Content-Security-Policy getDefaultDirectives should return a deep copy

[EvanHahn]

getDefaultDirectives returns a shallow copy:

helmet/middlewares/content-security-policy/index.ts

Line 71 in 6475da1

const getDefaultDirectives = () => ({ ...DEFAULT_DIRECTIVES });

Someone could mutate this object and cause chaos. We should:

1. Update this function to do a simple deep clone. I wouldn't pull in a library for this; I would update this function to return a copy.
2. Add a test to ensure that each call gives a separate copy. Try mutating one and verify that the change doesn't appear if you call getDefaultDirectives again.

This is technically a breaking change so it should be made against the v8.0.0 branch.

[sohrb]

Two things to note:

• I do not see how the original code allowed for unsafe mutation since the spread operator is returning a copy (all be it a shallow one).
• the structuredClone API provided by Node does perform a deep copy but doesn't copy functions. Is that a deal breaker?

[EvanHahn]

You could cause a problem if you mutate one of the arrays. For example:

const one = getDefaultDirectives();
one["script-src"].push("https://garbage.example");

const two = getDefaultDirectives();
console.log(two["script-src"]);
// => ["'self'", "https://garbage.example"]

[EvanHahn]

Done in d9319b8/#465.