✔ Code snippet to convert a permissions-policy back to a feature-policy

[righettod]

Hi,

As the Permissions-Policy header is still in development and is not yet well supported, I was wondering if adding the following code snippet in this location can be helpful and can make sense?

💡 The objective is to allow specifying the same policy but using the 2 format to increase the coverage of browsers according to their support level for Permissions-Policy and/or Feature-Policy policy header.

📑 Source for the conversion rules was this one.

💻 Code snippet (python3):

# Code snippet to convert back a "Permissions-Policy" HTTP response header value back to a "Feature-Policy" HTTP response header value.
# Reason: Support for the "Permissions-Policy" is not yet spread
# Source for conversion rules are the following:
# https://github.com/w3c/webappsec-permissions-policy/blob/main/permissions-policy-explainer.md#appendix-big-changes-since-this-was-called-feature-policy
permissions_policy = 'fullscreen=(), geolocation=(self "https://game.com" "https://map.example.com"), gyroscope=(self), usb=*'
feature_policy_directives = []
# Collect directives
permissions_policy_directives = permissions_policy.split(",")
# Process each directive
for permissions_policy_directive in permissions_policy_directives:
    # Remove leading and trailing spaces
    directive = permissions_policy_directive.strip(" ")
    # Remove all double quotes
    directive = directive.replace("\"", "")
    # Replace disabling expression () by the corresponding one in Feature-Policy
    directive = directive.replace("()", "'none'")
    # Quote keywords: self
    directive = directive.replace("self", "'self'")
    # Replace the equals affectation character by a space
    directive = directive.replace("=", " ")
    # Remove parenthesis
    directive = directive.replace("(", "").replace(")", "")
    # Add the current directive to the collection
    feature_policy_directives.append(directive)
# Convert the collection of directives to a string with ; as directives separator
feature_policy = "; ".join(feature_policy_directives)
print(feature_policy)

⚙ Execution example:

@riramar and all:
What do you think?

[riramar]

Sure. I'm fine with that. If you want to add more details about the script I think the Technical Resources tab would be more appropriate.

[righettod]

Implemented in the following PR:

OWASP/www-project-secure-headers#92