[FEATURE] Add Server Option to Send SAP's Target CSPs by default

[codeworrior]

When option cspDefaults:true is given, the server now sends two policies
for *.html files, both in report-only mode:

• sap-target-level-1, which forbids inline scripts and only allows
  sources from self
• sap-target-level-2, which additionally forbids 'eval'

Each policy is sent with its own 'Content-Security-Policy-Report-Only'
header. This might look uncommon, but simplifies automated validation of
the violation reports that are sent by the browser. Browsers don't
consistently report blocked-uri or source-file, but the original-policy
is reported consistently.

middleware/csp.js:

• allow to define and send a 2nd default policy
• skip execution for file types other than *.html and for HTTP methods
  other than POST and GET
• use native capabilities of the express request object instead of
  parsing URLs with NodeJS means
• when using the URL parameter, the shorter suffix ":ro" can now be
  used to activate the report-only mode

server.js

• add boolean server option 'cspDefaults' (default false)
• enrich csp middleware configuration accordingly when option is set

test/

• enhance for the new features

Thank you for your contribution! 🙌

To get it merged faster, kindly review the checklist below:

Pull Request Checklist

• Reviewed the Contributing Guidelines
  • Especially the How to Contribute section
• No merge commits
• Correct commit message style

[CLAassistant]

All committers have signed the CLA.

[coveralls]

Coverage increased (+2.5%) to 93.156% when pulling 10a8a74 on add-csp-defaults into aa57198 on master.

[coveralls]

Coverage increased (+2.5%) to 93.156% when pulling 9c0a37d on add-csp-defaults into aa57198 on master.

[codeworrior]

Renamed to sendSapTargetCSPs. Or should it be 'SAP'?

[matz3]

I don't mind. But should we really use CSPs instead of just CSP?
I guess your idea is that we currently send two headers with the two target levels, right?

[RandomByte]

It should definitely be camelcased: Csp/Csps. I would also favor Csp. Imho, abstractly speaking, a policy may contain multiple policies.

[codeworrior]

@RandomByte why 'definitely' ? Our documentation guidelines state that "Consider the correct spelling of capitalized abbreviations like ID, URL, JSON etc. At the beginning of UI5 development, we decided for the same reg. control properties and APIs.

And others give the same guidance, e.g. https://url.spec.whatwg.org/#url-apis-elsewhere :

If a standard decides to use a variant of the name "URL" for a feature it defines, it should name such a feature "url" (i.e., lowercase and with an "l" at the end). Names such as "URL", "URI", and "IRI" should not be used. However, if the name is a compound, "URL" (i.e., uppercase) is preferred, e.g., "newURL" and "oldURL".

[RandomByte]

Hm, I see. So far we tried to apply Googles Java Script guidelines for such cases: https://google.github.io/styleguide/jsguide.html#naming-camel-case-defined

From my experience, I find this convention rather easy to apply and consume as it is very consistent with abbreviations of all kinds.
E.g. in your example Sap is camel cased while CSP is not. Google simply says camel case everything.

Anyways, I could not find a public API of the tooling that applies this convention in that way so we can still decide and document it in https://github.com/SAP/ui5-tooling/blob/master/docs/Guidelines.md 👍

[RandomByte]

But this detail should not keep us from merging this. So from my side all uppercase or camel cased is fine and totally up to you in this case.

Just the Travis/ESLint still has something to mock about:

/home/travis/build/SAP/ui5-server/lib/server.js
   94:2    error  @param "sendSapTargetCSPs" does not match an existing function parameter  jsdoc/check-param-names
  107:108  error  Trailing spaces not allowed                                               no-trailing-spaces
  108:76   error  Trailing spaces not allowed                                               no-trailing-spaces

[codeworrior]

"Your proposal is acceptable" :-)

[RandomByte]

Please use Squash and Merge!

@matz3 I think your review comment is resolved?