|
Lines 37-43
t::lib::Mocks::mock_config( 'api_secret_passphrase', 'test' );
Link Here
|
| 37 |
|
37 |
|
| 38 |
subtest 'add() tests' => sub { |
38 |
subtest 'add() tests' => sub { |
| 39 |
|
39 |
|
| 40 |
plan tests => 13; |
40 |
plan tests => 19; |
| 41 |
|
41 |
|
| 42 |
$schema->storage->txn_begin; |
42 |
$schema->storage->txn_begin; |
| 43 |
|
43 |
|
|
Lines 68-73
subtest 'add() tests' => sub {
Link Here
|
| 68 |
$csp_report )->status_is( 401, 'CSP report denied (401)' ) |
68 |
$csp_report )->status_is( 401, 'CSP report denied (401)' ) |
| 69 |
->json_is( '/error', 'Invalid token.', '...because of an invalid token' ); |
69 |
->json_is( '/error', 'Invalid token.', '...because of an invalid token' ); |
| 70 |
|
70 |
|
|
|
71 |
$csp_report->{'csp-report'}->{'line-number'} = 99999999999999999; |
| 72 |
|
| 73 |
# Anonymous request should reject too long integers |
| 74 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 75 |
. csp_token() => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 76 |
->status_is( 400, 'CSP report rejected (400) because of line-number exceeding maximum value' ); |
| 77 |
$csp_report->{'csp-report'}->{'line-number'} = 42; |
| 78 |
|
| 79 |
$csp_report->{'csp-report'}->{'disposition'} = 'this is not okay'; |
| 80 |
|
| 81 |
# Anonymous request should reject values not in enum |
| 82 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 83 |
. csp_token() => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 84 |
->status_is( 400, 'CSP report rejected (400) because of disposition is not either "enforce" nor "report"' ); |
| 85 |
$csp_report->{'csp-report'}->{'disposition'} = 'enforce'; |
| 86 |
|
| 87 |
$csp_report->{'csp-report'}->{'script-sample'} = |
| 88 |
'this is way too long script sample. a maximum of only 40 characters is allowed'; |
| 89 |
|
| 90 |
# Anonymous request should reject too long strings |
| 91 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 92 |
. csp_token() => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 93 |
->status_is( 400, 'CSP report rejected (400) because of script-sample exceeding maximum length' ); |
| 94 |
$csp_report->{'csp-report'}->{'script-sample'} = 'console.log("hi");'; |
| 95 |
|
| 71 |
# Anonymous request should work (browsers send these without auth) |
96 |
# Anonymous request should work (browsers send these without auth) |
| 72 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
97 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 73 |
. csp_token() => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
98 |
. csp_token() => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 74 |
- |
|
|