com.helger.http.csp

Class CSP2Directive

java.lang.Object

com.helger.http.csp.CSP2Directive

All Implemented Interfaces:

com.helger.commons.name.IHasName, ICSPDirective, Serializable

public class CSP2Directive
extends Object
implements ICSPDirective

A single CSP 2.0 directive. It's a name-value-pair.

Author:

Philip Helger

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
CSP2Directive(String sName, CSP2SourceList aValue)
CSP2Directive(String sName, String sValue)

Method Summary

Modifier and Type	Method and Description
static CSP2Directive	createChildSrc(CSP2SourceList aValue) Defines valid sources for web workers and nested browsing contexts loaded using elements such as <frame> and <iframe>
static CSP2Directive	createConnectSrc(CSP2SourceList aValue) Applies to XMLHttpRequest (AJAX), WebSocket or EventSource.
static CSP2Directive	createDefaultSrc(CSP2SourceList aValue) The default-src is the default policy for loading content such as JavaScript, Images, CSS, Fonts, AJAX requests, Frames, HTML5 Media.
static CSP2Directive	createFontSrc(CSP2SourceList aValue) Defines valid sources of fonts.
static CSP2Directive	createFormAction(CSP2SourceList aValue) Defines valid sources that can be used as a HTML <form> action.
static CSP2Directive	createFrameAncestors(CSP2SourceList aValue) Defines valid sources for embedding the resource using <frame> <iframe> <object> <embed> <applet>.
static CSP2Directive	createFrameSrc(CSP2SourceList aValue) Deprecated.
static CSP2Directive	createImgSrc(CSP2SourceList aValue) Defines valid sources of images.
static CSP2Directive	createMediaSrc(CSP2SourceList aValue) Defines valid sources of audio and video, eg HTML5 <audio>, <video> elements.
static CSP2Directive	createObjectSrc(CSP2SourceList aValue) Defines valid sources of plugins, eg <object>, <embed> or <applet>.
static CSP2Directive	createPluginTypes(CSP2SourceList aValue) Defines valid MIME types for plugins invoked via <object> and <embed>.
static CSP2Directive	createReportURI(String sValue) The report-uri directive specifies a URI to which the user agent sends reports about policy violation.
static CSP2Directive	createSandbox(String sValue) The sandbox directive specifies an HTML sandbox policy that the user agent applies to the protected resource.
static CSP2Directive	createScriptSrc(CSP2SourceList aValue) Defines valid sources of JavaScript.
static CSP2Directive	createStyleSrc(CSP2SourceList aValue) Defines valid sources of stylesheets.
boolean	equals(Object o)
String	getName()
String	getValue()
int	hashCode()
static boolean	isValidName(String sName)
static boolean	isValidValue(String sValue)
String	toString()

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Methods inherited from interface com.helger.http.csp.ICSPDirective

getAsString, getAsStringIfHasValue, hasValue

Methods inherited from interface com.helger.commons.name.IHasName

getComparatorCollating, getComparatorName

Constructor Detail

CSP2Directive

public CSP2Directive(@Nonnull @Nonempty
                     String sName,
                     @Nullable
                     CSP2SourceList aValue)

CSP2Directive

public CSP2Directive(@Nonnull @Nonempty
                     String sName,
                     @Nullable
                     String sValue)

Method Detail

isValidName

public static boolean isValidName(@Nullable
                                  String sName)

isValidValue

public static boolean isValidValue(@Nullable
                                   String sValue)

getName

@Nonnull
 @Nonempty
public final String getName()

Specified by:

getName in interface com.helger.commons.name.IHasName

Specified by:

getName in interface ICSPDirective

Returns:

The name of this directive.

getValue

@Nullable
public final String getValue()

Specified by:

getValue in interface ICSPDirective

Returns:

The value of this directive. May be null or empty.

equals

public boolean equals(Object o)

Overrides:

equals in class Object

hashCode

public int hashCode()

Overrides:

hashCode in class Object

toString

public String toString()

Overrides:

toString in class Object

createDefaultSrc

@Nonnull
public static CSP2Directive createDefaultSrc(@Nullable
                                                       CSP2SourceList aValue)

The default-src is the default policy for loading content such as JavaScript, Images, CSS, Fonts, AJAX requests, Frames, HTML5 Media.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v1

createScriptSrc

@Nonnull
public static CSP2Directive createScriptSrc(@Nullable
                                                      CSP2SourceList aValue)

Defines valid sources of JavaScript.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v1

createStyleSrc

@Nonnull
public static CSP2Directive createStyleSrc(@Nullable
                                                     CSP2SourceList aValue)

Defines valid sources of stylesheets.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v1

createImgSrc

@Nonnull
public static CSP2Directive createImgSrc(@Nullable
                                                   CSP2SourceList aValue)

Defines valid sources of images.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v1

createConnectSrc

@Nonnull
public static CSP2Directive createConnectSrc(@Nullable
                                                       CSP2SourceList aValue)

Applies to XMLHttpRequest (AJAX), WebSocket or EventSource. If not allowed the browser emulates a 400 HTTP status code.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v1

createFontSrc

@Nonnull
public static CSP2Directive createFontSrc(@Nullable
                                                    CSP2SourceList aValue)

Defines valid sources of fonts.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v1

createObjectSrc

@Nonnull
public static CSP2Directive createObjectSrc(@Nullable
                                                      CSP2SourceList aValue)

Defines valid sources of plugins, eg <object>, <embed> or <applet>.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v1

createMediaSrc

@Nonnull
public static CSP2Directive createMediaSrc(@Nullable
                                                     CSP2SourceList aValue)

Defines valid sources of audio and video, eg HTML5 <audio>, <video> elements.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v1

createFrameSrc

@Deprecated
 @Nonnull
public static CSP2Directive createFrameSrc(@Nullable
                                                                   CSP2SourceList aValue)

Deprecated.

Defines valid sources for loading frames. child-src is preferred over this deprecated directive.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v1

createSandbox

@Nonnull
public static CSP2Directive createSandbox(@Nullable
                                                    String sValue)

The sandbox directive specifies an HTML sandbox policy that the user agent applies to the protected resource.

Parameters:

sValue - value

Returns:

new directive

Since:

CSP v1

createReportURI

@Nonnull
public static CSP2Directive createReportURI(@Nullable
                                                      String sValue)

The report-uri directive specifies a URI to which the user agent sends reports about policy violation.

Parameters:

sValue - Report URI

Returns:

new directive

Since:

CSP v1

createChildSrc

@Nonnull
public static CSP2Directive createChildSrc(@Nullable
                                                     CSP2SourceList aValue)

Defines valid sources for web workers and nested browsing contexts loaded using elements such as <frame> and <iframe>

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v2

createFormAction

@Nonnull
public static CSP2Directive createFormAction(@Nullable
                                                       CSP2SourceList aValue)

Defines valid sources that can be used as a HTML <form> action.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v2

createFrameAncestors

@Nonnull
public static CSP2Directive createFrameAncestors(@Nullable
                                                           CSP2SourceList aValue)

Defines valid sources for embedding the resource using <frame> <iframe> <object> <embed> <applet>. Setting this directive to 'none' should be roughly equivalent to X-Frame-Options: DENY

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v2

createPluginTypes

@Nonnull
public static CSP2Directive createPluginTypes(@Nullable
                                                        CSP2SourceList aValue)

Defines valid MIME types for plugins invoked via <object> and <embed>. To load an <applet> you must specify application/x-java-applet.
Not supported in Firefox up to v61.

Parameters:

aValue - Value list to use. May be be null.

Returns:

New CSP2Directive

Since:

CSP v2