Module org.htmlunit.csp

Package org.htmlunit.csp

Interface CspQueries

All Known Implementing Classes:

Policy, PolicyList

public interface CspQueries

Enforcement query API shared by Policy and PolicyList.

For a single Policy, each method applies that policy's rules. For a PolicyList, each method returns true only if every member policy allows the resource (an empty list is unrestricted). Semantics of individual checks are documented on Policy.

Since:

5.4.0

Author:

Ronald Brill, Rick Mitchell

See Also:

• Policy
• PolicyList
• CspQueriesInOrigin

Method Summary

Modifier and Type	Method	Description
boolean	allowsApplicationManifest(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether an application manifest is allowed.
boolean	allowsConnection(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a connection is allowed.
boolean	allowsEval()	Returns whether eval is allowed.
boolean	allowsExternalScript(Optional<String> nonce, Optional<String> integrity, Optional<? extends URLWithScheme> scriptUrl, Optional<Boolean> parserInserted, Optional<? extends URLWithScheme> origin)	Returns whether an external script is allowed.
boolean	allowsExternalStyle(Optional<String> nonce, Optional<? extends URLWithScheme> styleUrl, Optional<? extends URLWithScheme> origin)	Returns whether an external stylesheet is allowed.
boolean	allowsFont(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a font is allowed.
boolean	allowsFormAction(Optional<? extends URLWithScheme> to, Optional<Boolean> redirected, Optional<? extends URLWithScheme> redirectedTo, Optional<? extends URLWithScheme> origin)	Returns whether a form action is allowed.
boolean	allowsFrame(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a frame is allowed.
boolean	allowsFrameAncestor(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a frame ancestor is allowed.
boolean	allowsImage(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether an image is allowed.
boolean	allowsInlineScript(Optional<String> nonce, Optional<String> source, Optional<Boolean> parserInserted)	Returns whether an inline script is allowed.
boolean	allowsInlineStyle(Optional<String> nonce, Optional<String> source)	Returns whether an inline style is allowed.
boolean	allowsJavascriptUrlNavigation(Optional<String> source, Optional<? extends URLWithScheme> origin)	Returns whether a javascript: URL navigation is allowed.
boolean	allowsMedia(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether media is allowed.
boolean	allowsNavigation(Optional<? extends URLWithScheme> to, Optional<Boolean> redirected, Optional<? extends URLWithScheme> redirectedTo, Optional<? extends URLWithScheme> origin)	Returns whether navigation is allowed.
boolean	allowsObject(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether an object is allowed.
boolean	allowsPlugin(Optional<? extends MediaType> mediaType)	Returns whether a plugin type is allowed.
boolean	allowsPrefetch(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a prefetch is allowed.
boolean	allowsScriptAsAttribute(Optional<String> source)	Returns whether a script event-handler attribute is allowed.
boolean	allowsStyleAsAttribute(Optional<String> source)	Returns whether a style attribute is allowed.
boolean	allowsWorker(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a worker is allowed.

Method Details

allowsExternalScript

boolean allowsExternalScript(Optional<String> nonce,
 Optional<String> integrity,
 Optional<? extends URLWithScheme> scriptUrl,
 Optional<Boolean> parserInserted,
 Optional<? extends URLWithScheme> origin)

Returns whether an external script is allowed.

Parameters:

nonce - script nonce, if any

integrity - SRI metadata, if any

scriptUrl - script URL, if known

parserInserted - whether the script is parser-inserted

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsExternalScript(java.util.Optional<java.lang.String>, java.util.Optional<java.lang.String>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<java.lang.Boolean>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsInlineScript

boolean allowsInlineScript(Optional<String> nonce,
 Optional<String> source,
 Optional<Boolean> parserInserted)

Returns whether an inline script is allowed.

Parameters:

nonce - script nonce, if any

source - inline script text, if known

parserInserted - whether the script is parser-inserted

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsInlineScript(java.util.Optional<java.lang.String>, java.util.Optional<java.lang.String>, java.util.Optional<java.lang.Boolean>)

allowsScriptAsAttribute

boolean allowsScriptAsAttribute(Optional<String> source)

Returns whether a script event-handler attribute is allowed.

Parameters:

source - attribute text, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsScriptAsAttribute(java.util.Optional<java.lang.String>)

allowsEval

boolean allowsEval()

Returns whether eval is allowed.

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsEval()

allowsNavigation

boolean allowsNavigation(Optional<? extends URLWithScheme> to,
 Optional<Boolean> redirected,
 Optional<? extends URLWithScheme> redirectedTo,
 Optional<? extends URLWithScheme> origin)

Returns whether navigation is allowed.

Parameters:

to - navigation target URL, if known

redirected - whether the navigation is a redirect

redirectedTo - final URL after redirect, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsNavigation(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<java.lang.Boolean>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsFormAction

boolean allowsFormAction(Optional<? extends URLWithScheme> to,
 Optional<Boolean> redirected,
 Optional<? extends URLWithScheme> redirectedTo,
 Optional<? extends URLWithScheme> origin)

Returns whether a form action is allowed.

Parameters:

to - form action URL, if known

redirected - whether the submission redirects

redirectedTo - final URL after redirect, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsFormAction(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<java.lang.Boolean>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsJavascriptUrlNavigation

boolean allowsJavascriptUrlNavigation(Optional<String> source,
 Optional<? extends URLWithScheme> origin)

Returns whether a javascript: URL navigation is allowed.

Parameters:

source - JavaScript after the javascript: prefix, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsJavascriptUrlNavigation(java.util.Optional<java.lang.String>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsExternalStyle

boolean allowsExternalStyle(Optional<String> nonce,
 Optional<? extends URLWithScheme> styleUrl,
 Optional<? extends URLWithScheme> origin)

Returns whether an external stylesheet is allowed.

Parameters:

nonce - style nonce, if any

styleUrl - stylesheet URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsExternalStyle(java.util.Optional<java.lang.String>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsInlineStyle

boolean allowsInlineStyle(Optional<String> nonce,
 Optional<String> source)

Returns whether an inline style is allowed.

Parameters:

nonce - style nonce, if any

source - inline style text, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsInlineStyle(java.util.Optional<java.lang.String>, java.util.Optional<java.lang.String>)

allowsStyleAsAttribute

boolean allowsStyleAsAttribute(Optional<String> source)

Returns whether a style attribute is allowed.

Parameters:

source - attribute text, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsStyleAsAttribute(java.util.Optional<java.lang.String>)

allowsFrame

boolean allowsFrame(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether a frame is allowed.

Parameters:

source - framed resource URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsFrame(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsFrameAncestor

boolean allowsFrameAncestor(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether a frame ancestor is allowed.

Parameters:

source - ancestor frame URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsFrameAncestor(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsConnection

boolean allowsConnection(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether a connection is allowed.

Parameters:

source - connection URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsConnection(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsFont

boolean allowsFont(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether a font is allowed.

Parameters:

source - font URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsFont(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsImage

boolean allowsImage(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether an image is allowed.

Parameters:

source - image URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsImage(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsApplicationManifest

boolean allowsApplicationManifest(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether an application manifest is allowed.

Parameters:

source - manifest URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsApplicationManifest(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsMedia

boolean allowsMedia(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether media is allowed.

Parameters:

source - media URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsMedia(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsObject

boolean allowsObject(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether an object is allowed.

Parameters:

source - object URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsObject(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsPrefetch

boolean allowsPrefetch(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether a prefetch is allowed.

Parameters:

source - prefetch URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsPrefetch(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsWorker

boolean allowsWorker(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Returns whether a worker is allowed.

Parameters:

source - worker URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsWorker(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsPlugin

boolean allowsPlugin(Optional<? extends MediaType> mediaType)

Returns whether a plugin type is allowed.

Parameters:

mediaType - plugin media type, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsPlugin(java.util.Optional<? extends org.htmlunit.csp.value.MediaType>)