func TestRequestSetNilContext(t *testing.T) { 			t.Errorf(`ir.SetContext(nil): expected panic`) 		} 	}()--	ir.SetContext(nil)+	var nilContext context.Context+	ir.SetContext(nilContext)

  package safehttp -// Handler TODO+// Handler responds to an HTTP request.+//+// ServeHTTP should set headers, call one of the writing functions on the ResponseWriter+// to write the body of the response and then return the Result received from writing+// to the ResponseWriter.+//+// It is not valid to use the ResponseWriter or read from the body of the IncomingRequest+// after or concurrently with the completion of the ServeHTTP call.

 var disallowedContentTypes = map[string]bool{ // // Each CORS request must contain the header "X-Cors: 1". //+// The HEAD request method is disallowed.+// // All of this is to prevent XSRF. type Interceptor struct { 	// AllowedOrigins determines which origins should be allowed in the 	// Access-Control-Allow-Origin header. 	AllowedOrigins map[string]bool-	allowedHeaders map[string]bool

 func TestResponseWriterWriteTwicePanic(t *testing.T) { 				w.Write(safehtml.HTMLEscaped("<h1>Escaped, so not really a heading</h1>")) 			}, 		},+		{+			name: "Call WriteJSON twice",+			write: func(w *safehttp.ResponseWriter) {+				obj := struct{ Field string }{Field: "myField"}+				w.WriteJSON(obj)+				w.WriteJSON(obj)+			},

 func NotWritten() Result { 	return Result{} } -// Write TODO+// Write dispatches the response to the Dispatcher, setting the Content-Type to+// text/html; charset=utf-8 and response status to 200 OK if resp is a safe+// response. The Dispatcher will then write the response to the underlying+// Response Writer.+//+// TODO: replace panics with proper error handling when getting the response+// Content-Type or writing the response fails. func (w *ResponseWriter) Write(resp Response) Result {-	w.markWritten()+	ct, err := w.d.ContentType(resp)+	if err != nil {+		panic(err)+	}+	w.rw.WriteHeader(int(StatusOK))+	w.rw.Header().Set("Content-Type", ct)

 func NotWritten() Result { 	return Result{} } -// Write TODO+// Write dispatches the response to the Dispatcher, setting the Content-Type to+// text/html; charset=utf-8 and response status to 200 OK if resp is a safe+// response. The Dispatcher will then write the response to the underlying+// Response Writer.+//+// TODO: replace panics with proper error handling when getting the response+// Content-Type or writing the response fails. func (w *ResponseWriter) Write(resp Response) Result { 	w.markWritten()+	ct, err := w.d.ContentType(resp)+	if err != nil {+		panic(err)+	}+	w.rw.Header().Set("Content-Type", ct)+	w.rw.WriteHeader(int(StatusOK)) 	if err := w.d.Write(w.rw, resp); err != nil {-		panic("error")+		panic(err) 	} 	return Result{} } -// WriteTemplate TODO+// WriteJSON encapsulates data into a JSON response and dispatches it to the+// Dispatcher, to be serialised and written to the ResponseWriter. It will also+// set the Content-Type to application/json; charset=utf-8 and the response+// status to 200 OK.+//+// TODO: replace panics with proper error handling when getting the response+// Content-Type or writing the response fails.+func (w *ResponseWriter) WriteJSON(data interface{}) Result {+	w.markWritten()+	resp := JSONResponse{Data: data}+	ct, err := w.d.ContentType(resp)+	if err != nil {+		panic(err)+	}+	w.rw.Header().Set("Content-Type", ct)+	w.rw.WriteHeader(int(StatusOK))+	if err := w.d.WriteJSON(w.rw, resp); err != nil {+		panic(err)+	}+	return Result{}+}++// WriteTemplate dispatches a parsed template and a data object to the+// Dispatcher to be executed and written to the underlying Response Writer, in+// case the template is a safe HTML template. If t is a safe HTML Template, the+// Content-Type will also be set to text/html; charset=utf-8 and the response+// status to 200 OK.+//+// TODO: replace panics with proper error handling when getting the response+// Content-Type or writing the response fails.

 func NotWritten() Result { 	return Result{} } -// Write TODO+// Write dispatches the response to the Dispatcher, setting the Content-Type to+// text/html; charset=utf-8 and response status to 200 OK if resp is a safe+// response. The Dispatcher will then write the response to the underlying+// Response Writer.+//+// TODO: replace panics with proper error handling when getting the response+// Content-Type or writing the response fails. func (w *ResponseWriter) Write(resp Response) Result { 	w.markWritten()+	ct, err := w.d.ContentType(resp)+	if err != nil {+		panic(err)+	}+	w.rw.Header().Set("Content-Type", ct)+	w.rw.WriteHeader(int(StatusOK)) 	if err := w.d.Write(w.rw, resp); err != nil {-		panic("error")+		panic(err) 	} 	return Result{} } -// WriteTemplate TODO+// WriteJSON encapsulates data into a JSON response and dispatches it to the+// Dispatcher, to be serialised and written to the ResponseWriter. It will also+// set the Content-Type to application/json; charset=utf-8 and the response+// status to 200 OK.+//+// TODO: replace panics with proper error handling when getting the response+// Content-Type or writing the response fails.+func (w *ResponseWriter) WriteJSON(data interface{}) Result {+	w.markWritten()+	resp := JSONResponse{Data: data}+	ct, err := w.d.ContentType(resp)+	if err != nil {+		panic(err)+	}+	w.rw.Header().Set("Content-Type", ct)

 func NotWritten() Result { 	return Result{} } -// Write TODO+// Write dispatches the response to the Dispatcher, setting the Content-Type to+// text/html; charset=utf-8 and response status to 200 OK if resp is a safe

 func (m methodHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) { 		} 	} -	h.ServeHTTP(rw, ir)+	if res := h.ServeHTTP(rw, ir); !res.written {+		rw.NoContent()

 func NotWritten() Result { 	return Result{} } -// Write TODO+// Write dispatches the response to the Dispatcher, setting the Content-Type to+// text/html; charset=utf-8 and response status to 200 OK if resp is a safe+// response. The Dispatcher will then write the response to the underlying+// Response Writer.+//+// TODO: replace panics with proper error handling when getting the response+// Content-Type or writing the response fails. func (w *ResponseWriter) Write(resp Response) Result {-	w.markWritten()+	ct, err := w.d.ContentType(resp)+	if err != nil {+		panic(err)+	}+	w.rw.WriteHeader(int(StatusOK))+	w.rw.Header().Set("Content-Type", ct)

 func TestMuxInterceptors(t *testing.T) { }  type setHeaderConfig struct {-	name  string-	value string

 func (setHeaderConfig) Match(i safehttp.Interceptor) bool { type setHeaderConfigInterceptor struct{}  func (p setHeaderConfigInterceptor) Before(w *safehttp.ResponseWriter, _ *safehttp.IncomingRequest, cfg interface{}) safehttp.Result {-	name := "Pizza" 	value := "Hawaii" 	if c, ok := cfg.(setHeaderConfig); ok {-		name = c.name-		value = c.value+		value = c.pizzaValue 	}-	w.Header().Set(name, value)+	w.Header().Set("Pizza", value) 	return safehttp.Result{} } +func (p setHeaderConfigInterceptor) Commit(w *safehttp.CommitResponseWriter, r *safehttp.IncomingRequest, resp safehttp.Response, cfg interface{}) safehttp.Result {+	value := "Fusili"+	if c, ok := cfg.(setHeaderConfig); ok {+		value = c.pastaValue+	}

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package cors_test++import (+	"testing"++	"github.com/google/go-cmp/cmp"+	"github.com/google/go-safeweb/safehttp"+	"github.com/google/go-safeweb/safehttp/plugins/cors"+	"github.com/google/go-safeweb/safehttp/safehttptest"+)++func TestRequest(t *testing.T) {+	tests := []struct {+		name             string+		req              *safehttp.IncomingRequest+		allowCredentials bool+		exposedHeaders   []string+		want             map[string][]string+	}{+		{+			name: "Basic GET",+			req: func() *safehttp.IncomingRequest {+				r := safehttptest.NewRequest(safehttp.MethodGet, "http://bar.com", nil)+				r.Header.Set("Origin", "https://foo.com")+				r.Header.Set("X-Cors", "1")+				r.Header.Set("Content-Type", "application/json")+				return r+			}(),+			want: map[string][]string{+				"Access-Control-Allow-Origin": {"https://foo.com"},+				"Vary":                        {"Origin"},+			},+		},+		{+			name: "Basic PUT",+			req: func() *safehttp.IncomingRequest {+				r := safehttptest.NewRequest(safehttp.MethodPut, "http://bar.com", nil)+				r.Header.Set("Origin", "https://foo.com")+				r.Header.Set("X-Cors", "1")+				r.Header.Set("Content-Type", "application/json")+				return r+			}(),+			want: map[string][]string{+				"Access-Control-Allow-Origin": {"https://foo.com"},+				"Vary":                        {"Origin"},+			},+		},+		{+			name: "Basic POST",+			req: func() *safehttp.IncomingRequest {+				r := safehttptest.NewRequest(safehttp.MethodPost, "http://bar.com", nil)+				r.Header.Set("Origin", "https://foo.com")+				r.Header.Set("X-Cors", "1")+				r.Header.Set("Content-Type", "application/json")+				return r+			}(),+			want: map[string][]string{+				"Access-Control-Allow-Origin": {"https://foo.com"},+				"Vary":                        {"Origin"},+			},+		},+		{+			name: "Basic HEAD",+			req: func() *safehttp.IncomingRequest {+				r := safehttptest.NewRequest(safehttp.MethodHead, "http://bar.com", nil)+				r.Header.Set("Origin", "https://foo.com")+				r.Header.Set("X-Cors", "1")+				r.Header.Set("Content-Type", "application/json")+				return r+			}(),+			want: map[string][]string{+				"Access-Control-Allow-Origin": {"https://foo.com"},+				"Vary":                        {"Origin"},+			},+		},+		{+			name: "No Origin header",+			req: func() *safehttp.IncomingRequest {+				r := safehttptest.NewRequest(safehttp.MethodPut, "http://bar.com", nil)+				r.Header.Set("X-Cors", "1")+				r.Header.Set("Content-Type", "application/json")+				return r+			}(),+			want: map[string][]string{},+		},+		{+			name: "AllowCredentials but no cookies",+			req: func() *safehttp.IncomingRequest {+				r := safehttptest.NewRequest(safehttp.MethodPut, "http://bar.com", nil)+				r.Header.Set("Origin", "https://foo.com")+				r.Header.Set("X-Cors", "1")+				r.Header.Set("Content-Type", "application/json")+				return r+			}(),+			allowCredentials: true,+			want: map[string][]string{+				"Access-Control-Allow-Origin": {"https://foo.com"},+				"Vary":                        {"Origin"},+			},+		},+		{+			name: "AllowCredentials with cookies",+			req: func() *safehttp.IncomingRequest {+				r := safehttptest.NewRequest(safehttp.MethodPut, "http://bar.com", nil)+				r.Header.Set("Origin", "https://foo.com")+				r.Header.Set("X-Cors", "1")+				r.Header.Set("Content-Type", "application/json")+				r.Header.Set("Cookie", "a=b")+				return r+			}(),+			allowCredentials: true,+			want: map[string][]string{+				"Access-Control-Allow-Credentials": {"true"},+				"Access-Control-Allow-Origin":      {"https://foo.com"},+				"Vary":                             {"Origin"},+			},+		},+		{+			name: "Expose one header",+			req: func() *safehttp.IncomingRequest {+				r := safehttptest.NewRequest(safehttp.MethodPut, "http://bar.com", nil)+				r.Header.Set("Origin", "https://foo.com")+				r.Header.Set("X-Cors", "1")+				r.Header.Set("Content-Type", "application/json")+				return r+			}(),+			exposedHeaders: []string{"Aaaa"},+			want: map[string][]string{+				"Access-Control-Expose-Headers": {"Aaaa"},+				"Access-Control-Allow-Origin":   {"https://foo.com"},+				"Vary":                          {"Origin"},+			},+		},+		{+			name: "Expose multiple headers",+			req: func() *safehttp.IncomingRequest {+				r := safehttptest.NewRequest(safehttp.MethodPut, "http://bar.com", nil)+				r.Header.Set("Origin", "https://foo.com")+				r.Header.Set("X-Cors", "1")+				r.Header.Set("Content-Type", "application/json")+				return r+			}(),+			exposedHeaders: []string{"Aaaa", "Bbbb", "Cccc"},+			want: map[string][]string{+				"Access-Control-Expose-Headers": {"Aaaa, Bbbb, Cccc"},+				"Access-Control-Allow-Origin":   {"https://foo.com"},+				"Vary":                          {"Origin"},+			},+		},+	}++	for _, tt := range tests {+		t.Run(tt.name, func(t *testing.T) {+			rr := safehttptest.NewResponseRecorder()++			it := cors.Default("https://foo.com")+			it.AllowCredentials = tt.allowCredentials+			it.ExposedHeaders = tt.exposedHeaders+			it.Before(rr.ResponseWriter, tt.req)+

 func TestMuxInterceptors(t *testing.T) { }  type setHeaderConfig struct {-	name  string-	value string

 func NewServeMux(d Dispatcher, domains ...string) *ServeMux { 	} } -type appliedInterceptor struct {+// AppliedInterceptor TODO+type AppliedInterceptor struct {

 type ResponseWriter struct {  	// Having this field unexported is essential for security. Otherwise one can 	// easily overwrite the struct bypassing all our safety guarantees.-	header  Header-	written bool+	header           Header+	appliedInterceps []AppliedInterceptor+	req              *IncomingRequest

 func NotWritten() Result { 	return Result{} } -// Write TODO+// Write dispatches the response to the Dispatcher, setting the Content-Type to+// text/html; charset=utf-8 and response status to 200 OK if resp is a safe+// response. The Dispatcher will then write the response to the underlying+// Response Writer.+//+// TODO: replace panics with proper error handling when getting the response+// Content-Type or writing the response fails. func (w *ResponseWriter) Write(resp Response) Result {-	w.markWritten()+	ct, err := w.d.ContentType(resp)+	if err != nil {+		panic(err)+	}+	w.rw.WriteHeader(int(StatusOK))+	w.rw.Header().Set("Content-Type", ct)

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package cors++import (+	"net/textproto"+	"strconv"+	"strings"++	"github.com/google/go-safeweb/safehttp"+)++const customHeader string = "X-Cors"++var disallowedMethods = map[string]bool{+	safehttp.MethodHead: true,+	safehttp.MethodGet:  true,+	safehttp.MethodPost: true,+}++var disallowedContentTypes = map[string]bool{+	"application/x-www-form-urlencoded": true,+	"multipart/form-data":               true,+	"text/plain":                        true,+}++// Interceptor handles CORS requests based on its settings.+//+// For more info about CORS, see: https://developer.mozilla.org/en-US/docs/Web/HTTP/CORS+//+// Constraints+//+// - The request methods GET, HEAD and POST are banned and will result in a 405+//   Method Not Allowed response.+// - The content types "application/x-www-form-urlencoded", "multipart/form-data"+//   and "text/plain" are also banned and will result in a  415 Unsupported Media+//   Type response.+// - Each CORS request must contain the header "X-Cors: 1" or "Sec-Fetch-Mode: cors".+// All of this is to prevent XSRF.+type Interceptor struct {+	// AllowedOrigins determines which origins should be allowed in the+	// Access-Control-Allow-Origin header.+	AllowedOrigins map[string]bool+	allowedHeaders map[string]bool+	// ExposedHeaders determines which headers should be set in the+	// Access-Control-Expose-Headers header. If ExposedHeaders is nil, then the+	// header is not set.+	ExposedHeaders []string+	// AllowCredentials determines if Access-Control-Allow-Credentials should be+	// set to true when requests containing Cookie headers arrive.+	AllowCredentials bool+	// MaxAge sets the Access-Control-Max-Age header.+	// MaxAge=0 results in MaxAge: 5.+	MaxAge int+}++// Default creates a CORS Interceptor with default settings.+// Those defaults are:+//   - No Exposed Headers+//   - No Allowed Headers+//   - AllowCredentials: false+//   - MaxAge: 5 seconds+func Default(allowedOrigins ...string) *Interceptor {+	ao := map[string]bool{}+	for _, o := range allowedOrigins {+		ao[o] = true+	}+	return &Interceptor{+		AllowedOrigins: ao,+		allowedHeaders: map[string]bool{},+	}+}++// SetAllowedHeaders sets which headers should be allowed in the Access-Control-Allow-Headers+// header. The headers are first canonicalized using textproto.CanonicalMIMEHeaderKey.+func (it *Interceptor) SetAllowedHeaders(headers ...string) {+	it.allowedHeaders = map[string]bool{}+	for _, h := range headers {+		it.allowedHeaders[textproto.CanonicalMIMEHeaderKey(h)] = true+	}+}++// Before handles the incoming request and sets headers or responds with an error+// accordingly.+func (it *Interceptor) Before(w safehttp.ResponseWriter, r *safehttp.IncomingRequest) safehttp.Result {+	origin := r.Header.Get("Origin")+	if !it.AllowedOrigins[origin] {+		return w.ClientError(safehttp.StatusForbidden)+	}+	h := w.Header()+	allowOrigin, err := h.Claim("Access-Control-Allow-Origin")+	if err != nil {+		return w.ServerError(safehttp.StatusInternalServerError)+	}+	vary, err := h.Claim("Vary")

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package safehttp_test++import (+	"github.com/google/go-safeweb/safehttp"+	"github.com/google/safehtml"+	safetemplate "github.com/google/safehtml/template"+	"html/template"+	"math"+	"net/http"+	"strings"+	"testing"+)++func TestDefaultDispatcherValidResponse(t *testing.T) {+	tests := []struct {+		name        string+		write       func(w http.ResponseWriter) error+		wantStatus  safehttp.StatusCode+		wantHeaders map[string][]string+		wantBody    string+	}{+		{+			name: "Safe HTML Response",+			write: func(w http.ResponseWriter) error {+				d := &safehttp.DefaultDispatcher{}+				return d.Write(w, safehtml.HTMLEscaped("<h1>Hello World!</h1>"))+			},+			wantBody: "&lt;h1&gt;Hello World!&lt;/h1&gt;",+		},+		{+			name: "Safe HTML Template Response",+			write: func(w http.ResponseWriter) error {+				d := &safehttp.DefaultDispatcher{}+				return d.ExecuteTemplate(w, safetemplate.Must(safetemplate.New("name").Parse("<h1>{{ . }}</h1>")), "This is an actual heading, though.")+			},+			wantBody: "<h1>This is an actual heading, though.</h1>",+		},+		{+			name: "Valid JSON Response",+			write: func(w http.ResponseWriter) error {+				d := &safehttp.DefaultDispatcher{}+				data := struct {+					Field string `json:"field"`+				}{Field: "myField"}+				return d.WriteJSON(w, safehttp.JSONResponse{Data: data})+			},+			wantBody: `{"field":"myField"}`,+		},+	}+	for _, tt := range tests {+		t.Run(tt.name, func(t *testing.T) {+			b := &strings.Builder{}+			rw := newResponseRecorder(b)++			err := tt.write(rw)++			if err != nil {+				t.Errorf("tt.write(rw): got error %v, want nil", err)+			}++			if gotBody := b.String(); tt.wantBody != gotBody {+				t.Errorf("response body: got %q, want %q", gotBody, tt.wantBody)+			}+		})+	}+}++func TestDefaultDispatcherInvalidResponse(t *testing.T) {+	tests := []struct {+		name  string+		write func(w http.ResponseWriter) error+	}{+		{+			name: "Unsafe HTML Response",+			write: func(w http.ResponseWriter) error {+				d := &safehttp.DefaultDispatcher{}+				return d.Write(w, "<h1>Hello World!</h1>")+			},+		},+

 func TestResponseWriterWriteTwicePanic(t *testing.T) { 				w.Write(safehtml.HTMLEscaped("<h1>Escaped, so not really a heading</h1>")) 			}, 		},+		{+			name: "Call WriteJSON twice",+			write: func(w *safehttp.ResponseWriter) {+				data := struct{ Field string }{Field: "myField"}+				jsonObj, err := json.Marshal(data)+				if err != nil {+					t.Fatalf("invalid json object")+				}+				w.WriteJSON(jsonObj)+				w.WriteJSON(jsonObj)+			},

 func (w *ResponseWriter) Interceptor(key string) Interceptor { }  // Result TODO-type Result struct{}+type Result struct {+	err error+}

 func NotWritten() Result { 	return Result{} } -// Write TODO+// Write dispatches the response to the Dispatcher, setting the Content-Type to+// text/html; charset=utf-8 and response status to 200 OK if resp is a safe+// response. The Dispatcher will then write the response to the underlying+// Response Writer.+//+// TODO: replace panics with proper error handling when getting the response+// Content-Type or writing the response fails. func (w *ResponseWriter) Write(resp Response) Result {-	w.markWritten()+	ct, err := w.d.ContentType(resp)+	if err != nil {+		panic(err)+	}+	w.rw.WriteHeader(int(StatusOK))+	w.rw.Header().Set("Content-Type", ct)

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package safehttp++import (+	"encoding/json"+	"errors"+	"github.com/google/safehtml"+	"github.com/google/safehtml/template"+	"net/http"+)++// DefaultDispatcher is responsible of writing the body of a response to an+// Response Writer if it's of a safe type.+type DefaultDispatcher struct{}++// ContentType returns the Content-Type of a safe respons if it's of a safe-type+// and a non-nil error otherwise.

 func TestMuxHandlerReturnsNotWritten(t *testing.T) { 		t.Errorf(`response body got: %q want: ""`, got) 	} }++func TestMuxNilDispatcher(t *testing.T) {+	defer func() {+		if r := recover(); r == nil {+			t.Errorf(`mux.NewServeMux(nil): expected panic`)+		}+	}()+	_ = safehttp.NewServeMux(nil)

+// Copyright 2020 Google LLC+//+// Licensed under the Apache License, Version 2.0 (the "License");+// you may not use this file except in compliance with the License.+// You may obtain a copy of the License at+//+// 	https://www.apache.org/licenses/LICENSE-2.0+//+// Unless required by applicable law or agreed to in writing, software+// distributed under the License is distributed on an "AS IS" BASIS,+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.+// See the License for the specific language governing permissions and+// limitations under the License.++package safehttp++import (+	"encoding/json"+	"errors"+	"github.com/google/safehtml"+	"github.com/google/safehtml/template"+	"net/http"+)++// DefaultDispatcher is responsible of writing the body of a response to an+// Response Writer if it's of a safe type.+type DefaultDispatcher struct{}++// ContentType returns the Content-Type of a safe respons if it's of a safe-type