@frat/csp-serdes

Simple and correct Content-Security-Policy parser and serializer using ES6 Maps and Sets.

import * as csp from 'csp-serdes'

example_policy = "default-src 'none'; script-src 'nonce-ExamplePolicyTests'; sandbox; connect-src https: 'self'; img-src 'self'; style-src 'self'"

policy = csp.parse(example_policy)

policy instanceof Map // true
policy.get('default-src') instanceof Set // true

// remove directives
policy.delete('sandbox')

// modify directives
policy.get('script-src').add("'unsafe-eval'")

// replace directives
policy.set('script-src', new Set(["'self'", "'unsafe-eval'"]))

// serialize back to a string
csp.serialize(policy) // "default-src 'none'; script-src 'self' 'unsafe-eval'; connect-src https: 'self'; img-src 'self'; style-src 'self'"