<commit_before>// jshint quotmark: false

var _ = require('underscore');
var platform = require('platform');

var ALL_HEADERS = [
  'X-Content-Security-Policy',
  'Content-Security-Policy',
  'X-WebKit-CSP'
];

var DIRECTIVES = [
  'default-src',
  'script-src',
  'object-src',
  'img-src',
  'media-src',
  'frame-src',
  'font-src',
  'connect-src',
  'style-src',
  'report-uri',
  'sandbox'
];

var MUST_BE_QUOTED = [
  'none',
  'self',
  'unsafe-inline',
  'unsafe-eval'
];

module.exports = function csp(options) {
  var reportOnly;
  var setAllHeaders;
  var safari5;

  options = options || { 'default-src': ["'self'"] };
  reportOnly = options.reportOnly || false;
  setAllHeaders = options.setAllHeaders || false;
  safari5 = options.safari5 || false;

  _.each(options, function (value) {
    if (_(value).isArray()) {
      MUST_BE_QUOTED.forEach(function (must) {
        if (value.indexOf(must) !== -1) {
          throw new Error(value + ' must be quoted');
        }
      });
    } else {
      MUST_BE_QUOTED.forEach(function (must) {
        if (value == must) {
          throw new Error(value + ' must be quoted');
        }
      });
    }
  });

  if (reportOnly && !options['report-uri']) {
    throw new Error('Please remove reportOnly or add a report-uri.');
  }

  return function *csp(next) {
    var headers = [];
    var policy = {};

    var browser = platform.parse(this.get('user-agent'));
    var version = parseFloat(browser.version);

    DIRECTIVES.forEach(function (directive) {

      var value = options[directive];
      if ((value !== null) && (value !== undefined)) {
        policy[directive] = value;
      }

      var shouldWrapInArray = (_(value).isString()) && (
        (directive != 'sandbox') ||
        ((directive == 'sandbox') && (value !== true))
        );
      if (shouldWrapInArray) {
        policy[directive] = value.split(/\s/g);
      }

    });

    switch (browser.name) {

      case 'IE':
        if (version >= 10) {
          headers.push('X-Content-Security-Policy');
          if ((policy.sandbox === null) || (policy.sandbox === undefined)) {
            policy.sandbox = true;
          }
        }
        break;

      case 'Firefox':

        if (version >= 23) {

          headers.push('Content-Security-Policy');

        } else if ((version >= 4) && (version < 23)) {

          headers.push('X-Content-Security-Policy');

          policy['default-src'] = policy['default-src'] || ['*'];

          Object.keys(options).forEach(function (key) {

            var value = options[key];

            if (key == 'connect-src') {
              policy['xhr-src'] = value;
            } else if (key == 'default-src') {
              if (version < 5) {
                policy.allow = value;
              } else {
                policy['default-src'] = value;
              }
            } else if (key != 'sandbox') {
              policy[key] = value;
            }

            var index;
            if ((index = policy[key].indexOf("'unsafe-inline'")) !== -1) {
              if (key === 'script-src') {
                policy[key][index] = "'inline-script'";
              } else {
                policy[key].splice(index, 1);
              }
            }
            if ((index = policy[key].indexOf("'unsafe-eval'")) !== -1) {
              if (key === 'script-src') {
                policy[key][index] = "'eval-script'";
              } else {
                policy[key].splice(index, 1);
              }
            }<commit_msg>Update csp.js<commit_after>// jshint quotmark: false

var _ = require('underscore');
var platform = require('platform');

var ALL_HEADERS = [
  'X-Content-Security-Policy',
  'Content-Security-Policy',
  'X-WebKit-CSP'
];

var DIRECTIVES = [
  'default-src',
  'script-src',
  'object-src',
  'img-src',
  'media-src',
  'frame-src',
  'font-src',
  'connect-src',
  'style-src',
  'report-uri',
  'sandbox'
];

var MUST_BE_QUOTED = [
  'none',
  'self',
  'unsafe-inline',
  'unsafe-eval'
];

module.exports = function csp(options) {
  var reportOnly;
  var setAllHeaders;
  var safari5;

  options = options || { 'default-src': ["'self'"] };
  reportOnly = options.reportOnly || false;
  setAllHeaders = options.setAllHeaders || false;
  safari5 = options.safari5 || false;

  _.each(options, function (value) {
    if (_(value).isArray()) {
      MUST_BE_QUOTED.forEach(function (must) {
        if (value.indexOf(must) !== -1) {
          throw new Error(value + ' must be quoted');
        }
      });
    } else {
      MUST_BE_QUOTED.forEach(function (must) {
        if (value == must) {
          throw new Error(value + ' must be quoted');
        }
      });
    }
  });

  if (reportOnly && !options['report-uri']) {
    throw new Error('Please remove reportOnly or add a report-uri.');
  }

  return function *csp(next) {
    var headers = [];
    var policy = {};

    var browser = platform.parse(this.get('user-agent'));
    var version = parseFloat(browser.version);

    DIRECTIVES.forEach(function (directive) {

      var value = options[directive];
      if ((value !== null) && (value !== undefined)) {
        policy[directive] = value;
      }

      var shouldWrapInArray = (_(value).isString()) && (
        (directive != 'sandbox') ||
        ((directive == 'sandbox') && (value !== true))
        );
      if (shouldWrapInArray) {
        policy[directive] = value.split(/\s/g);
      }

    });

    switch (browser.name) {

      case 'IE':
        if (version >= 10) {
          headers.push('X-Content-Security-Policy');
          if ((policy.sandbox === null) || (policy.sandbox === undefined)) {
            policy.sandbox = true;
          }
        }
        break;

      case 'Firefox':

        if (version >= 23) {

          headers.push('Content-Security-Policy');

        } else if ((version >= 4) && (version < 23)) {

          headers.push('X-Content-Security-Policy');

          policy['default-src'] = policy['default-src'] || ['*'];

          Object.keys(policy).forEach(function (key) {

            var value = options[key];

            if (key == 'connect-src') {
              policy['xhr-src'] = value;
            } else if (key == 'default-src') {
              if (version < 5) {
                policy.allow = value;
              } else {
                policy['default-src'] = value;
              }
            } else if (key != 'sandbox') {
              policy[key] = value;
            }

            var index;
            if ((index = policy[key].indexOf("'unsafe-inline'")) !== -1) {
              if (key === 'script-src') {
                policy[key][index] = "'inline-script'";
              } else {
                policy[key].splice(index, 1);
              }
            }
            if ((index = policy[key].indexOf("'unsafe-eval'")) !== -1) {
              if (key === 'script-src') {
                policy[key][index] = "'eval-script'";
              } else {
                policy[key].splice(index, 1);
              }
            }
{'fraction_non_alphanumeric': 0.1714245135634143, 'fraction_numerical': 0.004544808975997728, 'mean_word_length': 1.8848832445718968, 'pattern_counts': {'":': 0, '<': 7, '<?xml version=': 0, '>': 9, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '5356655', 'n_tokens_mistral': 2257, 'n_tokens_neox': 2159, 'n_words': 437}