google-cla[bot]
commented
7 months ago Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).
View this failed invocation of the CLA check for more information.
For the most up to date status, view the checks section at the bottom of the pull request.
This PR implements parsing of comma separated CSPs. It is meant to be a conversation starter and I do not mind reworking the code or the PR itself to make it simpler to merge.
Users can provide an array of CSPs (To interact with HTTP libraries that do not concatenate headers) or a comma separated string (as provided by the http lib in nodejs). This should fix https://github.com/google/csp-evaluator/issues/10 and https://github.com/google/csp-evaluator/issues/25.
While working on the implementation, I had to change some of the rules to take into account the "AND" behaviour of multi-CSPs. I took the opportunity to add check (Ex. https://github.com/google/csp-evaluator/issues/54 and other checks commonly found during review of CSPs)
Since the library now has to handle a list of directive maps instead of a single map, the inner-working have changed and I took the liberty of moving the version number to 2.0.0 to indicate potential breaking changes. The upper-level interactions (Creating a parser, recovering the CSP object, passing the CSP object to the evaluator and obtaining the results, etc.) should remain the same.
To sum up, here is the list of changes: