// File: /workspace/github_c_makefile_star2_O2/icebert[P]pblat/lib/htmshell.c
// Function: getCspPolicyString
char *getCspPolicyString()
/* get the policy string */
{
// example "default-src 'self'; child-src 'none'; object-src 'none'"
struct dyString *policy = dyStringNew(1024);
dyStringAppend(policy, "default-src *;");

/* more secure method not used yet 
dyStringAppend(policy, "default-src 'self';");

dyStringAppend(policy, "  child-src 'self';");
*/

dyStringAppend(policy, " script-src 'self' blob:");
// Trick for backwards compatibility with browsers that understand CSP1 but not nonces (CSP2).
dyStringAppend(policy, " 'unsafe-inline'");
// For browsers that DO understand nonces and CSP2, they ignore 'unsafe-inline' in script if nonce is present.
char *noncePolicy=getNoncePolicy();
dyStringPrintf(policy, " %s", noncePolicy);
freeMem(noncePolicy);
dyStringAppend(policy, " code.jquery.com");          // used by hgIntegrator jsHelper and others
dyStringAppend(policy, " www.google-analytics.com"); // used by google analytics
// cirm cdw lib and web browse
dyStringAppend(policy, " www.samsarin.com/project/dagre-d3/latest/dagre-d3.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/d3/3.4.4/d3.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/jquery/1.12.1/jquery.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/jstree/3.2.1/jstree.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/bowser/1.6.1/bowser.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/jstree/3.3.4/jstree.min.js");
dyStringAppend(policy, " login.persona.org/include.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js");
// expMatrix
dyStringAppend(policy, " ajax.googleapis.com");
dyStringAppend(policy, " maxcdn.bootstrapcdn.com");
dyStringAppend(policy, " d3js.org/d3.v3.min.js");
// jsHelper
dyStringAppend(policy, " cdn.datatables.net");

dyStringAppend(policy, ";");


dyStringAppend(policy, " style-src * 'unsafe-inline';");

/* more secure method not used yet 
dyStringAppend(policy, " style-src 'self' 'unsafe-inline'");
dyStringAppend(policy, " code.jquery.com");          // used by hgIntegrator
dyStringAppend(policy, " netdna.bootstrapcdn.com");  // used by hgIntegrator
dyStringAppend(policy, " fonts.googleapis.com");    // used by hgGateway
dyStringAppend(policy, " maxcdn.bootstrapcdn.com"); // used by hgGateway
dyStringAppend(policy, ";");
*/

// The data: protocol is used by popular browser extensions.
// It seems to be safe and it is too bad that it must be explicitly included.
dyStringAppend(policy, " font-src * data:;");

/* more secure method not used yet 
dyStringAppend(policy, " font-src 'self'");
dyStringAppend(policy, " netdna.bootstrapcdn.com");  // used by hgIntegrator
dyStringAppend(policy, " maxcdn.bootstrapcdn.com"); // used by hgGateway
dyStringAppend(policy, " fonts.gstatic.com");       // used by hgGateway
dyStringAppend(policy, ";");

dyStringAppend(policy, " object-src 'none';");

*/

dyStringAppend(policy, " img-src * data:;");  

/* more secure method not used yet 
dyStringAppend(policy, " img-src 'self'");
// used by hgGene for modbaseimages in hg/hgc/lowelab.c hg/protein/lib/domains.c hg/hgGene/domains.c
dyStringAppend(policy, " modbase.compbio.ucsf.edu");  
dyStringAppend(policy, " hgwdev.gi.ucsc.edu"); // used by visiGene
dyStringAppend(policy, " genome.ucsc.edu"); // used by visiGene
dyStringAppend(policy, " code.jquery.com");          // used by hgIntegrator
dyStringAppend(policy, " www.google-analytics.com"); // used by google analytics
dyStringAppend(policy, " stats.g.doubleclick.net"); // used by google analytics
dyStringAppend(policy, ";");
*/
return dyStringCannibalize(&policy);
}

// Assembly:
pushq %r15
pushq %r14
pushq %rbx
subq $0x10, %rsp
movl $0x400, %edi            # imm = 0x400
callq 0x21bcc
movq %rax, %r14
leaq 0x8(%rsp), %rbx
movq %rax, (%rbx)
leaq 0x437a9(%rip), %rsi     # 0x85f63
movq %rax, %rdi
callq 0x21dda
leaq 0x437a9(%rip), %rsi     # 0x85f72
movq %r14, %rdi
callq 0x21dda
leaq 0x437b3(%rip), %rsi     # 0x85f8b
movq %r14, %rdi
callq 0x21dda
callq 0x4275b
movq %rax, %r15
leaq 0x3d7df(%rip), %rsi     # 0x7ffce
movq %r14, %rdi
movq %rax, %rdx
xorl %eax, %eax
callq 0x21ec7
movq %r15, %rdi
callq 0x28c2d
leaq 0x43791(%rip), %rsi     # 0x85f9c
movq %r14, %rdi
callq 0x21dda
leaq 0x43793(%rip), %rsi     # 0x85fad
movq %r14, %rdi
callq 0x21dda
leaq 0x4379e(%rip), %rsi     # 0x85fc7
movq %r14, %rdi
callq 0x21dda
leaq 0x437c5(%rip), %rsi     # 0x85ffd
movq %r14, %rdi
callq 0x21dda
leaq 0x437e9(%rip), %rsi     # 0x86030
movq %r14, %rdi
callq 0x21dda
leaq 0x43816(%rip), %rsi     # 0x8606c
movq %r14, %rdi
callq 0x21dda
leaq 0x43842(%rip), %rsi     # 0x860a7
movq %r14, %rdi
callq 0x21dda
leaq 0x4386e(%rip), %rsi     # 0x860e2
movq %r14, %rdi
callq 0x21dda
leaq 0x4389a(%rip), %rsi     # 0x8611d
movq %r14, %rdi
callq 0x21dda
leaq 0x438a9(%rip), %rsi     # 0x8613b
movq %r14, %rdi
callq 0x21dda
leaq 0x438dd(%rip), %rsi     # 0x8617e
movq %r14, %rdi
callq 0x21dda
leaq 0x438e3(%rip), %rsi     # 0x86193
movq %r14, %rdi
callq 0x21dda
leaq 0x438ed(%rip), %rsi     # 0x861ac
movq %r14, %rdi
callq 0x21dda
leaq 0x438f5(%rip), %rsi     # 0x861c3
movq %r14, %rdi
callq 0x21dda
leaq 0x42547(%rip), %rsi     # 0x84e24
movq %r14, %rdi
callq 0x21dda
leaq 0x438eb(%rip), %rsi     # 0x861d7
movq %r14, %rdi
callq 0x21dda
leaq 0x438fa(%rip), %rsi     # 0x861f5
movq %r14, %rdi
callq 0x21dda
leaq 0x438fe(%rip), %rsi     # 0x86208
movq %r14, %rdi
callq 0x21dda
movq %rbx, %rdi
callq 0x21c26
addq $0x10, %rsp
popq %rbx
popq %r14
popq %r15
retq