private static function enumerateNonHttps(
        Header $header,
        $directive,
        $sources
    ) {
        Types::assert(['string' => [$directive, $sources]], [2, 3]);

        if (preg_match_all('/(?:[ ]|^)\Khttp[:][^ ]*/', $sources, $matches))
        {
            $friendlyHeader = $header->getFriendlyName();

            return new Error(
                $friendlyHeader . ' contains the insecure protocol
                    HTTP in ' . (count($matches[0]) > 1 ?
                    'the following source values '
                    : 'a source value ')
                . '<b>' . implode(', ', $matches[0]) . '</b>; this can
                    allow anyone to insert elements covered by the
                    <b>' . $directive . '</b> directive into the page.',

                E_USER_WARNING
            );
        }

        return null;
    }