Support multiple comma-separated policies in a single header.

Munter · Feb 23, 2017 · f8f0905 · f8f0905
1 parent 8a72328
commit f8f0905
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 9 deletions.
diff --git a/lib/index.js b/lib/index.js
@@ -96,15 +96,20 @@ const lookupTargetCspLevelInCanIUseDb = memoizeSync((family, major, minor) => {
 });
 
 const downgradeAndSerializeCsp = memoizeSync((cspStr, targetCspLevel) => {
-    const parsedCsp = parseCsp(cspStr);
-    let downgradedCsp = parsedCsp;
-    if (targetCspLevel < 3) {
-        downgradedCsp = downgradeCsp3ToCsp2(downgradedCsp);
-    }
-    if (targetCspLevel < 2) {
-        downgradedCsp = downgradeCsp2ToCsp1(downgradedCsp);
-    }
-    return serializeCsp(downgradedCsp);
+    // Process multiple comma-separated policies separately:
+    return cspStr
+        .split(/,\s*/)
+        .map(cspStr => {
+            let csp = parseCsp(cspStr);
+            if (targetCspLevel < 3) {
+                csp = downgradeCsp3ToCsp2(csp);
+            }
+            if (targetCspLevel < 2) {
+                csp = downgradeCsp2ToCsp1(csp);
+            }
+            return serializeCsp(csp);
+        })
+        .join(', ');
 });
 
 module.exports = (config = {}) => {

diff --git a/test/index.js b/test/index.js
@@ -48,6 +48,21 @@ describe('with multiple CSP headers', function () {
     });
 });
 
+describe('with multiple comma-separated policies in a single header', function () {
+    // Safari 7
+    beforeEach(() => {
+        userAgentString = 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_3) AppleWebKit/537.75.14 (KHTML, like Gecko) Version/7.0.3 Safari/7046A194A';
+    });
+
+    it('should each contained policy individually and reassemble them', function () {
+        return expect(
+            "script-src somewhere.com/with/a/path, script-src 'sha256-XeYlw2NVzOfB1UCIJqCyGr+0n7bA4fFslFpvKu84IAw='",
+            'to come out as',
+            "script-src somewhere.com, script-src 'unsafe-inline'"
+        );
+    });
+});
+
 describe('with a "report only" CSP header', function () {
     describe('in a browser that does not require the "base" header name to be changed', function () {
         // Safari 7