Haketilo

/* Make CSP headers do our bidding, not interfere */

function sanitize_csp_header(header, rule, block)

{

    const csp = parse_csp(header.value);

    if (block) {

	/* No snitching */

	delete csp['report-to'];

	delete csp['report-uri'];

	delete csp['script-src'];

	delete csp['script-src-elem'];

	csp['script-src-attr'] = ["'none'"];

	csp['prefetch-src'] = ["'none'"];

    }

    if ('script-src' in csp)

	csp['script-src'].push(rule);

    else

	csp['script-src'] = [rule];

    if ('script-src-elem' in csp)

	csp['script-src-elem'].push(rule);

    else

	csp['script-src-elem'] = [rule];

    const new_policy = Object.entries(csp).map(

	i => `${i[0]} ${i[1].join(' ')};`

    );

    return {name: header.name, value: new_policy.join('')};

}

 * EXPORT sanitize_csp_header