cockpit_web_response_security_policy (const gchar *content_security_policy,
                                      const gchar *self_origin)
{
  const gchar *default_src = "default-src 'self'";
  const gchar *form_action = "form-action 'self'";
  const gchar *base_uri = "base-uri 'self'";
  const gchar *object_src = "object-src 'none'";
  const gchar *font_src = "font-src 'self' data:";
  const gchar *img_src = "img-src 'self' data:";
  const gchar *block_all_mixed_content = "block-all-mixed-content";
  gchar **parts = NULL;
  GString *result;
  gint i;

  result = g_string_sized_new (128);

  /*
   * Note that browsers need to be explicitly told they can connect
   * to a WebSocket. This is non-obvious, but it stems from the fact
   * that some browsers treat 'https' and 'wss' as different protocols.
   *
   * Since each component could establish a WebSocket connection back to
   * cockpit-ws, we need to insert that into the policy.
   */

  if (content_security_policy)
    parts = g_strsplit (content_security_policy, ";", -1);

  for (i = 0; parts && parts[i] != NULL; i++)
    g_strstrip (parts[i]);

  if (!strv_have_prefix (parts, "default-src "))
    g_string_append_printf (result, "%s; ", default_src);
  if (!strv_have_prefix (parts, "connect-src "))
    {
      g_string_append (result, "connect-src 'self'");
      if (self_origin && g_str_has_prefix (self_origin, "http"))
        g_string_append_printf (result, " ws%s", self_origin + 4);
      g_string_append (result, "; ");
    }
  if (!strv_have_prefix (parts, "form-action "))
    g_string_append_printf (result, "%s; ", form_action);
  if (!strv_have_prefix (parts, "base-uri "))
    g_string_append_printf (result, "%s; ", base_uri);
  if (!strv_have_prefix (parts, "object-src "))
    g_string_append_printf (result, "%s; ", object_src);
  if (!strv_have_prefix (parts, "font-src "))
    g_string_append_printf (result, "%s; ", font_src);
  if (!strv_have_prefix (parts, "img-src "))
    g_string_append_printf (result, "%s; ", img_src);
  if (!strv_have_prefix (parts, "block-all-mixed-content"))
    g_string_append_printf (result, "%s; ", block_all_mixed_content);

  for (i = 0; parts && parts[i] != NULL; i++)
    g_string_append_printf (result, "%s; ", parts[i]);

  g_strfreev (parts);

  /* Remove trailing semicolon */
  g_string_set_size (result, result->len - 2);

  /* Put in our own origin */
  if (self_origin)
    string_inject_origin (result, self_origin);

  return g_string_free (result, FALSE);
}
cockpit_web_response_security_policy (const gchar *content_security_policy,
                                      const gchar *self_origin)
{
  const gchar *default_src = "default-src 'self'";
  const gchar *form_action = "form-action 'self'";
  const gchar *base_uri = "base-uri 'self'";
  const gchar *object_src = "object-src 'none'";
  const gchar *font_src = "font-src 'self' data:";
  const gchar *img_src = "img-src 'self' data:";
  const gchar *block_all_mixed_content = "block-all-mixed-content";
  gchar **parts = NULL;
  GString *result;
  gint i;

  result = g_string_sized_new (128);

   

  if (content_security_policy)
    parts = g_strsplit (content_security_policy, ";", -1);

  for (i = 0; parts && parts[i] != NULL; i++)
    g_strstrip (parts[i]);

  if (!strv_have_prefix (parts, "default-src "))
    g_string_append_printf (result, "%s; ", default_src);
  if (!strv_have_prefix (parts, "connect-src "))
    {
      g_string_append (result, "connect-src 'self'");
      if (self_origin && g_str_has_prefix (self_origin, "http"))
        g_string_append_printf (result, " ws%s", self_origin + 4);
      g_string_append (result, "; ");
    }
  if (!strv_have_prefix (parts, "form-action "))
    g_string_append_printf (result, "%s; ", form_action);
  if (!strv_have_prefix (parts, "base-uri "))
    g_string_append_printf (result, "%s; ", base_uri);
  if (!strv_have_prefix (parts, "object-src "))
    g_string_append_printf (result, "%s; ", object_src);
  if (!strv_have_prefix (parts, "font-src "))
    g_string_append_printf (result, "%s; ", font_src);
  if (!strv_have_prefix (parts, "img-src "))
    g_string_append_printf (result, "%s; ", img_src);
  if (!strv_have_prefix (parts, "block-all-mixed-content"))
    g_string_append_printf (result, "%s; ", block_all_mixed_content);

  for (i = 0; parts && parts[i] != NULL; i++)
    g_string_append_printf (result, "%s; ", parts[i]);

  g_strfreev (parts);

   
  g_string_set_size (result, result->len - 2);

   
  if (self_origin)
    string_inject_origin (result, self_origin);

  return g_string_free (result, FALSE);
}