<commit_before>"use strict";

let hood = require("hood");
let helmet = require("helmet");
let csurf = require("csurf");

const defaultTrustedDomains = {
  default: [ "'self'" ],
  connection: [
                "'self'",
                "https://pontoon.mozilla.org"
              ],
  frame: [
          "'self'",
          "https://docs.google.com"
         ],
  iframe: [
            "https://pontoon.mozilla.org"
          ],
  font: [
          "'self'",
          "https://fonts.gstatic.com",
          "https://netdna.bootstrapcdn.com",
          "https://code.cdn.mozilla.net/",
          "https://pontoon.mozilla.org"
        ],
  image: [ "*" ],
  media: [ "*" ],
  script: [
            "'self'",
            "http://mozorg.cdn.mozilla.net",
            "https://ajax.googleapis.com",
            "https://mozorg.cdn.mozilla.net",
            "https://www.google-analytics.com",
            "https://pontoon.mozilla.org"
          ],
  stylesheet: [
                "'self'",
                "http://mozorg.cdn.mozilla.net",
                "https://ajax.googleapis.com",
                "https://fonts.googleapis.com",
                "https://mozorg.cdn.mozilla.net",
                "https://netdna.bootstrapcdn.com",
                "https://pontoon.mozilla.org"
              ]
};

function Security(server) {
  this.server = server;
}

Security.prototype = {
  csp(domainList) {
    domainList = domainList || {};
    Object.keys(defaultTrustedDomains).forEach(mimeType => {
      let domainsToAdd = domainList[mimeType];
      let defaultDomains = defaultTrustedDomains[mimeType];

      if(domainsToAdd && defaultDomains.indexOf("*") !== -1) {
        domainList[mimeType] = domainsToAdd;
      } else {
        domainList[mimeType] = defaultDomains.concat((domainsToAdd || []));
      }
    });

    this.server.use(hood.csp({
      headers: [ "Content-Security-Policy-Report-Only" ],
      policy: {
        "default-src": domainList.default,
        "connect-src": domainList.connection,
        "frame-src": domainList.frame,
        "child-src": domainList.iframe,
        "font-src": domainList.font,
        "img-src": domainList.image,
        "media-src": domainList.media,
        "script-src": domainList.script,
        "style-src": domainList.stylesheet
      }
    }));

    return this;
  },
  ssl() {
    this.server.use(helmet.hsts());
    this.server.enable("trust proxy");

    return this;
  },
  xss() {
    this.server.use(helmet.xssFilter());
    return this;
  },
  mimeSniff() {
    this.server.use(helmet.noSniff());
    return this;
  },
  csrf() {
    this.server.use(csurf());
    return this;
  },
  xframe() {
    this.server.use(helmet.xframe());
    return this;
  }
};

module.exports = Security;<commit_msg>Allow Pontoon to frame Thimble<commit_after>"use strict";

let hood = require("hood");
let helmet = require("helmet");
let csurf = require("csurf");

const defaultTrustedDomains = {
  default: [ "'self'" ],
  connection: [
                "'self'",
                "https://pontoon.mozilla.org"
              ],
  frame: [
          "'self'",
          "https://docs.google.com"
         ],
  iframe: [
            "https://pontoon.mozilla.org"
          ],
  font: [
          "'self'",
          "https://fonts.gstatic.com",
          "https://netdna.bootstrapcdn.com",
          "https://code.cdn.mozilla.net/",
          "https://pontoon.mozilla.org"
        ],
  image: [ "*" ],
  media: [ "*" ],
  script: [
            "'self'",
            "http://mozorg.cdn.mozilla.net",
            "https://ajax.googleapis.com",
            "https://mozorg.cdn.mozilla.net",
            "https://www.google-analytics.com",
            "https://pontoon.mozilla.org"
          ],
  stylesheet: [
                "'self'",
                "http://mozorg.cdn.mozilla.net",
                "https://ajax.googleapis.com",
                "https://fonts.googleapis.com",
                "https://mozorg.cdn.mozilla.net",
                "https://netdna.bootstrapcdn.com",
                "https://pontoon.mozilla.org"
              ]
};

function Security(server) {
  this.server = server;
}

Security.prototype = {
  csp(domainList) {
    domainList = domainList || {};
    Object.keys(defaultTrustedDomains).forEach(mimeType => {
      let domainsToAdd = domainList[mimeType];
      let defaultDomains = defaultTrustedDomains[mimeType];

      if(domainsToAdd && defaultDomains.indexOf("*") !== -1) {
        domainList[mimeType] = domainsToAdd;
      } else {
        domainList[mimeType] = defaultDomains.concat((domainsToAdd || []));
      }
    });

    this.server.use(hood.csp({
      headers: [ "Content-Security-Policy-Report-Only" ],
      policy: {
        "default-src": domainList.default,
        "connect-src": domainList.connection,
        "frame-src": domainList.frame,
        "child-src": domainList.iframe,
        "font-src": domainList.font,
        "img-src": domainList.image,
        "media-src": domainList.media,
        "script-src": domainList.script,
        "style-src": domainList.stylesheet
      }
    }));

    return this;
  },
  ssl() {
    this.server.use(helmet.hsts());
    this.server.enable("trust proxy");

    return this;
  },
  xss() {
    this.server.use(helmet.xssFilter());
    return this;
  },
  mimeSniff() {
    this.server.use(helmet.noSniff());
    return this;
  },
  csrf() {
    this.server.use(csurf());
    return this;
  },
  xframe() {
    this.server.use(helmet.xframe("allow-from", "https://pontoon.mozilla.org"));
    return this;
  }
};

module.exports = Security;
{'fraction_non_alphanumeric': 0.17222222222222222, 'fraction_numerical': 0.00035842293906810036, 'mean_word_length': 1.9765333333333333, 'pattern_counts': {'":': 18, '<': 3, '<?xml version=': 0, '>': 5, 'https://': 33, 'lorem ipsum': 0, 'www.': 2, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '2596767', 'n_tokens_mistral': 1837, 'n_tokens_neox': 1747, 'n_words': 238}