
                  # There are cases where certain directives are legitimate.
                  continue
  
              # TensorBoard follows principle of least privilege. However, to make it
              # easier to conform to the security policy for plugin authors,
              # TensorBoard trusts request and resources originating its server. Also,
              # it can selectively trust domains as long as they use https protocol.
              # Lastly, it can allow 'none' directive.
              # TODO(stephanwlee): allow configuration for whitelist of domains for
              # stricter enforcement.
              # TODO(stephanwlee): deprecate the sha-based whitelisting.
              if (
                  value == "'self'"
                  or value == "'none'"
                  or value.startswith("https:")
                  or value.startswith("'sha256-")
              ):
                  continue
  
              msg = "Illegal Content-Security-Policy for {name}: {value}".format(
                  name=name, value=value
              )
              violations.append(msg)
  
      if not has_default_src:
          violations.append(
              "Requires default-src for Content-Security-Policy"
          )
  
      if violations:
          _maybe_raise_value_error("\n".join(violations))
  
file_path: tensorboard/tensorboard/backend/security_validator.py
imports: import dataclasses
  from typing import Collection
  from werkzeug.datastructures import Headers
  from werkzeug import http
  from tensorboard.util import tb_logging
label_desc: Use image node_id 7 for calling the SecurityValidatorMiddleware obj's underlying member method code with example usage: obj._validate_csp_policies(policies) without return types