Skip to main content

inject_csp_meta

ssg::csp

Function inject_csp_meta 

Source 
pub fn inject_csp_meta(html: &str, policy: &str) -> String
Expand description

Inserts a <meta http-equiv="Content-Security-Policy" content="..."> tag immediately after the <head> opening tag.

Uses lol_html so the insertion point is the correct one regardless of whitespace, comments, or <title> placement inside the head (issue #525 AC7). If the document already contains a CSP meta tag (either matching policy exactly or any other CSP policy), the input is returned unchanged so successive calls are idempotent. If no <head> element exists in the input, the function returns the input verbatim — this matches the convention used by the rest of the SSG HTML post-processors (no implicit head injection).

§Examples

use ssg::csp::inject_csp_meta;

let html = "<html><head><title>t</title></head></html>";
let out = inject_csp_meta(html, "default-src 'self'");
assert!(out.contains("Content-Security-Policy"));

§Errors

Returns the input unchanged when the underlying lol_html rewrite fails; in practice the only failure mode is allocation exhaustion.