Skip to content

Navigation Menu

Appearance settings

View all features
- BY COMPANY SIZE
  Enterprises
  Small and medium teams
  Startups
  Nonprofits
- BY USE CASE
  App Modernization
  DevSecOps
  DevOps
  CI/CD
  View all use cases
- BY INDUSTRY
  Healthcare
  Financial services
  Manufacturing
  Government
  View all industries
View all solutions
- EXPLORE BY TOPIC
  AI
  Software Development
  DevOps
  Security
  View all topics
- EXPLORE BY TYPE
  Customer stories
  Events & webinars
  Ebooks & reports
  Business insights
  GitHub Skills
- SUPPORT & SERVICES
  Documentation
  Customer support
  Community forum
  Trust center
  Partners
- COMMUNITY
  GitHub SponsorsFund open source developers
- PROGRAMS
  Security Lab
  Maintainer Community
  Accelerator
  Archive Program
- REPOSITORIES
  Topics
  Trending
  Collections
- ENTERPRISE SOLUTIONS
  Enterprise platformAI-powered developer platform
- AVAILABLE ADD-ONS
  GitHub Advanced SecurityEnterprise-grade security features
  Copilot for BusinessEnterprise-grade AI features
  Premium SupportEnterprise-grade 24/7 support
Pricing

Search code, repositories, users, issues, pull requests...

Search

Clear

Search syntax tips

Provide feedback

We read every piece of feedback, and take your input very seriously.

Include my email address so I can be contacted

Saved searches

Use saved searches to filter your results more quickly

Name

Query

To see all available qualifiers, see our documentation.

Appearance settings

You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session.

Dismiss alert

devpunks / snuggsi Public

Notifications You must be signed in to change notification settings
Fork 13
Star 399

Code
Issues 39
Pull requests 6
Discussions
Actions
Projects
Wiki
Security
Insights

Additional navigation options

Code
Issues
Pull requests
Discussions
Actions
Projects
Wiki
Security
Insights

Content security policy#160

Open

snuggs wants to merge 239 commits intomaindevpunks/snuggsi:mainfrom

content-security-policydevpunks/snuggsi:content-security-policyCopy head branch name to clipboard

Conversation Commits239 (239)Checks Files changed

Open

Content security policy#160
snuggs wants to merge 239 commits intomainfrom
content-security-policy

Commits

Commits on Jun 30, 2018

Migrate `onFinish` callback
snuggs
committed
Fix grammatical error
snuggs
committed
Convert to using object deconstruction
snuggs
committed
Add middleware/policy to loader
snuggs
committed
Add middleware/policy to test loader
snuggs
committed
Add middleware/policy implementaion
snuggs
committed
Add middleware/policy.test suite to cover Content Security Policy
snuggs
committed
Update test helper functionality
snuggs
committed
Remove only test from middleware
snuggs
committed
Add Node Security Platform link
snuggs
committed
Add CORS section to middleware/README.md
snuggs
committed
Add security and policy information to middlware/README.md
snuggs
committed
Add middleware/policies.es implementation
snuggs
committed
Test Content-Security-Policy: default-src 'none'
snuggs
committed
Test Stub Content-Security-Policy
snuggs
committed
Add whitespace formatting
snuggs
committed
Add policy middleware to default Server stack
snuggs
committed
Add default stubs for Content-Security-Policy
snuggs
committed
Add report-uri for Content-Security-Policy
snuggs
committed
Add default stubs for Content-Security-Policy
snuggs
committed
Add test for style-src none
snuggs
committed
Use include for header comparison
snuggs
committed
Remove console.logs
snuggs
committed
Remove semicolons from test definition
snuggs
committed
Refactor selectors to use includes
snuggs
committed
Refactor selectors to use includes
snuggs
committed
Refactor policies
snuggs
committed
Remove unnecessary semi-colon
snuggs
committed
Add spec for Content-Security-Policy: frame-src
snuggs
committed
Add spec for Content-Security-Policy: connect-src
snuggs
committed
Add spec for Content-Security-Policy: img-src
snuggs
committed
Add spec for Content-Security-Policy: script-src
snuggs
committed
Remove bug from lowercased variable name
snuggs
committed
Remove only test
snuggs
committed
Fix scripts policy comment
snuggs
committed
Add spec for Content-Security-Policy: report-uri
snuggs
committed
Convert from self to none in Content-Security-Policy test descriptions
snuggs
committed
Fix comments for Content-Security-Policy middleware implementation
snuggs
committed
Add test for script nonce
snuggs
committed
Add link for script nonce
snuggs
committed
Use defaults for Content-Security-Policy: default-src
snuggs
committed
Reformat TSU for Content-Security-Policy middleware
snuggs
committed
Only join policies without trailing semi-colon
snuggs
committed
Update comment for report-uri
snuggs
committed
Update comment for report-uri
snuggs
committed
Use defaults for Content-Security-Policy: font-src
snuggs
committed
Fix font-src comment
snuggs
committed
Add spec for Content-Security-Policy: object-uri
snuggs
committed
Add spec for Content-Security-Policy: media-uri
snuggs
committed
Add note about report-uri analytics
snuggs
committed
Add comment for default-src in Content-Security-Policy
snuggs
committed
Add comment for report-uri.com pricing
snuggs
committed
Add report-uri.com url for reporting
snuggs
committed
Add spec for Content-Security-Policy-Report-Only
snuggs
committed
Add test to ensure Content-Security-Policy is not sent with ?report
snuggs
committed
Add comment about security breach of ?report
snuggs
committed
Add comment about XSS attacks using unsafe-inline
snuggs
committed
Add W3C specification link to README.md
snuggs
committed
Add W3C NONCE reference to middleware/policy.es
snuggs
committed
Add W3C NONCE uniqueness comment
snuggs
committed
Add comment about nonces for Safari Lack of support:-(
snuggs
committed
Add link to MDN documentaiton for CSP
snuggs
committed
Add link to MDN documentaiton for HTTP Header Content-Security-Policy
snuggs
committed
Add documentation about CSP to middleware/README.md
snuggs
committed
Add dummy logic for remaining CSP directives
snuggs
committed
Add link to Moz://a Security Guidelines
snuggs
committed
Add link to GOOGLE CSP
snuggs
committed
Add link to security headers.io
snuggs
committed
Add wikipedia link for CSP
snuggs
committed
Add Github link for CSP
snuggs
committed
Add Github link for post-CSP journey
snuggs
committed
Add services and links section to middleware
snuggs
committed
Add link to W3C Web App Security
snuggs
committed
Remove quotes from test description
snuggs
committed
Add links for report-uri
snuggs
committed
Add Collection of CSP Bypasses
snuggs
committed
Format whitespace in middleware/policy.test
snuggs
committed
Add spec for Content-Security-Policy: worker-src specification
snuggs
committed
Remove only test
snuggs
committed
Fix formatting of middleware/policy.es
snuggs
committed
Remove default 'self' value from policy comments
snuggs
committed
Content-Security-Policy fallback worker-src to script-src
snuggs
committed
Content-Security-Policy fallback frame-src to default-src
snuggs
committed
Content-Security-Policy fallback script-src to default-src
snuggs
committed
Content-Security-Policy Deprecate report-uri for report-to
snuggs
committed
Content-Security-Policy: Rename policies collection to directives
snuggs
committed
Content-Security-Policy: fix broken link
snuggs
committed
Add comment for default-src
snuggs
committed
Fix bug in Content-Security-Policy creating prefixing semi-colon
snuggs
committed
Remove only test
snuggs
committed
Content-Security-Policy: Fallback to using defaults for each directive
snuggs
committed
Add schemes comment
snuggs
committed
Fix comment for scripts directives
snuggs
committed
Remove comment about Content-Security-Policy in favor of README.md
snuggs
committed
Remove google strict-csp document in favor of README.md
snuggs
committed
Set INSECURE true for request upgrade
snuggs
committed
fix whitespace
snuggs
committed
Remove greenfield comment
snuggs
committed
Content-Security-Policy: block-all-mixed-content specification
snuggs
committed
Content-Security-Policy: update-insecure-requests specification
snuggs
committed
Adjust const(ant) whitespace
snuggs
committed
Content-Security-Policy: Rearrange and reformat directives
snuggs
committed
Content-Security-Policy: base-uri
snuggs
committed
Content-Security-Policy: sandbox specification
snuggs
committed
Content-Security-Policy: plugin-types specification
snuggs
committed
Content-Security-Policy: form-action specification
snuggs
committed
Content-Security-Policy: frame-ancestors specification
snuggs
committed
Fix whitespace
snuggs
committed
Refactor const(ant) variables
snuggs
committed
Content-Security-Policy: Refactor report url into variable
snuggs
committed
Content-Security-Policy: Refactor async/await fetch into expression to retrieve header only
snuggs
committed
Convert to use single quotes instead of double quotes
snuggs
committed
Convert to use vanity report-uri endpoint
snuggs
committed
Remove merge conflict
snuggs
committed
Fix snuggsi error
snuggs
committed
Comment compressor test for future PR
snuggs
committed
Comment negotiator test for future PR
snuggs
committed
Comment librarian test for future PR
snuggs
committed
Add server.close
snuggs
committed
use serve test helper method. /cc @brandondees @tmornini
snuggs
committed
Update CSP default frames
snuggs
committed
Update CSP default connects
snuggs
committed
Update CSP default images
snuggs
committed
Update CSP default fonts
snuggs
committed
Update CSP default objects
snuggs
committed
Update CSP default medias
snuggs
committed
Update CSP default styles
snuggs
committed
Update CSP default scripts
snuggs
committed
Update CSP default workers
snuggs
committed
Update CSP default bases
snuggs
committed
Update CSP default forms
snuggs
committed
Update CSP default ancestors
snuggs
committed

Commits on Jul 1, 2018

Convert default-src to use self
snuggs
committed
Migrate to use serve routine
snuggs
committed
Update to use serve in plugin-types
snuggs
committed
Update object-src to none
snuggs
committed
update plugin types to mime type defaults
snuggs
committed
Update object-src policy to 'none'
snuggs
committed
Update plugins for plugin-src CSP
snuggs
committed
Update plugins for plugin-src CSP
snuggs
committed
Migrate plugin-types to near object-src since they are dependent
snuggs
committed
Update object-src test to none
snuggs
committed
Update spec description for object-src and plugin-types
snuggs
committed
Add comment for when object-sr is NOT 'none'
snuggs
committed
Add not ok test for plugin-types
snuggs
committed
Migrate plugin-types juxtaposed to object-src
snuggs
committed
Remove CSP plugin-types when objects default to 'none'
snuggs
committed
Fix whitespace with context set derectives
snuggs
committed

Commits on Jul 2, 2018

Refactor secure
snuggs
committed
Migrate await next within policy middleware
snuggs
committed
Add middleware/policy.json
snuggs
committed
Add image-src to policy.json
snuggs
committed
Add script-src to policy.json
snuggs
committed
Convert image-src to img-src
snuggs
committed
Use google analytics in img-src
snuggs
committed
Add style-src to policy.json
snuggs
committed
Add report-uri to policy.json
snuggs
committed
Fix whitespace
snuggs
committed
Remove google analytics
snuggs
committed
Fix whitespace for report-uri
snuggs
committed
Fix header level for resource/README.md
snuggs
committed
Add comment for updated require
snuggs
committed
Reorganize external links for request methods
snuggs
committed
Add types to definition in resource/README.md
snuggs
committed
Reorganize definition in resource/README.md
snuggs
committed
Fix whitespace
snuggs
committed
Reorganize mime sniffing section
snuggs
committed
Fix comment bug LOLZ
snuggs
committed
Update default-src fallback comments
snuggs
committed
Refactor policy variables
snuggs
committed
Refactor policy variables
snuggs
committed
Convert backticks to double quotes
snuggs
committed
Convert backticks to double quotes
snuggs
committed
Fix whitespace and comments
snuggs
committed
Update bases uri
snuggs
committed
Update plugin types for security policy
snuggs
committed
Update forms action for security policy
snuggs
committed
Update frame-ancestors directive for Content Security Policy
snuggs
committed
Update worker-src for Content security policy
snuggs
committed
REorganize variables for Security policy
snuggs
committed
Fix formatting of Content Security Policy constant variables
snuggs
committed
Update sandbox directives for content security policy
snuggs
committed
Fix context.set variable
snuggs
committed
Migrate header variable
snuggs
committed
Remove header variable from method signature
snuggs
committed
Refactor policy to be a middleware signature
snuggs
committed
Send context to next in policy.es
snuggs
committed
Updte security breach comment
snuggs
committed
Convert to backticks for report
snuggs
committed
Update report variable for policy.es
snuggs
committed
Update frames position in variable stack
snuggs
committed
Update img-src variable name for Content Security Policy
snuggs
committed
Update style variable
snuggs
committed
Reorganize directives for content security policy
snuggs
committed
Update sandbox directive for content security policy
snuggs
committed
Update worker-src for CSP
snuggs
committed
Update script-src
snuggs
committed
Update frame-src for CSP
snuggs
committed
Update font-src for content security policy
snuggs
committed
Update media-src directive for Content Security Policy
snuggs
committed
Convert Policy variable from connects to connect for CSP directive
snuggs
committed
Convert Policy variable from bases to base for CSP directive
snuggs
committed
Update Navigation Directives for Content Security Policy
snuggs
committed
Reorder variables for CSP
snuggs
committed
Update plugin-types variable for CSP
snuggs
committed
Fix bug in objects variable
snuggs
committed
Fix bug in sandbox variable
snuggs
committed
Fix indentation level of sandbox defaults
snuggs
committed
Fix bug in sandbox variable
snuggs
committed
Fix indentation level of SECURE, header, and scheme variables for CSP
snuggs
committed
Add whitespace to CSP directive variable declarations
snuggs
committed
Add comments for Document directives
snuggs
committed
Update comments for directive section
snuggs
committed
Add secure variable to policy.json
snuggs
committed
Reorganizee keys within policy.json
snuggs
committed
Update SECURE for update insecure requests and blocking mixed content
snuggs
committed
Remove using backticks
snuggs
committed
Fix bug related to Content-Security-Policy-Report-Only
snuggs
committed
Refactor Content-Security-Policy-Report-Only test
snuggs
committed
Reorder test constants
snuggs
committed
Rename public/browser-sync.es -> public/browser-sync.js
snuggs
committed
Rename public/browser-sync.es -> public/browser-sync.js
snuggs
committed

Commits on Jul 3, 2018

Refactor test for Content-Security-Policy-Report-Only
snuggs
committed
Assert Content-Security-Policy-Report-Only does not exist without querystring parameter ?report
snuggs
committed
Refactor policy.es
snuggs
committed
Refactor Content-Security-Policy-Report-Only test
snuggs
committed

Commits on Jul 4, 2018

Add report/README.md
snuggs
committed
Add MDN link
snuggs
committed
Add report/index.json
snuggs
committed
Add sample csp report for report resource
snuggs
committed
Add Report resource to server
snuggs
committed
Fix bug with routing system
snuggs
committed

Commits on Jul 6, 2018

Migrate color palette and style comments to prevent CSP error
snuggs
committed
Remove legacy style tag
snuggs
committed
Create specification for child-src as per Changes in CSP3
snuggs
committed
Create specification for manifest-src as per Changes in CSP3
snuggs
committed

Commits on Jul 14, 2018

Refactor Content-Security-Policy-Report-Only
snuggs
committed
Refactor Content-Security-Policy-Report-Only and Content-Security-Policy into separate specs
snuggs
committed
Remove only test
snuggs
committed

Footer

© 2026 GitHub, Inc.

Footer navigation

Terms
Privacy
Security
Status
Community
Docs
Contact

You can’t perform that action at this time.