minify Content-Security-Policy (#1014)

fixes #947
kangax · Apr 1, 2019 · 47b7042 · 47b7042
1 parent c810fa3
commit 47b7042
Show file tree

Hide file tree

Showing 2 changed files with 29 additions and 0 deletions.
diff --git a/src/htmlminifier.js b/src/htmlminifier.js
@@ -311,6 +311,9 @@ function cleanAttributeValue(tag, attrName, attrValue, options, attrs) {
       return (+numString).toString();
     });
   }
+  else if (isContentSecurityPolicy(tag, attrs) && attrName.toLowerCase() === 'content') {
+    return collapseWhitespaceAll(attrValue);
+  }
   else if (options.customAttrCollapse && options.customAttrCollapse.test(attrName)) {
     attrValue = attrValue.replace(/\n+|\r+|\s{2,}/g, '');
   }
@@ -335,6 +338,17 @@ function isMetaViewport(tag, attrs) {
   }
 }
 
+function isContentSecurityPolicy(tag, attrs) {
+  if (tag !== 'meta') {
+    return false;
+  }
+  for (var i = 0, len = attrs.length; i < len; i++) {
+    if (attrs[i].name.toLowerCase() === 'http-equiv' && attrs[i].value.toLowerCase() === 'content-security-policy') {
+      return true;
+    }
+  }
+}
+
 function ignoreCSS(id) {
   return '/* clean-css ignore:start */' + id + '/* clean-css ignore:end */';
 }

diff --git a/tests/minifier.js b/tests/minifier.js
@@ -3549,3 +3549,18 @@ QUnit.test('canCollapseWhitespace and canTrimWhitespace hooks', function(assert)
     canCollapseWhitespace: canCollapseAndTrimWhitespace
   }), output);
 });
+
+QUnit.test('minify Content-Security-Policy', function(assert) {
+  var input, output;
+
+  input = '<meta Http-Equiv="Content-Security-Policy"\t\t\t\tContent="default-src \'self\';\n\n\t\timg-src https://*;">';
+  output = '<meta http-equiv="Content-Security-Policy" content="default-src \'self\'; img-src https://*;">';
+  assert.equal(minify(input), output);
+
+  input = '<meta http-equiv="content-security-policy"\t\t\t\tcontent="default-src \'self\';\n\n\t\timg-src https://*;">';
+  output = '<meta http-equiv="content-security-policy" content="default-src \'self\'; img-src https://*;">';
+  assert.equal(minify(input), output);
+
+  input = '<meta http-equiv="content-security-policy" content="default-src \'self\'; img-src https://*;">';
+  assert.equal(minify(input), input);
+});