<commit_before>'user strict';

var helmet = require('helmet');

var securityHeaders = function (app, forceSecure) {
    
    app.set('x-powered-by', false);
    var ninetyDaysInMilliseconds = 7776000000;
    app.use(helmet.hsts({ maxAge: ninetyDaysInMilliseconds, force: forceSecure }));
    app.use(helmet.frameguard('deny'));
    app.use(helmet.hidePoweredBy());
    app.use(helmet.noSniff());
    app.use(helmet.xssFilter());
    // can't currently use CSP as i would like because various 3rd party libs are using inline style and javascript eval()
    app.use(helmet.csp({
        directives: {
            defaultSrc: ["'none'"],
            scriptSrc: ["'self'", "'unsafe-eval'"], //needed for lodash and nools
            connectSrc: ["'self'", 'https://raw.githubusercontent.com'],
            styleSrc: ["'self'", 'http://fonts.googleapis.com', 'https://fonts.googleapis.com', "'unsafe-inline'"], //needed for jquery
            imgSrc: ["'self'", 'data:'],
            fontSrc: ["'self'", 'http://fonts.gstatic.com', 'https://fonts.gstatic.com'],
            formAction: ["'self'", 'https://github.com'],
            reportUri: 'https://report-uri.io/report/owaspthreatdragon'
        }
    }));
};

module.exports = securityHeaders;<commit_msg>fixed failing security headers config test<commit_after>'user strict';

var helmet = require('helmet');

var securityHeaders = function (app, forceSecure) {
    
    app.set('x-powered-by', false);
    var ninetyDaysInMilliseconds = 7776000000;
    app.use(helmet.hsts({ maxAge: ninetyDaysInMilliseconds, force: forceSecure }));
    app.use(helmet.frameguard('deny'));
    app.use(helmet.hidePoweredBy());
    app.use(helmet.noSniff());
    app.use(helmet.xssFilter());
    // can't currently use CSP as i would like because various 3rd party libs are using inline style and javascript eval()
    app.use(helmet.csp({
        directives: {
            defaultSrc: ["'none'"],
            scriptSrc: ["'self'", "'unsafe-eval'"], //needed for lodash and nools
            connectSrc: ["'self'"],
            styleSrc: ["'self'", 'http://fonts.googleapis.com', 'https://fonts.googleapis.com', "'unsafe-inline'"], //needed for jquery
            imgSrc: ["'self'", 'data:'],
            fontSrc: ["'self'", 'http://fonts.gstatic.com', 'https://fonts.gstatic.com'],
            formAction: ["'self'", 'https://github.com'],
            reportUri: 'https://report-uri.io/report/owaspthreatdragon'
        }
    }));
};

module.exports = securityHeaders;
{'fraction_non_alphanumeric': 0.17665867306155075, 'fraction_numerical': 0.008792965627498001, 'mean_word_length': 3.110016420361248, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 9, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '7571224', 'n_tokens_mistral': 814, 'n_tokens_neox': 769, 'n_words': 165}