Module org.htmlunit.csp

Package org.htmlunit.csp

Class PolicyList

java.lang.Object

org.htmlunit.csp.PolicyList

All Implemented Interfaces:

CspQueries

public class PolicyList
extends Object
implements CspQueries

Represents a list of Content Security Policies parsed from a comma-separated serialized CSP list, or combined from multiple header / meta deliveries.

A serialized CSP list (e.g. the value of a Content-Security-Policy HTTP header) may contain multiple policies separated by commas. Each policy is parsed independently, and a resource is blocked if any policy in the list blocks it — equivalently, allows* methods return true only when every member policy allows the resource. See CSP3 multiple policies.

Implements CspQueries: each query method AND-delegates to member Policy instances (short-circuit on the first deny). An empty list is unrestricted (all allows* return true).

Instances are created by Policy.parseSerializedCSPList(String, PolicyListErrorConsumer) or ofSerialized(List, PolicyListErrorConsumer). Empty policies (those with no directives) are omitted during parsing.

Author:

Ronald Brill, Rick Mitchell, Salvation Team

See Also:

• CspQueries
• Policy.parseSerializedCSPList(String, PolicyListErrorConsumer)
• Policy.parseSerializedCSPList(String, Policy.PolicyListErrorConsumer)

Constructor Summary

Constructors

Constructor	Description
PolicyList(List<Policy> policies)	Ctor.

Method Summary

Modifier and Type	Method	Description
boolean	allowsApplicationManifest(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether an application manifest is allowed.
boolean	allowsConnection(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a connection is allowed.
boolean	allowsEval()	Returns whether eval is allowed.
boolean	allowsExternalScript(Optional<String> nonce, Optional<String> integrity, Optional<? extends URLWithScheme> scriptUrl, Optional<Boolean> parserInserted, Optional<? extends URLWithScheme> origin)	Returns whether an external script is allowed.
boolean	allowsExternalStyle(Optional<String> nonce, Optional<? extends URLWithScheme> styleUrl, Optional<? extends URLWithScheme> origin)	Returns whether an external stylesheet is allowed.
boolean	allowsFont(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a font is allowed.
boolean	allowsFormAction(Optional<? extends URLWithScheme> to, Optional<Boolean> redirected, Optional<? extends URLWithScheme> redirectedTo, Optional<? extends URLWithScheme> origin)	Returns whether a form action is allowed.
boolean	allowsFrame(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a frame is allowed.
boolean	allowsFrameAncestor(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a frame ancestor is allowed.
boolean	allowsImage(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether an image is allowed.
boolean	allowsInlineScript(Optional<String> nonce, Optional<String> source, Optional<Boolean> parserInserted)	Returns whether an inline script is allowed.
boolean	allowsInlineStyle(Optional<String> nonce, Optional<String> source)	Returns whether an inline style is allowed.
boolean	allowsJavascriptUrlNavigation(Optional<String> source, Optional<? extends URLWithScheme> origin)	Returns whether a javascript: URL navigation is allowed.
boolean	allowsMedia(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether media is allowed.
boolean	allowsNavigation(Optional<? extends URLWithScheme> to, Optional<Boolean> redirected, Optional<? extends URLWithScheme> redirectedTo, Optional<? extends URLWithScheme> origin)	Returns whether navigation is allowed.
boolean	allowsObject(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether an object is allowed.
boolean	allowsPlugin(Optional<? extends MediaType> mediaType)	Returns whether a plugin type is allowed.
boolean	allowsPrefetch(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a prefetch is allowed.
boolean	allowsScriptAsAttribute(Optional<String> source)	Returns whether a script event-handler attribute is allowed.
boolean	allowsStyleAsAttribute(Optional<String> source)	Returns whether a style attribute is allowed.
boolean	allowsWorker(Optional<? extends URLWithScheme> source, Optional<? extends URLWithScheme> origin)	Returns whether a worker is allowed.
List<Policy>	getPolicies()	Returns the member policies (unmodifiable).
static PolicyList	ofSerialized(List<String> serializedPoliciesOrLists, Policy.PolicyListErrorConsumer policyListErrorConsumer)	Parses and combines multiple serialized CSP strings into one policy list.
String	toString()	Serializes this policy list back to its string representation.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Details

PolicyList

public PolicyList(List<Policy> policies)

Ctor.

Parameters:

policies - the list of parsed Policy instances (empty policies excluded)

Throws:

NullPointerException - if policies is null or contains null

Method Details

ofSerialized

public static PolicyList ofSerialized(List<String> serializedPoliciesOrLists,
 Policy.PolicyListErrorConsumer policyListErrorConsumer)

Parses and combines multiple serialized CSP strings into one policy list.

Each element may itself be a comma-separated CSP list (as with a single header field value). Values are joined with "," and parsed via Policy.parseSerializedCSPList(java.lang.String, org.htmlunit.csp.Policy.PolicyListErrorConsumer) (always as header delivery — deliveredViaMeta = false). For meta policies, parse with Policy.parseSerializedCSP(String, Policy.PolicyErrorConsumer, boolean) and pass the results to PolicyList(List). Report-Only policies should be kept in a separate PolicyList.

Parameters:

serializedPoliciesOrLists - header field values (not meta content strings that need deliveredViaMeta = true)

policyListErrorConsumer - consumer for parse errors/warnings

Returns:

the combined PolicyList

Throws:

NullPointerException - if serializedPoliciesOrLists or policyListErrorConsumer is null, or if any element of serializedPoliciesOrLists is null

Since:

5.4.0

getPolicies

public List<Policy> getPolicies()

Returns the member policies (unmodifiable).

Returns:

an unmodifiable list of all policies

toString

public String toString()

Serializes this policy list back to its string representation.

Individual policies are separated by ", ". Each policy is serialized using Policy.toString(). This is not an intersected / merged policy.

Overrides:

toString in class Object

Returns:

the comma-separated serialized CSP list string

allowsExternalScript

public boolean allowsExternalScript(Optional<String> nonce,
 Optional<String> integrity,
 Optional<? extends URLWithScheme> scriptUrl,
 Optional<Boolean> parserInserted,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether an external script is allowed.

Specified by:

allowsExternalScript in interface CspQueries

Parameters:

nonce - script nonce, if any

integrity - SRI metadata, if any

scriptUrl - script URL, if known

parserInserted - whether the script is parser-inserted

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsExternalScript(java.util.Optional<java.lang.String>, java.util.Optional<java.lang.String>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<java.lang.Boolean>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsInlineScript

public boolean allowsInlineScript(Optional<String> nonce,
 Optional<String> source,
 Optional<Boolean> parserInserted)

Description copied from interface: CspQueries

Returns whether an inline script is allowed.

Specified by:

allowsInlineScript in interface CspQueries

Parameters:

nonce - script nonce, if any

source - inline script text, if known

parserInserted - whether the script is parser-inserted

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsInlineScript(java.util.Optional<java.lang.String>, java.util.Optional<java.lang.String>, java.util.Optional<java.lang.Boolean>)

allowsScriptAsAttribute

public boolean allowsScriptAsAttribute(Optional<String> source)

Description copied from interface: CspQueries

Returns whether a script event-handler attribute is allowed.

Specified by:

allowsScriptAsAttribute in interface CspQueries

Parameters:

source - attribute text, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsScriptAsAttribute(java.util.Optional<java.lang.String>)

allowsEval

public boolean allowsEval()

Description copied from interface: CspQueries

Returns whether eval is allowed.

Specified by:

allowsEval in interface CspQueries

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsEval()

allowsNavigation

public boolean allowsNavigation(Optional<? extends URLWithScheme> to,
 Optional<Boolean> redirected,
 Optional<? extends URLWithScheme> redirectedTo,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether navigation is allowed.

Specified by:

allowsNavigation in interface CspQueries

Parameters:

to - navigation target URL, if known

redirected - whether the navigation is a redirect

redirectedTo - final URL after redirect, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsNavigation(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<java.lang.Boolean>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsFormAction

public boolean allowsFormAction(Optional<? extends URLWithScheme> to,
 Optional<Boolean> redirected,
 Optional<? extends URLWithScheme> redirectedTo,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether a form action is allowed.

Specified by:

allowsFormAction in interface CspQueries

Parameters:

to - form action URL, if known

redirected - whether the submission redirects

redirectedTo - final URL after redirect, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsFormAction(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<java.lang.Boolean>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsJavascriptUrlNavigation

public boolean allowsJavascriptUrlNavigation(Optional<String> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether a javascript: URL navigation is allowed.

Specified by:

allowsJavascriptUrlNavigation in interface CspQueries

Parameters:

source - JavaScript after the javascript: prefix, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsJavascriptUrlNavigation(java.util.Optional<java.lang.String>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsExternalStyle

public boolean allowsExternalStyle(Optional<String> nonce,
 Optional<? extends URLWithScheme> styleUrl,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether an external stylesheet is allowed.

Specified by:

allowsExternalStyle in interface CspQueries

Parameters:

nonce - style nonce, if any

styleUrl - stylesheet URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsExternalStyle(java.util.Optional<java.lang.String>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsInlineStyle

public boolean allowsInlineStyle(Optional<String> nonce,
 Optional<String> source)

Description copied from interface: CspQueries

Returns whether an inline style is allowed.

Specified by:

allowsInlineStyle in interface CspQueries

Parameters:

nonce - style nonce, if any

source - inline style text, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsInlineStyle(java.util.Optional<java.lang.String>, java.util.Optional<java.lang.String>)

allowsStyleAsAttribute

public boolean allowsStyleAsAttribute(Optional<String> source)

Description copied from interface: CspQueries

Returns whether a style attribute is allowed.

Specified by:

allowsStyleAsAttribute in interface CspQueries

Parameters:

source - attribute text, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsStyleAsAttribute(java.util.Optional<java.lang.String>)

allowsFrame

public boolean allowsFrame(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether a frame is allowed.

Specified by:

allowsFrame in interface CspQueries

Parameters:

source - framed resource URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsFrame(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsFrameAncestor

public boolean allowsFrameAncestor(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether a frame ancestor is allowed.

Specified by:

allowsFrameAncestor in interface CspQueries

Parameters:

source - ancestor frame URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsFrameAncestor(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsConnection

public boolean allowsConnection(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether a connection is allowed.

Specified by:

allowsConnection in interface CspQueries

Parameters:

source - connection URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsConnection(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsFont

public boolean allowsFont(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether a font is allowed.

Specified by:

allowsFont in interface CspQueries

Parameters:

source - font URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsFont(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsImage

public boolean allowsImage(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether an image is allowed.

Specified by:

allowsImage in interface CspQueries

Parameters:

source - image URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsImage(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsApplicationManifest

public boolean allowsApplicationManifest(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether an application manifest is allowed.

Specified by:

allowsApplicationManifest in interface CspQueries

Parameters:

source - manifest URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsApplicationManifest(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsMedia

public boolean allowsMedia(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether media is allowed.

Specified by:

allowsMedia in interface CspQueries

Parameters:

source - media URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsMedia(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsObject

public boolean allowsObject(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether an object is allowed.

Specified by:

allowsObject in interface CspQueries

Parameters:

source - object URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsObject(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsPrefetch

public boolean allowsPrefetch(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether a prefetch is allowed.

Specified by:

allowsPrefetch in interface CspQueries

Parameters:

source - prefetch URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsPrefetch(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsWorker

public boolean allowsWorker(Optional<? extends URLWithScheme> source,
 Optional<? extends URLWithScheme> origin)

Description copied from interface: CspQueries

Returns whether a worker is allowed.

Specified by:

allowsWorker in interface CspQueries

Parameters:

source - worker URL, if known

origin - protected-resource origin, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsWorker(java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>, java.util.Optional<? extends org.htmlunit.csp.url.URLWithScheme>)

allowsPlugin

public boolean allowsPlugin(Optional<? extends MediaType> mediaType)

Description copied from interface: CspQueries

Returns whether a plugin type is allowed.

Specified by:

allowsPlugin in interface CspQueries

Parameters:

mediaType - plugin media type, if known

Returns:

true if allowed under this query target's rules

See Also:

• Policy.allowsPlugin(java.util.Optional<? extends org.htmlunit.csp.value.MediaType>)