// File: /workspace/github_c_makefile_star2_O1/icebert[P]pblat/lib/htmshell.c
// Function: getCspPolicyString
char *getCspPolicyString()
/* get the policy string */
{
// example "default-src 'self'; child-src 'none'; object-src 'none'"
struct dyString *policy = dyStringNew(1024);
dyStringAppend(policy, "default-src *;");

/* more secure method not used yet 
dyStringAppend(policy, "default-src 'self';");

dyStringAppend(policy, "  child-src 'self';");
*/

dyStringAppend(policy, " script-src 'self' blob:");
// Trick for backwards compatibility with browsers that understand CSP1 but not nonces (CSP2).
dyStringAppend(policy, " 'unsafe-inline'");
// For browsers that DO understand nonces and CSP2, they ignore 'unsafe-inline' in script if nonce is present.
char *noncePolicy=getNoncePolicy();
dyStringPrintf(policy, " %s", noncePolicy);
freeMem(noncePolicy);
dyStringAppend(policy, " code.jquery.com");          // used by hgIntegrator jsHelper and others
dyStringAppend(policy, " www.google-analytics.com"); // used by google analytics
// cirm cdw lib and web browse
dyStringAppend(policy, " www.samsarin.com/project/dagre-d3/latest/dagre-d3.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/d3/3.4.4/d3.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/jquery/1.12.1/jquery.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/jstree/3.2.1/jstree.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/bowser/1.6.1/bowser.min.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/jstree/3.3.4/jstree.min.js");
dyStringAppend(policy, " login.persona.org/include.js");
dyStringAppend(policy, " cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js");
// expMatrix
dyStringAppend(policy, " ajax.googleapis.com");
dyStringAppend(policy, " maxcdn.bootstrapcdn.com");
dyStringAppend(policy, " d3js.org/d3.v3.min.js");
// jsHelper
dyStringAppend(policy, " cdn.datatables.net");

dyStringAppend(policy, ";");


dyStringAppend(policy, " style-src * 'unsafe-inline';");

/* more secure method not used yet 
dyStringAppend(policy, " style-src 'self' 'unsafe-inline'");
dyStringAppend(policy, " code.jquery.com");          // used by hgIntegrator
dyStringAppend(policy, " netdna.bootstrapcdn.com");  // used by hgIntegrator
dyStringAppend(policy, " fonts.googleapis.com");    // used by hgGateway
dyStringAppend(policy, " maxcdn.bootstrapcdn.com"); // used by hgGateway
dyStringAppend(policy, ";");
*/

// The data: protocol is used by popular browser extensions.
// It seems to be safe and it is too bad that it must be explicitly included.
dyStringAppend(policy, " font-src * data:;");

/* more secure method not used yet 
dyStringAppend(policy, " font-src 'self'");
dyStringAppend(policy, " netdna.bootstrapcdn.com");  // used by hgIntegrator
dyStringAppend(policy, " maxcdn.bootstrapcdn.com"); // used by hgGateway
dyStringAppend(policy, " fonts.gstatic.com");       // used by hgGateway
dyStringAppend(policy, ";");

dyStringAppend(policy, " object-src 'none';");

*/

dyStringAppend(policy, " img-src * data:;");  

/* more secure method not used yet 
dyStringAppend(policy, " img-src 'self'");
// used by hgGene for modbaseimages in hg/hgc/lowelab.c hg/protein/lib/domains.c hg/hgGene/domains.c
dyStringAppend(policy, " modbase.compbio.ucsf.edu");  
dyStringAppend(policy, " hgwdev.gi.ucsc.edu"); // used by visiGene
dyStringAppend(policy, " genome.ucsc.edu"); // used by visiGene
dyStringAppend(policy, " code.jquery.com");          // used by hgIntegrator
dyStringAppend(policy, " www.google-analytics.com"); // used by google analytics
dyStringAppend(policy, " stats.g.doubleclick.net"); // used by google analytics
dyStringAppend(policy, ";");
*/
return dyStringCannibalize(&policy);
}

// Assembly:
pushq %r14
pushq %rbx
pushq %rax
movl $0x400, %edi            # imm = 0x400
callq 0x261d0
movq %rsp, %rbx
movq %rax, (%rbx)
leaq 0x4e462(%rip), %rsi     # 0x96f83
movq %rax, %rdi
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e45f(%rip), %rsi     # 0x96f92
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e469(%rip), %rsi     # 0x96fab
callq 0x26425
callq 0x48ab2
movq %rax, %r14
movq (%rbx), %rdi
leaq 0x48485(%rip), %rsi     # 0x90fde
movq %rax, %rdx
xorl %eax, %eax
callq 0x2656a
movq %r14, %rdi
callq 0x2dd41
movq (%rbx), %rdi
leaq 0x4e447(%rip), %rsi     # 0x96fbc
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e449(%rip), %rsi     # 0x96fcd
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e454(%rip), %rsi     # 0x96fe7
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e47b(%rip), %rsi     # 0x9701d
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e49f(%rip), %rsi     # 0x97050
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e4cc(%rip), %rsi     # 0x9708c
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e4f8(%rip), %rsi     # 0x970c7
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e524(%rip), %rsi     # 0x97102
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e550(%rip), %rsi     # 0x9713d
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e55f(%rip), %rsi     # 0x9715b
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e593(%rip), %rsi     # 0x9719e
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e599(%rip), %rsi     # 0x971b3
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e5a3(%rip), %rsi     # 0x971cc
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e5ab(%rip), %rsi     # 0x971e3
callq 0x26425
movq (%rbx), %rdi
leaq 0x4d1fd(%rip), %rsi     # 0x95e44
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e5a1(%rip), %rsi     # 0x971f7
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e5b0(%rip), %rsi     # 0x97215
callq 0x26425
movq (%rbx), %rdi
leaq 0x4e5b4(%rip), %rsi     # 0x97228
callq 0x26425
movq %rbx, %rdi
callq 0x2622c
addq $0x8, %rsp
popq %rbx
popq %r14
retq