cmd
→
README
T
Decision
T
Directive
T
Finding
T
MigrationPlan
T
Policy
T
ResourceKind
T
ResourceRequest
T
Severity
T
Source
T
SourceKind
V
allows
V
audit
V
catalog_expect_base_uri_self
V
catalog_expect_default_src_none_or_self
V
catalog_expect_form_action_self
V
catalog_expect_frame_ancestors_none_or_self
V
catalog_expect_object_src_none
V
catalog_expect_require_trusted_types_script
V
catalog_expect_script_src_nonce
V
catalog_expect_style_src_nonce
V
catalog_missing_base_uri
V
catalog_missing_child_src
V
catalog_missing_connect_src
V
catalog_missing_default_src
V
catalog_missing_font_src
V
catalog_missing_form_action
V
catalog_missing_frame_ancestors
V
catalog_missing_frame_src
V
catalog_missing_img_src
V
catalog_missing_manifest_src
V
catalog_missing_media_src
V
catalog_missing_navigate_to
V
catalog_missing_object_src
V
catalog_missing_prefetch_src
V
catalog_missing_report_to
V
catalog_missing_report_uri
V
catalog_missing_require_trusted_types_for
V
catalog_missing_sandbox
V
catalog_missing_script_src
V
catalog_missing_style_src
V
catalog_missing_trusted_types
V
catalog_missing_upgrade_insecure_requests
V
catalog_missing_worker_src
V
catalog_rule_count
V
catalog_source_child_src_blob
V
catalog_source_child_src_data
V
catalog_source_child_src_filesystem
V
catalog_source_child_src_http
V
catalog_source_child_src_https
V
catalog_source_child_src_self
V
catalog_source_child_src_strict_dynamic
V
catalog_source_child_src_unsafe_eval
V
catalog_source_child_src_unsafe_inline
V
catalog_source_child_src_wildcard
V
catalog_source_child_src_ws
V
catalog_source_child_src_wss
V
catalog_source_connect_src_blob
V
catalog_source_connect_src_data
V
catalog_source_connect_src_filesystem
V
catalog_source_connect_src_http
V
catalog_source_connect_src_https
V
catalog_source_connect_src_self
V
catalog_source_connect_src_strict_dynamic
V
catalog_source_connect_src_unsafe_eval
V
catalog_source_connect_src_unsafe_inline
V
catalog_source_connect_src_wildcard
V
catalog_source_connect_src_ws
V
catalog_source_connect_src_wss
V
catalog_source_default_src_blob
V
catalog_source_default_src_data
V
catalog_source_default_src_filesystem
V
catalog_source_default_src_http
V
catalog_source_default_src_https
V
catalog_source_default_src_self
V
catalog_source_default_src_strict_dynamic
V
catalog_source_default_src_unsafe_eval
V
catalog_source_default_src_unsafe_inline
V
catalog_source_default_src_wildcard
V
catalog_source_default_src_ws
V
catalog_source_default_src_wss
V
catalog_source_font_src_blob
V
catalog_source_font_src_data
V
catalog_source_font_src_filesystem
V
catalog_source_font_src_http
V
catalog_source_font_src_https
V
catalog_source_font_src_self
V
catalog_source_font_src_strict_dynamic
V
catalog_source_font_src_unsafe_eval
V
catalog_source_font_src_unsafe_inline
V
catalog_source_font_src_wildcard
V
catalog_source_font_src_ws
V
catalog_source_font_src_wss
V
catalog_source_frame_src_blob
V
catalog_source_frame_src_data
V
catalog_source_frame_src_filesystem
V
catalog_source_frame_src_http
V
catalog_source_frame_src_https
V
catalog_source_frame_src_self
V
catalog_source_frame_src_strict_dynamic
V
catalog_source_frame_src_unsafe_eval
V
catalog_source_frame_src_unsafe_inline
V
catalog_source_frame_src_wildcard
V
catalog_source_frame_src_ws
V
catalog_source_frame_src_wss
V
catalog_source_img_src_blob
V
catalog_source_img_src_data
V
catalog_source_img_src_filesystem
V
catalog_source_img_src_http
V
catalog_source_img_src_https
V
catalog_source_img_src_self
V
catalog_source_img_src_strict_dynamic
V
catalog_source_img_src_unsafe_eval
V
catalog_source_img_src_unsafe_inline
V
catalog_source_img_src_wildcard
V
catalog_source_img_src_ws
V
catalog_source_img_src_wss
V
catalog_source_manifest_src_blob
V
catalog_source_manifest_src_data
V
catalog_source_manifest_src_filesystem
V
catalog_source_manifest_src_http
V
catalog_source_manifest_src_https
V
catalog_source_manifest_src_self
V
catalog_source_manifest_src_strict_dynamic
V
catalog_source_manifest_src_unsafe_eval
V
catalog_source_manifest_src_unsafe_inline
V
catalog_source_manifest_src_wildcard
V
catalog_source_manifest_src_ws
V
catalog_source_manifest_src_wss
V
catalog_source_media_src_blob
V
catalog_source_media_src_data
V
catalog_source_media_src_filesystem
V
catalog_source_media_src_http
V
catalog_source_media_src_https
V
catalog_source_media_src_self
V
catalog_source_media_src_strict_dynamic
V
catalog_source_media_src_unsafe_eval
V
catalog_source_media_src_unsafe_inline
V
catalog_source_media_src_wildcard
V
catalog_source_media_src_ws
V
catalog_source_media_src_wss
V
catalog_source_prefetch_src_blob
V
catalog_source_prefetch_src_data
V
catalog_source_prefetch_src_filesystem
V
catalog_source_prefetch_src_http
V
catalog_source_prefetch_src_https
V
catalog_source_prefetch_src_self
V
catalog_source_prefetch_src_strict_dynamic
V
catalog_source_prefetch_src_unsafe_eval
V
catalog_source_prefetch_src_unsafe_inline
V
catalog_source_prefetch_src_wildcard
V
catalog_source_prefetch_src_ws
V
catalog_source_prefetch_src_wss
V
catalog_source_script_src_blob
V
catalog_source_script_src_data
V
catalog_source_script_src_filesystem
V
catalog_source_script_src_http
V
catalog_source_script_src_https
V
catalog_source_script_src_self
V
catalog_source_script_src_strict_dynamic
V
catalog_source_script_src_unsafe_eval
V
catalog_source_script_src_unsafe_inline
V
catalog_source_script_src_wildcard
V
catalog_source_script_src_ws
V
catalog_source_script_src_wss
V
catalog_source_style_src_blob
V
catalog_source_style_src_data
V
catalog_source_style_src_filesystem
V
catalog_source_style_src_http
V
catalog_source_style_src_https
V
catalog_source_style_src_self
V
catalog_source_style_src_strict_dynamic
V
catalog_source_style_src_unsafe_eval
V
catalog_source_style_src_unsafe_inline
V
catalog_source_style_src_wildcard
V
catalog_source_style_src_ws
V
catalog_source_style_src_wss
V
catalog_source_worker_src_blob
V
catalog_source_worker_src_data
V
catalog_source_worker_src_filesystem
V
catalog_source_worker_src_http
V
catalog_source_worker_src_https
V
catalog_source_worker_src_self
V
catalog_source_worker_src_strict_dynamic
V
catalog_source_worker_src_unsafe_eval
V
catalog_source_worker_src_unsafe_inline
V
catalog_source_worker_src_wildcard
V
catalog_source_worker_src_ws
V
catalog_source_worker_src_wss
V
connect_request
V
contains_text
V
directive_has_source
V
extended_audit
V
findings_text
V
get_directive
V
has_directive
V
image_request
V
inline_script
V
normalize
V
parse
V
plan_from_requests
V
recipe_admin_console_core
V
recipe_admin_console_core_findings
V
recipe_admin_console_core_policy
V
recipe_admin_console_locked_forms
V
recipe_admin_console_locked_forms_findings
V
recipe_admin_console_locked_forms_policy
V
recipe_admin_console_sandboxed
V
recipe_admin_console_sandboxed_findings
V
recipe_admin_console_sandboxed_policy
V
recipe_admin_console_with_legacy_report
V
recipe_admin_console_with_legacy_report_findings
V
recipe_admin_console_with_legacy_report_policy
V
recipe_admin_console_with_manifest
V
recipe_admin_console_with_manifest_findings
V
recipe_admin_console_with_manifest_policy
V
recipe_admin_console_with_navigation
V
recipe_admin_console_with_navigation_findings
V
recipe_admin_console_with_navigation_policy
V
recipe_admin_console_with_prefetch
V
recipe_admin_console_with_prefetch_findings
V
recipe_admin_console_with_prefetch_policy
V
recipe_admin_console_with_reports
V
recipe_admin_console_with_reports_findings
V
recipe_admin_console_with_reports_policy
V
recipe_admin_console_with_trusted_types
V
recipe_admin_console_with_trusted_types_findings
V
recipe_admin_console_with_trusted_types_policy
V
recipe_admin_console_with_upgrade
V
recipe_admin_console_with_upgrade_findings
V
recipe_admin_console_with_upgrade_policy
V
recipe_analytics_light_core
V
recipe_analytics_light_core_findings
V
recipe_analytics_light_core_policy
V
recipe_analytics_light_locked_forms
V
recipe_analytics_light_locked_forms_findings
V
recipe_analytics_light_locked_forms_policy
V
recipe_analytics_light_sandboxed
V
recipe_analytics_light_sandboxed_findings
V
recipe_analytics_light_sandboxed_policy
V
recipe_analytics_light_with_legacy_report
V
recipe_analytics_light_with_legacy_report_findings
V
recipe_analytics_light_with_legacy_report_policy
V
recipe_analytics_light_with_manifest
V
recipe_analytics_light_with_manifest_findings
V
recipe_analytics_light_with_manifest_policy
V
recipe_analytics_light_with_navigation
V
recipe_analytics_light_with_navigation_findings
V
recipe_analytics_light_with_navigation_policy
V
recipe_analytics_light_with_prefetch
V
recipe_analytics_light_with_prefetch_findings
V
recipe_analytics_light_with_prefetch_policy
V
recipe_analytics_light_with_reports
V
recipe_analytics_light_with_reports_findings
V
recipe_analytics_light_with_reports_policy
V
recipe_analytics_light_with_trusted_types
V
recipe_analytics_light_with_trusted_types_findings
V
recipe_analytics_light_with_trusted_types_policy
V
recipe_analytics_light_with_upgrade
V
recipe_analytics_light_with_upgrade_findings
V
recipe_analytics_light_with_upgrade_policy
V
recipe_audit_by_name
V
recipe_count
V
recipe_docs_site_core
V
recipe_docs_site_core_findings
V
recipe_docs_site_core_policy
V
recipe_docs_site_locked_forms
V
recipe_docs_site_locked_forms_findings
V
recipe_docs_site_locked_forms_policy
V
recipe_docs_site_sandboxed
V
recipe_docs_site_sandboxed_findings
V
recipe_docs_site_sandboxed_policy
V
recipe_docs_site_with_legacy_report
V
recipe_docs_site_with_legacy_report_findings
V
recipe_docs_site_with_legacy_report_policy
V
recipe_docs_site_with_manifest
V
recipe_docs_site_with_manifest_findings
V
recipe_docs_site_with_manifest_policy
V
recipe_docs_site_with_navigation
V
recipe_docs_site_with_navigation_findings
V
recipe_docs_site_with_navigation_policy
V
recipe_docs_site_with_prefetch
V
recipe_docs_site_with_prefetch_findings
V
recipe_docs_site_with_prefetch_policy
V
recipe_docs_site_with_reports
V
recipe_docs_site_with_reports_findings
V
recipe_docs_site_with_reports_policy
V
recipe_docs_site_with_trusted_types
V
recipe_docs_site_with_trusted_types_findings
V
recipe_docs_site_with_trusted_types_policy
V
recipe_docs_site_with_upgrade
V
recipe_docs_site_with_upgrade_findings
V
recipe_docs_site_with_upgrade_policy
V
recipe_embed_widget_core
V
recipe_embed_widget_core_findings
V
recipe_embed_widget_core_policy
V
recipe_embed_widget_locked_forms
V
recipe_embed_widget_locked_forms_findings
V
recipe_embed_widget_locked_forms_policy
V
recipe_embed_widget_sandboxed
V
recipe_embed_widget_sandboxed_findings
V
recipe_embed_widget_sandboxed_policy
V
recipe_embed_widget_with_legacy_report
V
recipe_embed_widget_with_legacy_report_findings
V
recipe_embed_widget_with_legacy_report_policy
V
recipe_embed_widget_with_manifest
V
recipe_embed_widget_with_manifest_findings
V
recipe_embed_widget_with_manifest_policy
V
recipe_embed_widget_with_navigation
V
recipe_embed_widget_with_navigation_findings
V
recipe_embed_widget_with_navigation_policy
V
recipe_embed_widget_with_prefetch
V
recipe_embed_widget_with_prefetch_findings
V
recipe_embed_widget_with_prefetch_policy
V
recipe_embed_widget_with_reports
V
recipe_embed_widget_with_reports_findings
V
recipe_embed_widget_with_reports_policy
V
recipe_embed_widget_with_trusted_types
V
recipe_embed_widget_with_trusted_types_findings
V
recipe_embed_widget_with_trusted_types_policy
V
recipe_embed_widget_with_upgrade
V
recipe_embed_widget_with_upgrade_findings
V
recipe_embed_widget_with_upgrade_policy
V
recipe_media_gallery_core
V
recipe_media_gallery_core_findings
V
recipe_media_gallery_core_policy
V
recipe_media_gallery_locked_forms
V
recipe_media_gallery_locked_forms_findings
V
recipe_media_gallery_locked_forms_policy
V
recipe_media_gallery_sandboxed
V
recipe_media_gallery_sandboxed_findings
V
recipe_media_gallery_sandboxed_policy
V
recipe_media_gallery_with_legacy_report
V
recipe_media_gallery_with_legacy_report_findings
V
recipe_media_gallery_with_legacy_report_policy
V
recipe_media_gallery_with_manifest
V
recipe_media_gallery_with_manifest_findings
V
recipe_media_gallery_with_manifest_policy
V
recipe_media_gallery_with_navigation
V
recipe_media_gallery_with_navigation_findings
V
recipe_media_gallery_with_navigation_policy
V
recipe_media_gallery_with_prefetch
V
recipe_media_gallery_with_prefetch_findings
V
recipe_media_gallery_with_prefetch_policy
V
recipe_media_gallery_with_reports
V
recipe_media_gallery_with_reports_findings
V
recipe_media_gallery_with_reports_policy
V
recipe_media_gallery_with_trusted_types
V
recipe_media_gallery_with_trusted_types_findings
V
recipe_media_gallery_with_trusted_types_policy
V
recipe_media_gallery_with_upgrade
V
recipe_media_gallery_with_upgrade_findings
V
recipe_media_gallery_with_upgrade_policy
V
recipe_names
V
recipe_payment_redirect_core
V
recipe_payment_redirect_core_findings
V
recipe_payment_redirect_core_policy
V
recipe_payment_redirect_locked_forms
V
recipe_payment_redirect_locked_forms_findings
V
recipe_payment_redirect_locked_forms_policy
V
recipe_payment_redirect_sandboxed
V
recipe_payment_redirect_sandboxed_findings
V
recipe_payment_redirect_sandboxed_policy
V
recipe_payment_redirect_with_legacy_report
V
recipe_payment_redirect_with_legacy_report_findings
V
recipe_payment_redirect_with_legacy_report_policy
V
recipe_payment_redirect_with_manifest
V
recipe_payment_redirect_with_manifest_findings
V
recipe_payment_redirect_with_manifest_policy
V
recipe_payment_redirect_with_navigation
V
recipe_payment_redirect_with_navigation_findings
V
recipe_payment_redirect_with_navigation_policy
V
recipe_payment_redirect_with_prefetch
V
recipe_payment_redirect_with_prefetch_findings
V
recipe_payment_redirect_with_prefetch_policy
V
recipe_payment_redirect_with_reports
V
recipe_payment_redirect_with_reports_findings
V
recipe_payment_redirect_with_reports_policy
V
recipe_payment_redirect_with_trusted_types
V
recipe_payment_redirect_with_trusted_types_findings
V
recipe_payment_redirect_with_trusted_types_policy
V
recipe_payment_redirect_with_upgrade
V
recipe_payment_redirect_with_upgrade_findings
V
recipe_payment_redirect_with_upgrade_policy
V
recipe_policy_by_name
V
recipe_report_only_baseline_core
V
recipe_report_only_baseline_core_findings
V
recipe_report_only_baseline_core_policy
V
recipe_report_only_baseline_locked_forms
V
recipe_report_only_baseline_locked_forms_findings
V
recipe_report_only_baseline_locked_forms_policy
V
recipe_report_only_baseline_sandboxed
V
recipe_report_only_baseline_sandboxed_findings
V
recipe_report_only_baseline_sandboxed_policy
V
recipe_report_only_baseline_with_legacy_report
V
recipe_report_only_baseline_with_legacy_report_findings
V
recipe_report_only_baseline_with_legacy_report_policy
V
recipe_report_only_baseline_with_manifest
V
recipe_report_only_baseline_with_manifest_findings
V
recipe_report_only_baseline_with_manifest_policy
V
recipe_report_only_baseline_with_navigation
V
recipe_report_only_baseline_with_navigation_findings
V
recipe_report_only_baseline_with_navigation_policy
V
recipe_report_only_baseline_with_prefetch
V
recipe_report_only_baseline_with_prefetch_findings
V
recipe_report_only_baseline_with_prefetch_policy
V
recipe_report_only_baseline_with_reports
V
recipe_report_only_baseline_with_reports_findings
V
recipe_report_only_baseline_with_reports_policy
V
recipe_report_only_baseline_with_trusted_types
V
recipe_report_only_baseline_with_trusted_types_findings
V
recipe_report_only_baseline_with_trusted_types_policy
V
recipe_report_only_baseline_with_upgrade
V
recipe_report_only_baseline_with_upgrade_findings
V
recipe_report_only_baseline_with_upgrade_policy
V
recipe_static_site_core
V
recipe_static_site_core_findings
V
recipe_static_site_core_policy
V
recipe_static_site_locked_forms
V
recipe_static_site_locked_forms_findings
V
recipe_static_site_locked_forms_policy
V
recipe_static_site_sandboxed
V
recipe_static_site_sandboxed_findings
V
recipe_static_site_sandboxed_policy
V
recipe_static_site_with_legacy_report
V
recipe_static_site_with_legacy_report_findings
V
recipe_static_site_with_legacy_report_policy
V
recipe_static_site_with_manifest
V
recipe_static_site_with_manifest_findings
V
recipe_static_site_with_manifest_policy
V
recipe_static_site_with_navigation
V
recipe_static_site_with_navigation_findings
V
recipe_static_site_with_navigation_policy
V
recipe_static_site_with_prefetch
V
recipe_static_site_with_prefetch_findings
V
recipe_static_site_with_prefetch_policy
V
recipe_static_site_with_reports
V
recipe_static_site_with_reports_findings
V
recipe_static_site_with_reports_policy
V
recipe_static_site_with_trusted_types
V
recipe_static_site_with_trusted_types_findings
V
recipe_static_site_with_trusted_types_policy
V
recipe_static_site_with_upgrade
V
recipe_static_site_with_upgrade_findings
V
recipe_static_site_with_upgrade_policy
V
recipe_strict_nonce_core
V
recipe_strict_nonce_core_findings
V
recipe_strict_nonce_core_policy
V
recipe_strict_nonce_locked_forms
V
recipe_strict_nonce_locked_forms_findings
V
recipe_strict_nonce_locked_forms_policy
V
recipe_strict_nonce_sandboxed
V
recipe_strict_nonce_sandboxed_findings
V
recipe_strict_nonce_sandboxed_policy
V
recipe_strict_nonce_with_legacy_report
V
recipe_strict_nonce_with_legacy_report_findings
V
recipe_strict_nonce_with_legacy_report_policy
V
recipe_strict_nonce_with_manifest
V
recipe_strict_nonce_with_manifest_findings
V
recipe_strict_nonce_with_manifest_policy
V
recipe_strict_nonce_with_navigation
V
recipe_strict_nonce_with_navigation_findings
V
recipe_strict_nonce_with_navigation_policy
V
recipe_strict_nonce_with_prefetch
V
recipe_strict_nonce_with_prefetch_findings
V
recipe_strict_nonce_with_prefetch_policy
V
recipe_strict_nonce_with_reports
V
recipe_strict_nonce_with_reports_findings
V
recipe_strict_nonce_with_reports_policy
V
recipe_strict_nonce_with_trusted_types
V
recipe_strict_nonce_with_trusted_types_findings
V
recipe_strict_nonce_with_trusted_types_policy
V
recipe_strict_nonce_with_upgrade
V
recipe_strict_nonce_with_upgrade_findings
V
recipe_strict_nonce_with_upgrade_policy
V
recipe_wasm_app_core
V
recipe_wasm_app_core_findings
V
recipe_wasm_app_core_policy
V
recipe_wasm_app_locked_forms
V
recipe_wasm_app_locked_forms_findings
V
recipe_wasm_app_locked_forms_policy
V
recipe_wasm_app_sandboxed
V
recipe_wasm_app_sandboxed_findings
V
recipe_wasm_app_sandboxed_policy
V
recipe_wasm_app_with_legacy_report
V
recipe_wasm_app_with_legacy_report_findings
V
recipe_wasm_app_with_legacy_report_policy
V
recipe_wasm_app_with_manifest
V
recipe_wasm_app_with_manifest_findings
V
recipe_wasm_app_with_manifest_policy
V
recipe_wasm_app_with_navigation
V
recipe_wasm_app_with_navigation_findings
V
recipe_wasm_app_with_navigation_policy
V
recipe_wasm_app_with_prefetch
V
recipe_wasm_app_with_prefetch_findings
V
recipe_wasm_app_with_prefetch_policy
V
recipe_wasm_app_with_reports
V
recipe_wasm_app_with_reports_findings
V
recipe_wasm_app_with_reports_policy
V
recipe_wasm_app_with_trusted_types
V
recipe_wasm_app_with_trusted_types_findings
V
recipe_wasm_app_with_trusted_types_policy
V
recipe_wasm_app_with_upgrade
V
recipe_wasm_app_with_upgrade_findings
V
recipe_wasm_app_with_upgrade_policy
V
script_request
V
source_kind_to_string
V
style_request
V
summary

csp-weaver-mbt

MoonBit native Content-Security-Policy parser, auditor and migration planner.

csp

security

http

wasm

audit

moon add LH-DD-lh/csp-weaver-mbt@0.1.0

Download zip

Author

LH-DD-lh

Version

0.1.0

License

MIT

Repository

github.com/LH-DD-lh/csp-weaver-mbt.git

Last updated

11 hours ago

Downloads

README

#csp-weaver-mbt

csp-weaver-mbt 是一个 MoonBit 原生的 Content-Security-Policy 解析、审计与迁移规划库。它面向 MoonBit/Wasm 应用、静态站点生成器、安全扫描工具和 CI 策略校验场景，提供可复现的 CSP 解析、资源请求模拟、规则审计、策略配方和迁移计划能力。

#项目解决的问题

CSP 经常难以维护：策略字符串长、fallback 规则复杂、'unsafe-inline'、data:、blob:、通配符、plain HTTP、Trusted Types、frame/form/worker 等细节容易遗漏。这个库把 CSP 拆成 MoonBit 数据模型，并提供审计规则目录和可运行示例，帮助开发者在发布前发现风险并逐步收紧策略。

#适用场景

MoonBit/Wasm 前端应用的本地 CSP 验证。
静态站点或文档站生成流程中的安全头检查。
CI 中阻止高风险 CSP 回归。
从资源清单生成最小 CSP 初稿。
对已有 CSP 做规范化导出和风险解释。
教学项目：展示解析器、策略求值、审计目录和 Mooncakes 包工程化。

#独特性说明

查重方向覆盖 Mooncakes 和 GitHub 的 CSP、Content-Security-Policy、security header、policy audit、MoonBit 等关键词。当前未发现 MoonBit 原生的 CSP 解析、资源模拟、审计规则目录与迁移规划组合项目。与普通安全头展示器不同，本项目提供可嵌入 MoonBit 代码的类型化模型、100+ 扩展规则、100 个策略配方、请求级 allow/deny 模拟和迁移计划 API。

#安装方式

Mooncakes 包名：

LH-DD-lh/csp-weaver-mbt

在使用方项目中添加依赖：

moon add LH-DD-lh/csp-weaver-mbt

在 moon.pkg 中导入：

import {
  "LH-DD-lh/csp-weaver-mbt" @csp,
}

#最小使用示例

fn main {
  let policy = @csp.parse(
    "default-src 'self'; script-src 'self' 'nonce-demo'; object-src 'none'",
  )
  let decision = @csp.allows(
    policy,
    @csp.script_request("https://app.example/main.js", "https://app.example"),
  )
  println(decision.reason)
  println(@csp.findings_text(@csp.extended_audit(policy)))
}

#本地运行方式

moon check --deny-warn
moon build
moon test --deny-warn
moon run cmd/main
moon publish --dry-run

#核心功能

CSP header 解析和规范化导出。
Source expression 分类：keyword、scheme、host、nonce、hash、wildcard。
请求级模拟：script、style、img、font、connect、frame、worker、object、manifest 等资源类型。
内置审计：缺失关键指令、危险 source、'none' 误用、plain HTTP、通配符等。
扩展审计目录：100+ 条细分检查。
迁移规划：根据观察到的资源请求生成最小 allow-list 初稿。
配方库：100 个常见站点和应用场景的 CSP 起点。
CI 和示例入口：cmd/main 可直接运行。

#API 概览

API	说明
parse(input)	解析 CSP 字符串
normalize(policy)	规范化导出 CSP
allows(policy, request)	模拟资源请求是否允许
audit(policy)	默认审计
extended_audit(policy)	扩展审计目录
findings_text(findings)	渲染审计结果
plan_from_requests(requests)	从资源请求生成迁移计划
recipe_names()	返回策略配方名称
recipe_policy_by_name(name)	按名称获取配方策略
catalog_rule_count()	返回扩展审计规则数量

#支持范围

常见 CSP fetch directives 和 document/navigation directives。
'self'、'none'、nonce、hash、scheme、host、wildcard。
同源、scheme、host、*. 子域模式的请求模拟。
CSP 风险审计和迁移建议。
MoonBit wasm target 下可构建和测试。

#暂不支持范围

不实现浏览器完整 CSP 规范的所有边缘语义。
不做真实网络请求。
不自动读取 HTTP 响应头。
不验证 hash 内容是否匹配真实脚本体。
不替代专业渗透测试工具。

#测试与验收命令

moon check --deny-warn
moon build
moon test --deny-warn
moon run cmd/main
moon publish --dry-run
git status --short
git rev-list --count HEAD

#Mooncakes 发布

发布前确认 moon.mod 中的 owner、仓库地址和实际 GitHub 仓库一致：

moon login
moon publish --dry-run
moon publish

发布后检查：

https://mooncakes.io/docs/LH-DD-lh/csp-weaver-mbt
https://mooncakes.io/api/v0/manifest/LH-DD-lh/csp-weaver-mbt

#开源许可证与第三方说明

本项目采用 MIT License。核心实现为原创 MoonBit 代码，不移植第三方源码，不包含来源不明素材、图片、音频、字体或测试数据。生成的审计目录和配方库来自项目内维护的规则表，用于机械展开公开 API。

csp-weaver-mbt

#csp-weaver-mbt

#项目解决的问题

#适用场景

#独特性说明

#安装方式

#最小使用示例

#本地运行方式

#核心功能

#API 概览

#支持范围

#暂不支持范围

#测试与验收命令

#Mooncakes 发布

#开源许可证与第三方说明

#Decision

#Directive

#Finding

#MigrationPlan

#Policy

#ResourceKind

#ResourceRequest

#Severity

#Source

#SourceKind

#allows

#audit

#catalog_expect_base_uri_self

#catalog_expect_default_src_none_or_self

#catalog_expect_form_action_self

#catalog_expect_frame_ancestors_none_or_self

#catalog_expect_object_src_none

#catalog_expect_require_trusted_types_script

#catalog_expect_script_src_nonce

#catalog_expect_style_src_nonce

#catalog_missing_base_uri

#catalog_missing_child_src

#catalog_missing_connect_src

#catalog_missing_default_src

#catalog_missing_font_src

#catalog_missing_form_action

#catalog_missing_frame_ancestors

#catalog_missing_frame_src

#catalog_missing_img_src

#catalog_missing_manifest_src

#catalog_missing_media_src

#catalog_missing_navigate_to

#catalog_missing_object_src

#catalog_missing_prefetch_src

#catalog_missing_report_to

#catalog_missing_report_uri

#catalog_missing_require_trusted_types_for

#catalog_missing_sandbox

#catalog_missing_script_src

#catalog_missing_style_src

#catalog_missing_trusted_types

#catalog_missing_upgrade_insecure_requests

#catalog_missing_worker_src

#catalog_rule_count

#catalog_source_child_src_blob

#catalog_source_child_src_data

#catalog_source_child_src_filesystem

#catalog_source_child_src_http

#catalog_source_child_src_https

#catalog_source_child_src_self

#catalog_source_child_src_strict_dynamic

#catalog_source_child_src_unsafe_eval

#catalog_source_child_src_unsafe_inline

#catalog_source_child_src_wildcard

#catalog_source_child_src_ws

#catalog_source_child_src_wss

#catalog_source_connect_src_blob

#catalog_source_connect_src_data

#catalog_source_connect_src_filesystem

#catalog_source_connect_src_http

#catalog_source_connect_src_https

#catalog_source_connect_src_self

#catalog_source_connect_src_strict_dynamic

#catalog_source_connect_src_unsafe_eval

#catalog_source_connect_src_unsafe_inline

#
Decision

#
Directive

#
Finding

#
MigrationPlan

#
Policy

#
ResourceKind

#
ResourceRequest

#
Severity

#
Source

#
SourceKind

#
allows

#
audit

#
catalog_expect_base_uri_self

#
catalog_expect_default_src_none_or_self

#
catalog_expect_form_action_self

#
catalog_expect_frame_ancestors_none_or_self

#
catalog_expect_object_src_none

#
catalog_expect_require_trusted_types_script

#
catalog_expect_script_src_nonce

#
catalog_expect_style_src_nonce

#
catalog_missing_base_uri

#
catalog_missing_child_src

#
catalog_missing_connect_src

#
catalog_missing_default_src

#
catalog_missing_font_src

#
catalog_missing_form_action

#
catalog_missing_frame_ancestors

#
catalog_missing_frame_src

#
catalog_missing_img_src

#
catalog_missing_manifest_src

#
catalog_missing_media_src

#
catalog_missing_navigate_to

#
catalog_missing_object_src

#
catalog_missing_prefetch_src

#
catalog_missing_report_to

#
catalog_missing_report_uri

#
catalog_missing_require_trusted_types_for

#
catalog_missing_sandbox

#
catalog_missing_script_src

#
catalog_missing_style_src

#
catalog_missing_trusted_types

#
catalog_missing_upgrade_insecure_requests

#
catalog_missing_worker_src

#
catalog_rule_count

#
catalog_source_child_src_blob

#
catalog_source_child_src_data

#
catalog_source_child_src_filesystem

#
catalog_source_child_src_http

#
catalog_source_child_src_https

#
catalog_source_child_src_self

#
catalog_source_child_src_strict_dynamic

#
catalog_source_child_src_unsafe_eval

#
catalog_source_child_src_unsafe_inline

#
catalog_source_child_src_wildcard

#
catalog_source_child_src_ws

#
catalog_source_child_src_wss

#
catalog_source_connect_src_blob

#
catalog_source_connect_src_data

#
catalog_source_connect_src_filesystem

#
catalog_source_connect_src_http

#
catalog_source_connect_src_https

#
catalog_source_connect_src_self

#
catalog_source_connect_src_strict_dynamic

#
catalog_source_connect_src_unsafe_eval

#
catalog_source_connect_src_unsafe_inline

#
catalog_source_connect_src_wildcard

#
catalog_source_connect_src_ws

#
catalog_source_connect_src_wss

#
catalog_source_default_src_blob

#
catalog_source_default_src_data

#
catalog_source_default_src_filesystem

#
catalog_source_default_src_http

#
catalog_source_default_src_https

#
catalog_source_default_src_self

#
catalog_source_default_src_strict_dynamic

#
catalog_source_default_src_unsafe_eval

#
catalog_source_default_src_unsafe_inline

#
catalog_source_default_src_wildcard

#
catalog_source_default_src_ws

#
catalog_source_default_src_wss