Module org.htmlunit.csp
Package org.htmlunit.csp.directive

Class SourceExpressionDirective

java.lang.Object
org.htmlunit.csp.Directive
org.htmlunit.csp.directive.HostSourceDirective
org.htmlunit.csp.directive.SourceExpressionDirective
public class SourceExpressionDirective extends HostSourceDirective
Represents a CSP directive whose values form a source-expression list.

In addition to the host-sources and scheme-sources inherited from HostSourceDirective, a source-expression list may contain keyword sources ('unsafe-inline', 'unsafe-eval', 'strict-dynamic', 'unsafe-hashes', 'report-sample', 'unsafe-allow-redirects', 'wasm-unsafe-eval'), nonce-sources ('nonce-...') and hash-sources ('sha256-...', 'sha384-...', 'sha512-...').

This class is used for most fetch directives (script-src, style-src, default-src, img-src, etc.) as well as base-uri, form-action, and navigate-to.

Author:
Salvation Team

  • Constructor Details

    • SourceExpressionDirective

      public SourceExpressionDirective(List<String> values, Directive.DirectiveErrorConsumer errors)
      Parses a source-expression directive from the given list of values.

      Each token is classified as a keyword, nonce, hash, host-source, or scheme-source. Errors and warnings (duplicates, unrecognised tokens, empty lists, etc.) are reported through the supplied errors consumer.

      Parameters:
      values - the raw string values for this directive
      errors - consumer that receives parsing errors and warnings

  • Method Details

    • unsafeInline

      public boolean unsafeInline()
      Returns whether the 'unsafe-inline' keyword is present.

      When present (and not neutralised by nonces/hashes), inline scripts and styles are permitted.

      Returns:
      true if 'unsafe-inline' is present

    • unsafeEval

      public boolean unsafeEval()
      Returns whether the 'unsafe-eval' keyword is present.

      When present, eval() and similar string-to-code mechanisms are permitted.

      Returns:
      true if 'unsafe-eval' is present

    • strictDynamic

      public boolean strictDynamic()
      Returns whether the 'strict-dynamic' keyword is present.

      When present, trust is propagated to scripts loaded by already-trusted scripts, and host-/scheme-based allowlists are ignored.

      Returns:
      true if 'strict-dynamic' is present
      See Also:

    • unsafeHashes

      public boolean unsafeHashes()
      Returns whether the 'unsafe-hashes' keyword is present.

      When present, inline event handlers and javascript: URLs can be allowed by matching their content against the hash-sources in this directive.

      Returns:
      true if 'unsafe-hashes' is present

    • reportSample

      public boolean reportSample()
      Returns whether the 'report-sample' keyword is present.

      When present, violation reports include a sample of the violating code.

      Returns:
      true if 'report-sample' is present

    • unsafeAllowRedirects

      public boolean unsafeAllowRedirects()
      Returns whether the 'unsafe-allow-redirects' keyword is present.

      When present in a navigate-to directive, navigation is checked both before and after any redirect, rather than only before.

      Returns:
      true if 'unsafe-allow-redirects' is present

    • unsafeWasm

      public boolean unsafeWasm()
      Returns whether the 'wasm-unsafe-eval' keyword is present.

      When present, WebAssembly compilation and instantiation are permitted without requiring 'unsafe-eval'.

      Returns:
      true if 'wasm-unsafe-eval' is present
      See Also:

    • getNonces

      public List<Nonce> getNonces()
      Returns an unmodifiable list of nonce-sources parsed from this directive.
      Returns:
      the list of Nonce values

    • getHashes

      public List<Hash> getHashes()
      Returns an unmodifiable list of hash-sources parsed from this directive.
      Returns:
      the list of Hash values