import ( 	"time" ) +// Drivers is a tyny wrapper for https://pkg.go.dev/sql#Drivers

 import ( 	"time" ) +// Drivers is a tyny wrapper for https://pkg.go.dev/sql#Drivers func Drivers() []string { return sql.Drivers() } +// Register is a tyny wrapper for https://pkg.go.dev/sql#Register func Register(name string, driver driver.Driver) { sql.Register(name, driver) } +// ColumnType is a tyny wrapper for https://pkg.go.dev/sql#ColumnType type ColumnType = sql.ColumnType++// DBStats is a tyny wrapper for https://pkg.go.dev/sql#DBStats type DBStats = sql.DBStats++// IsolationLevel is a tyny wrapper for https://pkg.go.dev/sql#IsolationLevel type IsolationLevel = sql.IsolationLevel++// NamedArg is a tyny wrapper for https://pkg.go.dev/sql#NamedArg type NamedArg = sql.NamedArg++// NullBool is a tyny wrapper for https://pkg.go.dev/sql#NullBool type NullBool = sql.NullBool++// NullFloat64 is a tyny wrapper for https://pkg.go.dev/sql#NullFloat64 type NullFloat64 = sql.NullFloat64++// NullInt32 is a tyny wrapper for https://pkg.go.dev/sql#NullInt32 type NullInt32 = sql.NullInt32++// NullInt64 is a tyny wrapper for https://pkg.go.dev/sql#NullInt64 type NullInt64 = sql.NullInt64++// NullString is a tyny wrapper for https://pkg.go.dev/sql#NullString type NullString = sql.NullString++// NullTime is a tyny wrapper for https://pkg.go.dev/sql#NullTime type NullTime = sql.NullTime++// Out is a tyny wrapper for https://pkg.go.dev/sql#Out type Out = sql.Out++// RawBytes is a tyny wrapper for https://pkg.go.dev/sql#RawBytes type RawBytes = sql.RawBytes++// Result is a tyny wrapper for https://pkg.go.dev/sql#Result type Result = sql.Result++// Row is a tyny wrapper for https://pkg.go.dev/sql#Row type Row = sql.Row++// Rows is a tyny wrapper for https://pkg.go.dev/sql#Rows type Rows = sql.Rows++// Scanner is a tyny wrapper for https://pkg.go.dev/sql#Scanner type Scanner = sql.Scanner++// Stmt is a tyny wrapper for https://pkg.go.dev/sql#Stmt type Stmt = sql.Stmt++// TxOptions is a tyny wrapper for https://pkg.go.dev/sql#TxOptions type TxOptions = sql.TxOptions  // Conn behaves as the standard SQL package one, with the exception that it does not implement the `Raw` method for security reasons.+// Please see https://pkg.go.dev/sql#Conn type Conn struct { 	c *sql.Conn } -/*-func (c *Conn) Raw(f func(driverConn interface{}) error) (err error) {-	// Dangerous to expose-}-*/+// Begin is a tyny wrapper for https://pkg.go.dev/sql#Conn.Begin func (c Conn) BeginTx(ctx context.Context, opts *TxOptions) (Tx, error) { 	t, err := c.c.BeginTx(ctx, opts) 	return Tx{t}, err }-func (c Conn) Close() error { return c.c.Close() }++// Close is a tyny wrapper for https://pkg.go.dev/sql#Conn.Close+func (c Conn) Close() error {+	return c.c.Close()+}++// ExecContext is a tyny wrapper for https://pkg.go.dev/sql#Conn.ExecContext func (c Conn) ExecContext(ctx context.Context, query TrustedSQLString, args ...interface{}) (Result, error) { 	return c.c.ExecContext(ctx, query.s, args) }-func (c Conn) PingContext(ctx context.Context) error { return c.c.PingContext(ctx) }++// PingContext is a tyny wrapper for https://pkg.go.dev/sql#Conn.PingContext+func (c Conn) PingContext(ctx context.Context) error {+	return c.c.PingContext(ctx)+}++// PrepareContext is a tyny wrapper for https://pkg.go.dev/sql#Conn.PrepareContext func (c Conn) PrepareContext(ctx context.Context, query TrustedSQLString) (*Stmt, error) { 	return c.c.PrepareContext(ctx, query.s) }++// QueryContext is a tyny wrapper for https://pkg.go.dev/sql#Conn.QueryContext func (c Conn) QueryContext(ctx context.Context, query TrustedSQLString, args ...interface{}) (*Rows, error) { 	return c.c.QueryContext(ctx, query.s, args) }++// QueryRowContext is a tyny wrapper for https://pkg.go.dev/sql#Conn.QueryRowContext func (c Conn) QueryRowContext(ctx context.Context, query TrustedSQLString, args ...interface{}) *Row { 	return c.c.QueryRowContext(ctx, query.s, args) }  // DB behaves as the standard SQL package one, with the exception that it does not implement the `Driver` method for security reasons.+// Please see https://pkg.go.dev/sql#DB type DB struct { 	db *sql.DB } +// Open is a tyny wrapper for https://pkg.go.dev/sql#Open func Open(driverName, dataSourceName string) (DB, error) { 	db, err := sql.Open(driverName, dataSourceName) 	return DB{db}, err }++// OpenDB is a tyny wrapper for https://pkg.go.dev/sql#OpenDB func OpenDB(c driver.Connector) DB { return DB{sql.OpenDB(c)} }++// Begin is a tyny wrapper for https://pkg.go.dev/sql#DB.Begin func (db DB) Begin() (Tx, error) { 	t, err := db.db.Begin() 	return Tx{t}, err }++// BeginTx is a tyny wrapper for https://pkg.go.dev/sql#DB.BeginTx func (db DB) BeginTx(ctx context.Context, opts *TxOptions) (Tx, error) { 	t, err := db.db.BeginTx(ctx, opts) 	return Tx{t}, err }-func (db DB) Close() error { return db.db.Close() }++// Close is a tyny wrapper for https://pkg.go.dev/sql#DB.Close+func (db DB) Close() error {+	return db.db.Close()+}++// Conn is a tyny wrapper for https://pkg.go.dev/sql#DB.Conn func (db DB) Conn(ctx context.Context) (Conn, error) { 	c, err := db.db.Conn(ctx) 	return Conn{c}, err }++// Exec is a tyny wrapper for https://pkg.go.dev/sql#DB.Exec func (db DB) Exec(query TrustedSQLString, args ...interface{}) (Result, error) { 	return db.db.Exec(query.s, args) }++// ExecContext is a tyny wrapper for https://pkg.go.dev/sql#DB.ExecContext func (db DB) ExecContext(ctx context.Context, query TrustedSQLString, args ...interface{}) (Result, error) { 	return db.db.ExecContext(ctx, query.s, args) }-func (db DB) Ping() error                                   { return db.db.Ping() }-func (db DB) PingContext(ctx context.Context) error         { return db.db.PingContext(ctx) }-func (db DB) Prepare(query TrustedSQLString) (*Stmt, error) { return db.db.Prepare(query.s) }++// Ping is a tyny wrapper for https://pkg.go.dev/sql#DB.Ping+func (db DB) Ping() error {+	return db.db.Ping()+}++// PingContext is a tyny wrapper for https://pkg.go.dev/sql#DB.PingContext+func (db DB) PingContext(ctx context.Context) error {+	return db.db.PingContext(ctx)+}++// Prepare is a tyny wrapper for https://pkg.go.dev/sql#DB.Prepare+func (db DB) Prepare(query TrustedSQLString) (*Stmt, error) {+	return db.db.Prepare(query.s)+}++// PrepareContext is a tyny wrapper for https://pkg.go.dev/sql#DB.PrepareContext func (db DB) PrepareContext(ctx context.Context, query TrustedSQLString) (*Stmt, error) { 	return db.db.PrepareContext(ctx, query.s) }++// Query is a tyny wrapper for https://pkg.go.dev/sql#DB.Query func (db DB) Query(query TrustedSQLString, args ...interface{}) (*Rows, error) { 	return db.db.Query(query.s, args) }++// QueryContext is a tyny wrapper for https://pkg.go.dev/sql#DB.QueryContext func (db DB) QueryContext(ctx context.Context, query TrustedSQLString, args ...interface{}) (*Rows, error) { 	return db.db.QueryContext(ctx, query.s, args) }++// QueryRow is a tyny wrapper for https://pkg.go.dev/sql#DB.QueryRow func (db DB) QueryRow(query TrustedSQLString, args ...interface{}) *Row { 	return db.db.QueryRow(query.s, args) }++// QueryRowContext is a tyny wrapper for https://pkg.go.dev/sql#DB.QueryRowContext func (db DB) QueryRowContext(ctx context.Context, query TrustedSQLString, args ...interface{}) *Row { 	return db.db.QueryRowContext(ctx, query.s, args) } -// Go 1.15 func (db DB) SetConnMaxIdleTime(d time.Duration) { db.db.SetConnMaxIdleTime(d) }-func (db DB) SetConnMaxLifetime(d time.Duration) { db.db.SetConnMaxLifetime(d) }-func (db DB) SetMaxIdleConns(n int)              { db.db.SetMaxIdleConns(n) }-func (db DB) SetMaxOpenConns(n int)              { db.db.SetMaxOpenConns(n) }-func (db DB) Stats() DBStats                     { return db.db.Stats() }+// Only available in Go 1.15++// func (db DB) SetConnMaxIdleTime(d time.Duration) { db.db.SetConnMaxIdleTime(d) }

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package xsrfhtml++import (+	"context"+	"crypto/rand"+	"encoding/base64"+	"errors"+	"fmt"+	"github.com/google/go-safeweb/safehttp/plugins/xsrf"++	"github.com/google/go-safeweb/safehttp"+	"golang.org/x/net/xsrftoken"+)++const (+	// TokenKey is the form key used when sending the token as part of POST+	// request.+	TokenKey    = "xsrf-token"+	cookieIDKey = "xsrf-cookie"+)++// Interceptor implements XSRF protection.+type Interceptor struct {+	// SecretAppKey uniquely identifies each registered service and should have+	// high entropy as it is used for generating the XSRF token.+	SecretAppKey string+}++var _ safehttp.Interceptor = &Interceptor{}++type tokenCtxKey struct{}++// Token extracts the XSRF token from the incoming request. If it is not+// present, it returns a non-nil error.+func Token(r *safehttp.IncomingRequest) (string, error) {+	tok := r.Context().Value(tokenCtxKey{})+	if tok == nil {+		return "", errors.New("xsrf token not found")+	}+	return tok.(string), nil+}++func addCookieID(w *safehttp.ResponseWriter) (*safehttp.Cookie, error) {+	buf := make([]byte, 20)+	if _, err := rand.Read(buf); err != nil {+		return nil, fmt.Errorf("crypto/rand.Read: %v", err)+	}++	c := safehttp.NewCookie(cookieIDKey, base64.StdEncoding.EncodeToString(buf))+	c.SetSameSite(safehttp.SameSiteStrictMode)+	if err := w.SetCookie(c); err != nil {+		return nil, err+	}+	return c, nil+}++// Before should be executed before directing the safehttp.IncomingRequest to+// the handler to ensure it is not part of a Cross-Site Request+// Forgery attack.+//+// On first user visit through a state preserving request (GET, HEAD or+// OPTIONS), a nonce-based cookie will be set in the response as a way to+// distinguish between users and prevent pre-login XSRF attacks. The cookie will+// be used in the token generation and verification algorithm and is expected to+// be present in all subsequent incoming requests.+//+// For every authorized request, the interceptor will also generate a+// cryptographically-safe XSRF token using the appKey, the cookie and the path+// visited. This can be later extracted using Token and should be injected as a+// hidden input field in HTML forms.+//+// In case of state changing requests (all except GET, HEAD and OPTIONS), the+// interceptor checks for the presence of the XSRF token in the request body+// (expected to have been injected) and validates it.+func (it *Interceptor) Before(w *safehttp.ResponseWriter, r *safehttp.IncomingRequest, _ safehttp.InterceptorConfig) safehttp.Result {+	needsValidation := !xsrf.StatePreserving(r)

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package xsrfangular++import (+	"crypto/rand"+	"encoding/base64"+	"fmt"+	"github.com/google/go-safeweb/safehttp"+	"github.com/google/go-safeweb/safehttp/plugins/xsrf"+	"strconv"+	"time"+)++// Interceptor provides protection against Cross-Site Request Forgery attacks+// for Angular's XHR requests.+//+// See https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection for more details.+type Interceptor struct {+	// TokenCookieName is the name of the seesion cookie that holds the XSRF+	// token.+	TokenCookieName string+	// TokenHeaderName is the name of the HTTP header that holds the XSRF token.+	TokenHeaderName string+}++var _ safehttp.Interceptor = &Interceptor{}++// Default creates an Interceptor with TokenCookieName set to XSRF-TOKEN and+// TokenHeaderName set to X-XSRF-TOKEN, their default values. However, in order+// to prevent collisions when multiple applications share the same domain or+// subdomain, each application should set a unique name for the cookie.+//+// See https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection for more details.+func Default() *Interceptor {+	return &Interceptor{+		TokenCookieName: "XSRF-TOKEN",+		TokenHeaderName: "X-XSRF-TOKEN",+	}+}++// Before checks for the presence of a matching XSRF token, generated on the+// first page access, in both a cookie and a header. Their names should be set+// when the Interceptor is created.+func (it *Interceptor) Before(w *safehttp.ResponseWriter, r *safehttp.IncomingRequest, _ safehttp.InterceptorConfig) safehttp.Result {+	if xsrf.StatePreserving(r) {+		return safehttp.NotWritten()+	}++	c, err := r.Cookie(it.TokenCookieName)+	if err != nil || c.Value() == "" {+		return w.WriteError(safehttp.StatusForbidden)+	}++	tok := r.Header.Get(it.TokenHeaderName)+	if tok == "" || tok != c.Value() {+		// Only JavaScript running on the user domain can read the+		// cookie and correctly set the token header. Hence, if the same token+		// is found in both the cookie and the header, this guarantees the+		// request came from the user's domain.+		return w.WriteError(safehttp.StatusUnauthorized)+	}++	return safehttp.NotWritten()+}++func (it *Interceptor) addTokenCookie(w *safehttp.ResponseWriter) error {+	tok := make([]byte, 20)+	if _, err := rand.Read(tok); err != nil {+		return fmt.Errorf("crypto/rand.Read: %v", err)+	}+	c := safehttp.NewCookie(it.TokenCookieName, base64.StdEncoding.EncodeToString(tok))++	c.SetSameSite(safehttp.SameSiteStrictMode)+	c.SetPath("/")+	d := 24 * time.Hour+	timeout, err := strconv.Atoi(fmt.Sprintf("%.0f", d.Seconds()))+	if err != nil {+		return err+	}+	// Set the duration of the token cookie to 24 hours.+	c.SetMaxAge(timeout)+	// Needed in order to make the cookie accessible by JavaScript+	// running on the user's domain.+	c.DisableHTTPOnly()++	if err := w.SetCookie(c); err != nil {+		return err+	}+	return nil+}++// Commit generates a cryptographically secure random cookie on the first state+// preserving request (GET, HEAD or OPTION) and sets it in the response. On+// every subsequent request the cookie is expected alongside a header that+// matches its value.+func (it *Interceptor) Commit(w *safehttp.ResponseWriter, r *safehttp.IncomingRequest, resp safehttp.Response, _ safehttp.InterceptorConfig) safehttp.Result {+	if c, err := r.Cookie(it.TokenCookieName); err == nil && c.Value() != "" {+		return safehttp.NotWritten()+	}++	if !xsrf.StatePreserving(r) {

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package xsrfangular++import (+	"crypto/rand"+	"encoding/base64"+	"fmt"+	"github.com/google/go-safeweb/safehttp"+	"github.com/google/go-safeweb/safehttp/plugins/xsrf"+	"strconv"+	"time"+)++// Interceptor provides protection against Cross-Site Request Forgery attacks+// for Angular's XHR requests.+//+// See https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection for more details.+type Interceptor struct {+	// TokenCookieName is the name of the seesion cookie that holds the XSRF+	// token.+	TokenCookieName string+	// TokenHeaderName is the name of the HTTP header that holds the XSRF token.+	TokenHeaderName string+}++var _ safehttp.Interceptor = &Interceptor{}++// Default creates an Interceptor with TokenCookieName set to XSRF-TOKEN and+// TokenHeaderName set to X-XSRF-TOKEN, their default values. However, in order+// to prevent collisions when multiple applications share the same domain or+// subdomain, each application should set a unique name for the cookie.+//+// See https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection for more details.+func Default() *Interceptor {+	return &Interceptor{+		TokenCookieName: "XSRF-TOKEN",+		TokenHeaderName: "X-XSRF-TOKEN",+	}+}++// Before checks for the presence of a matching XSRF token, generated on the+// first page access, in both a cookie and a header. Their names should be set+// when the Interceptor is created.+func (it *Interceptor) Before(w *safehttp.ResponseWriter, r *safehttp.IncomingRequest, _ safehttp.InterceptorConfig) safehttp.Result {+	if xsrf.StatePreserving(r) {+		return safehttp.NotWritten()+	}++	c, err := r.Cookie(it.TokenCookieName)+	if err != nil || c.Value() == "" {+		return w.WriteError(safehttp.StatusForbidden)+	}++	tok := r.Header.Get(it.TokenHeaderName)+	if tok == "" || tok != c.Value() {+		// Only JavaScript running on the user domain can read the+		// cookie and correctly set the token header. Hence, if the same token+		// is found in both the cookie and the header, this guarantees the+		// request came from the user's domain.+		return w.WriteError(safehttp.StatusUnauthorized)+	}++	return safehttp.NotWritten()+}++func (it *Interceptor) addTokenCookie(w *safehttp.ResponseWriter) error {+	tok := make([]byte, 20)+	if _, err := rand.Read(tok); err != nil {+		return fmt.Errorf("crypto/rand.Read: %v", err)+	}+	c := safehttp.NewCookie(it.TokenCookieName, base64.StdEncoding.EncodeToString(tok))++	c.SetSameSite(safehttp.SameSiteStrictMode)+	c.SetPath("/")+	d := 24 * time.Hour+	timeout, err := strconv.Atoi(fmt.Sprintf("%.0f", d.Seconds()))+	if err != nil {+		return err+	}+	// Set the duration of the token cookie to 24 hours.+	c.SetMaxAge(timeout)

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package xsrfangular++import (+	"crypto/rand"+	"encoding/base64"+	"fmt"+	"github.com/google/go-safeweb/safehttp"+	"github.com/google/go-safeweb/safehttp/plugins/xsrf"+)++// Interceptor provides protection against Cross-Site Request Forgery attacks+// for Angular's XHR requests.+//+// See https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection for more details.+type Interceptor struct {+	// TokenCookieName is the name of the seesion cookie that holds the XSRF+	// token.+	TokenCookieName string+	// TokenHeaderName is the name of the HTTP header that holds the XSRF token.+	TokenHeaderName string+}++var _ safehttp.Interceptor = &Interceptor{}++// Default creates an Interceptor with TokenCookieName set to XSRF-TOKEN and+// TokenHeaderName set to X-XSRF-TOKEN, their default values. However, in order+// to prevent collisions when multiple applications share the same domain or+// subdomain, each application should set a unique name for the cookie.+func Default() *Interceptor {+	return &Interceptor{+		TokenCookieName: "XSRF-TOKEN",+		TokenHeaderName: "X-XSRF-TOKEN",+	}+}++// Before checks for the presence of a matching XSRF token, generated on the+// first page access, in both a cookie and a header. Their names should be set+// when the Interceptor is created.+func (it *Interceptor) Before(w *safehttp.ResponseWriter, r *safehttp.IncomingRequest, _ safehttp.InterceptorConfig) safehttp.Result {+	if xsrf.StatePreserving(r) {+		return safehttp.NotWritten()+	}++	c, err := r.Cookie(it.TokenCookieName)+	if err != nil || c.Value() == "" {+		return w.WriteError(safehttp.StatusForbidden)+	}++	tok := r.Header.Get(it.TokenHeaderName)+	if tok == "" || tok != c.Value() {+		// Only JavaScript running on the user domain can read the

+// Copyright 2020 Google LLC

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package xsrfangular++import (+	"crypto/rand"+	"encoding/base64"+	"fmt"+	"github.com/google/go-safeweb/safehttp"+	"github.com/google/go-safeweb/safehttp/plugins/xsrf"+)++// Interceptor provides protection against Cross-Site Request Forgery attacks+// for Angular's XHR requests.+//+// See https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection for more details.+type Interceptor struct {+	// TokenCookieName is the name of the seesion cookie that holds the XSRF+	// token. In order to prevent collisions when multiple applications share+	// the same domain or subdomain, each application should set a unique name+	// for the cookie.+	TokenCookieName string+	// TokenHeaderName is the name of the HTTP header that holds the XSRF token.+	TokenHeaderName string+}++var _ safehttp.Interceptor = &Interceptor{}++// Before checks for the presence of a matching XSRF token, generated on the+// first page access, in both a cookie and a header. Their names should be set+// when the Interceptor is created.+func (it *Interceptor) Before(w *safehttp.ResponseWriter, r *safehttp.IncomingRequest, _ safehttp.InterceptorConfig) safehttp.Result {+	if xsrf.StatePreserving(r) {+		return safehttp.NotWritten()+	}++	c, err := r.Cookie(it.TokenCookieName)+	if err != nil || c.Value() == "" {+		return w.WriteError(safehttp.StatusForbidden)+	}++	tok := r.Header.Get(it.TokenHeaderName)+	if tok == "" || tok != c.Value() {+		return w.WriteError(safehttp.StatusUnauthorized)+	}++	return safehttp.NotWritten()+}++func (it *Interceptor) addAngularTokenCookie(w *safehttp.ResponseWriter) error {+	tok := make([]byte, 20)+	if _, err := rand.Read(tok); err != nil {+		return fmt.Errorf("crypto/rand.Read: %v", err)+	}+	c := safehttp.NewCookie(it.TokenCookieName, base64.StdEncoding.EncodeToString(tok))++	c.SetSameSite(safehttp.SameSiteStrictMode)+	c.SetPath("/")+	// Set the duration of the token cookie to 24 hours.+	c.SetMaxAge(86400)

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package xsrfangular++import (+	"crypto/rand"+	"encoding/base64"+	"fmt"+	"github.com/google/go-safeweb/safehttp"+	"github.com/google/go-safeweb/safehttp/plugins/xsrf"+)++// Interceptor provides protection against Cross-Site Request Forgery attacks+// for Angular's XHR requests.+//+// See https://docs.angularjs.org/api/ng/service/$http#cross-site-request-forgery-xsrf-protection for more details.+type Interceptor struct {+	// TokenCookieName is the name of the seesion cookie that holds the XSRF

 type Template interface { // TemplateResponse bundles a Template with its data and names to function // mappings to be passed together to the commit phase. type TemplateResponse struct {-	Template *Template-	Data     *interface{}+	Template Template+	Data     interface{} 	FuncMap  map[string]interface{} }  // NoContentResponse is sent to the commit phase when it's initiated from // ResponseWriter.NoContent. type NoContentResponse struct{}++// JSONResp creates a JSONResponse from a data object. This should be a+// valid JSON object that can be serialised and written to the+// http.ResponseWriter using a JSON encoder.+func JSONResp(data interface{}) JSONResponse {+	return JSONResponse{Data: data}+}++// TemplateResp creates a TemplateResponse from a Template, its data and+// the name to function mappings. These will be pre-processed and then written+// to the http.ResponseWriter, if deemed safe. If the funcMap is non-nil, its+// elements will override the existing name to function mappings in the+// template. An attempt to define a new name to function mapping that is not+// already in the template will result in a panic.+func TemplateResp(t Template, data interface{}, funcMap map[string]interface{}) TemplateResponse {+	return TemplateResponse{+		Template: t,+		Data:     data,+		FuncMap:  funcMap,+	}+}

 func TestResponseWriterWriteTwicePanic(t *testing.T) { 			}, 		}, 		{-			name: "Call WriteJSON twice",+			name: "Call NoContent twice", 			write: func(w *safehttp.ResponseWriter) {-				obj := struct{ Field string }{Field: "myField"}-				w.WriteJSON(obj)-				w.WriteJSON(obj)+				w.NoContent()+				w.NoContent() 			}, 		}, 		{-			name: "Call Write then WriteJSON",+			name: "Call WriteError twice", 			write: func(w *safehttp.ResponseWriter) {-				obj := struct{ Field string }{Field: "myField"}-				w.Write(obj)-				w.WriteJSON(obj)+				w.WriteError(safehttp.StatusInternalServerError)+				w.WriteError(safehttp.StatusInternalServerError) 			}, 		}, 		{-			name: "Call WriteTemplate twice",+			name: "Call Redirect twice", 			write: func(w *safehttp.ResponseWriter) {-				w.WriteTemplate(template.Must(template.New("name").Parse("<h1>{{ . }}</h1>")), "This is an actual heading, though.")-				w.WriteTemplate(template.Must(template.New("name").Parse("<h1>{{ . }}</h1>")), "This is an actual heading, though.")+				ir := safehttptest.NewRequest(safehttp.MethodGet, "/", nil)+				w.Redirect(ir, "/asdf", safehttp.StatusMovedPermanently)+				w.Redirect(ir, "/asdf", safehttp.StatusMovedPermanently) 			}, 		},+	}++	for _, tt := range tests {+		t.Run(tt.name, func(t *testing.T) {+			w := safehttp.NewResponseWriter(safehttp.DefaultDispatcher{}, safehttptest.NewTestResponseWriter(&strings.Builder{}), nil)+			defer func() {+				if r := recover(); r == nil {

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++// Package xsrf provides a safehttp.Interceptor that ensures Cross-Site Request+// Forgery protection by verifying the incoming requests, rejecting those+// requests that are suspected to be part of an attack.+package angularxsrf++import (+	"github.com/google/go-cmp/cmp"+	"github.com/google/go-safeweb/safehttp"+	"github.com/google/go-safeweb/safehttp/safehttptest"+	"strings"+	"testing"+)++const (+	cookieName = "XSRF-TOKEN"+	headerName = "X-XSRF-TOKEN"+)++func TestAngularAddCookie(t *testing.T) {+	req := safehttptest.NewRequest(safehttp.MethodGet, "/", nil)+	rec := safehttptest.NewResponseRecorder()+	i := &Interceptor{+		TokenCookieName: cookieName,+		TokenHeaderName: headerName,+	}+	i.Commit(rec.ResponseWriter, req, nil, nil)++	if got, want := rec.Status(), safehttp.StatusOK; got != want {+		t.Errorf("rec.Status(): got %v, want %v", got, want)+	}++	tokCookieDefaults := "Path=/; Max-Age=86400; Secure; SameSite=Strict"+	got := map[string][]string(rec.Header())["Set-Cookie"][0]+	if !strings.Contains(got, i.TokenCookieName) {+		t.Errorf("Set-Cookie header: %s not present", i.TokenCookieName)+	}+	if !strings.Contains(got, tokCookieDefaults) {+		t.Errorf("Set-Cookie header: got %s, want defaults %s", got, tokCookieDefaults)+	}++	if got, want := rec.Body(), ""; got != want {+		t.Errorf("rec.Body(): got %q want %q", got, want)+	}+}++func TestAngularPostProtection(t *testing.T) {+	tests := []struct {+		name       string+		req        *safehttp.IncomingRequest+		wantStatus safehttp.StatusCode+		wantHeader map[string][]string+		wantBody   string+	}{+		{+			name: "Same cookie and header",+			req: func() *safehttp.IncomingRequest {+				req := safehttptest.NewRequest(safehttp.MethodPost, "/", nil)+				req.Header.Set("Cookie", cookieName+"="+"1234")+				req.Header.Set(headerName, "1234")+				return req+			}(),+			wantStatus: safehttp.StatusOK,+			wantHeader: map[string][]string{},+			wantBody:   "",+		},+		{+			name: "Different cookie and header",+			req: func() *safehttp.IncomingRequest {+				req := safehttptest.NewRequest(safehttp.MethodPost, "/", nil)+				req.Header.Set("Cookie", cookieName+"="+"5768")+				req.Header.Set(headerName, "1234")+				return req+			}(),+			wantStatus: safehttp.StatusUnauthorized,+			wantHeader: map[string][]string{+				"Content-Type":           {"text/plain; charset=utf-8"},+				"X-Content-Type-Options": {"nosniff"},+			},+			wantBody: "Unauthorized\n",+		},+		{+			name: "Missing header",+			req: func() *safehttp.IncomingRequest {+				req := safehttptest.NewRequest(safehttp.MethodPost, "/", nil)+				req.Header.Set("Cookie", cookieName+"="+"1234")+				return req+			}(),+			wantStatus: safehttp.StatusUnauthorized,+			wantHeader: map[string][]string{+				"Content-Type":           {"text/plain; charset=utf-8"},+				"X-Content-Type-Options": {"nosniff"},+			},+			wantBody: "Unauthorized\n",+		},+		{+			name: "Missing cookie",+			req: func() *safehttp.IncomingRequest {+				req := safehttptest.NewRequest(safehttp.MethodPost, "/", nil)+				req.Header.Set(headerName, "1234")+				return req+			}(),+			wantStatus: safehttp.StatusForbidden,+			wantHeader: map[string][]string{+				"Content-Type":           {"text/plain; charset=utf-8"},+				"X-Content-Type-Options": {"nosniff"},+			},+			wantBody: "Forbidden\n",

 type TemplateResponse struct { // NoContentResponse is sent to the commit phase when it's initiated from // ResponseWriter.NoContent. type NoContentResponse struct{}++// NewJSONResponse creates a JSON response from a data object. This should be a+// valid JSON object that can be serialised and written to the+// http.ResponseWriter using a JSON encoder.+func NewJSONResponse(data interface{}) JSONResponse {+	return JSONResponse{Data: data}+}++// NewTemplateResponse creates a TemplateResponse from a Template, its data and+// the name to function mappings. These will be pre-processed and then written+// to the http.ResponseWriter, if deemed safe. If the funcMap is non-nil, its+// elements will override the existing name to function mappings in the+// template. An attempt to define a new name to function mapping that is not+// already in the template will result in a panic.+func NewTemplateResponse(t Template, data interface{}, funcMap map[string]interface{}) TemplateResponse {+	return TemplateResponse{+		Template: &t,+		Data:     &data,

 func TestDefaultDispatcherValidResponse(t *testing.T) { 						Parse("<h1>{{ . }}</h1>"))) 				var data interface{} 				data = "This is an actual heading, though."-				resp := safehttp.TemplateResponse{-					Template: &t,-					Data:     &data,-				}-				return d.ExecuteTemplate(w, resp)+				return d.Write(w, safehttp.NewTemplateResponse(t, data, nil))

 type Interceptor interface { 	// is written to the ResponseWriter, then the Commit phases from the 	// remaining interceptors won't execute. 	Commit(w *ResponseWriter, r *IncomingRequest, resp Response, cfg InterceptorConfig) Result++	// OnError runs when ResponseWriter.WriteError is called, before the+	// actual error response is written. An attempt to write to the+	// ResponseWriter in this phase will result in an irrecoverable error.+	OnError(w *ResponseWriter, r *IncomingRequest, resp Response, cfg InterceptorConfig) Result

 func TestMuxHandlerReturnsNotWritten(t *testing.T) { 		t.Errorf(`response body got: %q want: ""`, got) 	} }++type onErrorWriteInterceptor struct{}++func (onErrorWriteInterceptor) Before(w *safehttp.ResponseWriter, _ *safehttp.IncomingRequest, _ safehttp.InterceptorConfig) safehttp.Result {+	return w.WriteError(safehttp.StatusBadRequest)+}++func (onErrorWriteInterceptor) Commit(_ *safehttp.ResponseWriter, _ *safehttp.IncomingRequest, _ safehttp.Response, _ safehttp.InterceptorConfig) safehttp.Result {+	return safehttp.Result{}+}++func (onErrorWriteInterceptor) OnError(w *safehttp.ResponseWriter, _ *safehttp.IncomingRequest, _ safehttp.Response, _ safehttp.InterceptorConfig) safehttp.Result {+	w.Header().Set("header", "bad")+	return w.WriteError(safehttp.StatusInsufficientStorage)+}++func TestMuxInterceptorWriteInOnError(t *testing.T) {+	b := &strings.Builder{}+	rw := safehttptest.NewTestResponseWriter(b)++	req := httptest.NewRequest(safehttp.MethodGet, "http://foo.com/bar", nil)++	mb := &safehttp.ServeMuxConfig{}+	mb.Intercept(onErrorWriteInterceptor{})++	registeredHandler := safehttp.HandlerFunc(func(w *safehttp.ResponseWriter, r *safehttp.IncomingRequest) safehttp.Result {+		return w.Write(safehtml.HTMLEscaped("<h1>Hello World!</h1>"))+	})+	mb.Handle("/bar", safehttp.MethodGet, registeredHandler)++	defer func() {+		if r := recover(); r == nil {+			t.Errorf(`mb.Mux().ServeHTTP(rw, req): expected panic`)+		}+	}()

 type Interceptor interface { 	// is written to the ResponseWriter, then the Commit phases from the 	// remaining interceptors won't execute. 	Commit(w *ResponseWriter, r *IncomingRequest, resp Response, cfg InterceptorConfig) Result++	// OnError runs when ResponseWriter.WriteError is called, before the+	// actual error response is written. An attempt to write to the+	// ResponseWriter in this phase will result in an irrecoverable error.+	OnError(w *ResponseWriter, r *IncomingRequest, resp Response, cfg InterceptorConfig) Result

 func (p Policy) String() string { 	return string(p.Mode) + `; report-to "` + p.ReportingGroup + `"` } -// NewInterceptor constructs an interceptor that applies the given policies.-func NewInterceptor(policies ...Policy) Interceptor {-	var rep []string-	var enf []string+type serializedPolicies struct {+	rep []string+	enf []string+}++func serializePolicies(policies ...Policy) serializedPolicies {+	var s serializedPolicies 	for _, p := range policies { 		if p.ReportOnly {-			rep = append(rep, p.String())+			s.rep = append(s.rep, p.String()) 		} else {-			enf = append(enf, p.String())+			s.enf = append(s.enf, p.String()) 		} 	}-	return Interceptor{rep: rep, enf: enf}+	return s+}++// NewInterceptor constructs an interceptor that applies the given policies.+func NewInterceptor(policies ...Policy) Interceptor {

 func (h handler) commitPhase(w *ResponseWriter, resp Response) { 		} 	} }++// errrorPhase calls the OnError phases of all the interceptors associated with+// a handler. This stage runs before an error response is written to the+// ResponseWriter.+//+// TODO: BIG WARNING, if an interceptor attempts to write to the ResponseWriter+// in the OnError phase then this method will recurse.

 type Interceptor interface { 	// is written to the ResponseWriter, then the Commit phases from the 	// remaining interceptors won't execute. 	Commit(w *ResponseWriter, r *IncomingRequest, resp Response, cfg InterceptorConfig) Result++	// OnError runs when ResponseWriter.WriteError is called, before the+	// actual error response is written.

 import ( 	"crypto/rand" 	"encoding/base64" 	"errors"-	"fmt"- 	"github.com/google/go-safeweb/safehttp" 	"golang.org/x/net/xsrftoken" )  const (-	// TokenKey is the form key used when sending the token as part of POST-	// request.-	TokenKey    = "xsrf-token" 	cookieIDKey = "xsrf-cookie"+	TokenKey    = "xsrf-token" ) +type tokenCtxKey struct{}+ var statePreservingMethods = map[string]bool{ 	safehttp.MethodGet:     true, 	safehttp.MethodHead:    true, 	safehttp.MethodOptions: true, } -// Interceptor implements XSRF protection. type Interceptor struct {-	// SecretAppKey uniquely identifies each registered service and should have-	// high entropy as it is used for generating the XSRF token.-	SecretAppKey string+	secretAppKey string+	g            Generator+	c            Checker+	i            Injector