|
Lines 236-242
subtest 'Content-Security-Policy tests' => sub {
Link Here
|
| 236 |
|
236 |
|
| 237 |
my $expected_csp_header = $modes->{$mode}; |
237 |
my $expected_csp_header = $modes->{$mode}; |
| 238 |
my $expected_csp_header_value = |
238 |
my $expected_csp_header_value = |
| 239 |
"default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'"; |
239 |
"default-src 'self'; script-src 'self' 'unsafe-eval' 'nonce-_CSP_NONCE_'; style-src 'self' 'unsafe-inline' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; |
| 240 |
t::lib::Mocks::mock_config( |
240 |
t::lib::Mocks::mock_config( |
| 241 |
'content_security_policy', |
241 |
'content_security_policy', |
| 242 |
{ $interface => { csp_mode => $mode, csp_header_value => $expected_csp_header_value } } |
242 |
{ $interface => { csp_mode => $mode, csp_header_value => $expected_csp_header_value } } |
|
Lines 291-297
subtest 'Content-Security-Policy tests' => sub {
Link Here
|
| 291 |
|
291 |
|
| 292 |
my $cache = Koha::Cache::Memory::Lite->get_instance; |
292 |
my $cache = Koha::Cache::Memory::Lite->get_instance; |
| 293 |
my $nonce = $cache->get_from_cache("csp_nonce"); |
293 |
my $nonce = $cache->get_from_cache("csp_nonce"); |
| 294 |
$expected_csp_header_value =~ s/_CSP_NONCE_/nonce-$nonce/g; |
294 |
$expected_csp_header_value =~ s/_CSP_NONCE_/$nonce/g; |
| 295 |
C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); |
295 |
C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); |
| 296 |
|
296 |
|
| 297 |
$stdout =~ /(Content-Security-Policy[A-Za-z\-]*): (.*)\r/im; |
297 |
$stdout =~ /(Content-Security-Policy[A-Za-z\-]*): (.*)\r/im; |
| 298 |
- |
|
|