mozilla / addons-linter / 3763

100%

push

travis-ci

Parse and validate CSP rules more properly. (#1434)

* First take on #1298 , parse and validate CSP rules more properly.

This needs much more test-values, best from real-life add-ons.

* Add a few more tests

* Fix parseCspPolicy tests

* Update message a bit

* Make sure other rules like style-src are unaffected

* Move url validation inside try/catch block

* Generally avoid loading anything from a host

* Refactor parsing logic a bit to be more explicit with host matches.

* Add two more invalid values

* Add one more invalid example

* Be a bit less strict, there are a few scenarios that we might not be able to match properly...

* More bugfixes, don't match plain host names for now

* Refactor matching again to properly match all crappy things...

* Small cleanups

* More tests, lint worker-src too, forbid unsafe-eval.

* Forbid unsafe-inline too

* Fix tests

* Update message

* re-add unsafe-eval and unsafe-inline based on @wagnerand request.

Fixes #1298

741 of 774 branches covered (95.74%)

1439 of 1439 relevant lines covered (100.0%)

192.89 hits per line