// File: /workspace/github_c_makefile_star2_O3/icebert[P]pblat/lib/htmshell.c
// Function: getCspPolicyString
char *getCspPolicyString()
/* get the policy string */
{
// example "default-src 'self'; child-src 'none'; object-src 'none'"
struct dyString *policy = dyStringNew(1024);
dyStringAppend(policy, "default-src *;");

/* more secure method not used yet 
dyStringAppend(policy, "default-src 'self';");

dyStringAppend(policy, "  child-src 'self';");
*/

dyStringAppend(policy, " script-src 'self' blob:");
// Trick for backwards compatibility with browsers that understand CSP1 but not nonces (CSP2).
dyStringAppend(policy, " 'unsafe-inline'");
// For browsers that DO understand nonces and CSP2, they ignore 'unsafe-inline' in script if nonce is present.
char *noncePolicy=getNoncePolicy();
dyStringPrintf(policy, " %s", noncePolicy);
freeMem(noncePolicy);
dyStringAppend(policy, " code.jquery.com");          // used by hgIntegrator jsHelper and others
dyStringAppend(policy, " www.google-analytics.com"); // used by google analytics
// cirm cdw lib and web browse
dyStringAppend(policy, " www.samsarin.com/project/dagre-d3/latest/dagre-d3.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/d3/3.4.4/d3.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/jquery/1.12.1/jquery.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/jstree/3.2.1/jstree.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/bowser/1.6.1/bowser.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/jstree/3.3.4/jstree.min.js");
dyStringAppend(policy, " login.persona.org/include.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js");
// expMatrix
dyStringAppend(policy, " ajax.googleapis.com");
dyStringAppend(policy, " maxcdn.bootstrapcdn.com");
dyStringAppend(policy, " d3js.org/d3.v3.min.js");
// jsHelper
dyStringAppend(policy, " cdn.datatables.net");

dyStringAppend(policy, ";");


dyStringAppend(policy, " style-src * 'unsafe-inline';");

/* more secure method not used yet 
dyStringAppend(policy, " style-src 'self' 'unsafe-inline'");
dyStringAppend(policy, " code.jquery.com");          // used by hgIntegrator
dyStringAppend(policy, " netdna.bootstrapcdn.com");  // used by hgIntegrator
dyStringAppend(policy, " fonts.googleapis.com");    // used by hgGateway
dyStringAppend(policy, " maxcdn.bootstrapcdn.com"); // used by hgGateway
dyStringAppend(policy, ";");
*/

// The data: protocol is used by popular browser extensions.
// It seems to be safe and it is too bad that it must be explicitly included.
dyStringAppend(policy, " font-src * data:;");

/* more secure method not used yet 
dyStringAppend(policy, " font-src 'self'");
dyStringAppend(policy, " netdna.bootstrapcdn.com");  // used by hgIntegrator
dyStringAppend(policy, " maxcdn.bootstrapcdn.com"); // used by hgGateway
dyStringAppend(policy, " fonts.gstatic.com");       // used by hgGateway
dyStringAppend(policy, ";");

dyStringAppend(policy, " object-src 'none';");

*/

dyStringAppend(policy, " img-src * data:;");  

/* more secure method not used yet 
dyStringAppend(policy, " img-src 'self'");
// used by hgGene for modbaseimages in hg/hgc/lowelab.c hg/protein/lib/domains.c hg/hgGene/domains.c
dyStringAppend(policy, " modbase.compbio.ucsf.edu");  
dyStringAppend(policy, " hgwdev.gi.ucsc.edu"); // used by visiGene
dyStringAppend(policy, " genome.ucsc.edu"); // used by visiGene
dyStringAppend(policy, " code.jquery.com");          // used by hgIntegrator
dyStringAppend(policy, " www.google-analytics.com"); // used by google analytics
dyStringAppend(policy, " stats.g.doubleclick.net"); // used by google analytics
dyStringAppend(policy, ";");
*/
return dyStringCannibalize(&policy);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x10, %rsp
movl $0x400, %edi            # imm = 0x400
callq 0x264e0
movq %rax, %r14
leaq 0x8(%rsp), %rbx
movq %rax, (%rbx)
leaq 0x4e1f1(%rip), %rsi     # 0x97063
movq %rax, %rdi
callq 0x2674f
leaq 0x4e1f1(%rip), %rsi     # 0x97072
movq %r14, %rdi
callq 0x2674f
leaq 0x4e1fb(%rip), %rsi     # 0x9708b
movq %r14, %rdi
callq 0x2674f
callq 0x48dfb
movq %rax, %r15
leaq 0x48227(%rip), %rsi     # 0x910ce
movq %r14, %rdi
movq %rax, %rdx
xorl %eax, %eax
callq 0x26883
movq %r15, %rdi
callq 0x2e0a0
leaq 0x4e1d9(%rip), %rsi     # 0x9709c
movq %r14, %rdi
callq 0x2674f
leaq 0x4e1db(%rip), %rsi     # 0x970ad
movq %r14, %rdi
callq 0x2674f
leaq 0x4e1e6(%rip), %rsi     # 0x970c7
movq %r14, %rdi
callq 0x2674f
leaq 0x4e20d(%rip), %rsi     # 0x970fd
movq %r14, %rdi
callq 0x2674f
leaq 0x4e231(%rip), %rsi     # 0x97130
movq %r14, %rdi
callq 0x2674f
leaq 0x4e25e(%rip), %rsi     # 0x9716c
movq %r14, %rdi
callq 0x2674f
leaq 0x4e28a(%rip), %rsi     # 0x971a7
movq %r14, %rdi
callq 0x2674f
leaq 0x4e2b6(%rip), %rsi     # 0x971e2
movq %r14, %rdi
callq 0x2674f
leaq 0x4e2e2(%rip), %rsi     # 0x9721d
movq %r14, %rdi
callq 0x2674f
leaq 0x4e2f1(%rip), %rsi     # 0x9723b
movq %r14, %rdi
callq 0x2674f
leaq 0x4e325(%rip), %rsi     # 0x9727e
movq %r14, %rdi
callq 0x2674f
leaq 0x4e32b(%rip), %rsi     # 0x97293
movq %r14, %rdi
callq 0x2674f
leaq 0x4e335(%rip), %rsi     # 0x972ac
movq %r14, %rdi
callq 0x2674f
leaq 0x4e33d(%rip), %rsi     # 0x972c3
movq %r14, %rdi
callq 0x2674f
leaq 0x4cf8f(%rip), %rsi     # 0x95f24
movq %r14, %rdi
callq 0x2674f
leaq 0x4e333(%rip), %rsi     # 0x972d7
movq %r14, %rdi
callq 0x2674f
leaq 0x4e342(%rip), %rsi     # 0x972f5
movq %r14, %rdi
callq 0x2674f
leaq 0x4e346(%rip), %rsi     # 0x97308
movq %r14, %rdi
callq 0x2674f
movq %rbx, %rdi
callq 0x2653c
addq $0x10, %rsp
popq %rbx
popq %r14
popq %r15
retq