<commit_before>/**
 * Injects Cordova content into the application's index.html
 */
'use strict';

const filter = require('gulp-filter');
const lazypipe = require('lazypipe');
const replace = require('gulp-replace');
const size = require('gulp-size');

const DEFAULT_SOURCE = 'index.html';

/**
 * Replaces placeholder in the index.html of the Cordova application
 * 
 * @param {Object} options Configuration for the replacement
 * @param {string[]} options.connectSrc Entries to be added to the CSP rule for "connect-src"
 * @param {string[]} options.frameSrc Entries to be added to the CSP rule for "frame-src"
 * @param {string} options.source Path of the application, e.g. index.html (or http://localhost:post for iOS)
 */
module.exports = function injectIndex({ connectSrc, frameSrc, source = DEFAULT_SOURCE } = options) {
	const htmlFilter = filter('**/*.html', {restore: true});

	return lazypipe()
		.pipe(() => htmlFilter)
		.pipe(() => replace('<!-- inject:cordova-script -->', '<script src="cordova.js" async></script>'))
		.pipe(() => replace('<!-- inject:cordova-csp -->', createMetaCsp(source, connectSrc, frameSrc)))
		.pipe(() => size({title: 'inject-cordova-index'}))
		.pipe(() => htmlFilter.restore);
}

/**
 * Creates the <meta> tag for the Content-Security-Policy
 * 
 * It enables by default access to Youtube, Google Analytics, and Google fonts.
 * 
 * @return {string} Meta tag with CSP rules
 */
function createMetaCsp(source, connectSrc = [], frameSrc = []) {
	const cspConnectSrc = [ 'self:', ...connectSrc ];
	if (source === DEFAULT_SOURCE) {
		cspConnectSrc.push('file:');
	} else {
		cspConnectSrc.push(source);
	}

	// Allow playing embeded Youtube videos
	const cspFrameSrc = [ 'https://www.youtube.com', ...frameSrc ];

	const cspRules = {
		'default-src': '\'self\' data: gap: https://ssl.gstatic.com \'unsafe-eval\' \'unsafe-inline\' https://www.google-analytics.com https://www.youtube.com https://s.ytimg.com',
		'media-src': 'data: *',
		'img-src': 'data: blob: *',
		'font-src': 'data: \'self\' https://fonts.gstatic.com',
		'style-src': '\'self\' \'unsafe-inline\' https://fonts.googleapis.com',
		'connect-src': cspConnectSrc.join(' '),
		'frame-src': cspFrameSrc.join(' '),
		'child-src': cspFrameSrc.join(' '),
	};
<commit_msg>Allow to pass values for default-src<commit_after>/**
 * Injects Cordova content into the application's index.html
 */
'use strict';

const filter = require('gulp-filter');
const lazypipe = require('lazypipe');
const replace = require('gulp-replace');
const size = require('gulp-size');

const DEFAULT_SOURCE = 'index.html';

/**
 * Replaces placeholder in the index.html of the Cordova application
 * 
 * @param {Object} options Configuration for the replacement
 * @param {string[]} options.connectSrc Entries to be added to the CSP rule for "connect-src"
 * @param {string[]} options.defaultSrc Entries to be added to the CSP rule for "default-src"
 * @param {string[]} options.frameSrc Entries to be added to the CSP rule for "frame-src"
 * @param {string} options.source Path of the application, e.g. index.html (or http://localhost:post for iOS)
 */
module.exports = function injectIndex({ connectSrc, defaultSrc, frameSrc, source = DEFAULT_SOURCE } = options) {
	const htmlFilter = filter('**/*.html', {restore: true});

	return lazypipe()
		.pipe(() => htmlFilter)
		.pipe(() => replace('<!-- inject:cordova-script -->', '<script src="cordova.js" async></script>'))
		.pipe(() => replace('<!-- inject:cordova-csp -->', createMetaCsp(source, connectSrc, defaultSrc, frameSrc)))
		.pipe(() => size({title: 'inject-cordova-index'}))
		.pipe(() => htmlFilter.restore);
}

/**
 * Creates the <meta> tag for the Content-Security-Policy
 * 
 * It enables by default access to Youtube, Google Analytics, and Google fonts.
 * 
 * @return {string} Meta tag with CSP rules
 */
function createMetaCsp(source, connectSrc = [], defaultSrc = [], frameSrc = []) {
	const cspConnectSrc = [
		'self:',
		source === DEFAULT_SOURCE ? 'file:' : source,
		...connectSrc
	];

	// Allow playing embeded Youtube videos
	const cspDefaultSrc = [
		'https://www.google-analytics.com',
		'https://www.youtube.com',
		'https://s.ytimg.com',
		...defaultSrc,
	];
	const cspFrameSrc = [
		'https://www.youtube.com',
		...frameSrc
	];

	const cspRules = {
		'default-src': `'self' data: gap: https://ssl.gstatic.com 'unsafe-eval' 'unsafe-inline' ${cspDefaultSrc.join(' ')}`,
		'media-src': 'data: *',
		'img-src': 'data: blob: *',
		'font-src': 'data: \'self\' https://fonts.gstatic.com',
		'style-src': '\'self\' \'unsafe-inline\' https://fonts.googleapis.com',
		'connect-src': cspConnectSrc.join(' '),
		'frame-src': cspFrameSrc.join(' '),
		'child-src': cspFrameSrc.join(' '),
	};

{'fraction_non_alphanumeric': 0.1849894291754757, 'fraction_numerical': 0.0, 'mean_word_length': 4.198901098901099, 'pattern_counts': {'":': 0, '<': 13, '<?xml version=': 0, '>': 23, 'https://': 14, 'lorem ipsum': 0, 'www.': 6, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3707250', 'n_tokens_mistral': 1595, 'n_tokens_neox': 1503, 'n_words': 411}