Revamp signatures and break header caching on FF

Signatures, instead of consisting of the secure salt followed by the unique
value generated from the URL, are now the unique value generated from the
policy value (which will follow them) succeeded by the URL.

CSP headers are now _always_ cleared on FF, regardless of whether the page
is whitelisted or not. This means whitelisting takes effect on page reload,
rather than only when caching occurs. However, it obviously presents security
issues; refinment will occur in a future commit.

1 files changed, 6 insertions, 5 deletions

diff --git a/content/main.js b/content/main.js
index e75f61d..317b319 100644
--- a/content/main.js
+++ b/content/main.js
@@ -100,15 +100,16 @@ function inject_csp(head)
 
 if (!is_privileged_url(document.URL)) {
     const targets = url_extract_policy(document.URL);
-    targets.policy = targets.policy || {};
-    const nonce = targets.policy.nonce || gen_nonce();
-
-    if (targets.signed)
+    if (targets.policy) {
 	if (targets.target2 !== undefined)
 	    window.location.href = targets.base_url + targets.target2;
 	else
 	    history.replaceState(null, "", targets.base_url);
-
+    }
+    
+    targets.policy = targets.valid_sig ? targets.policy : {};
+    
+    const nonce = targets.policy.nonce || gen_nonce();
     start_activity_info_server();
     handle_page_actions(nonce);