|
Lines 40-46
my $csp = Koha::ContentSecurityPolicy->new;
Link Here
|
| 40 |
|
40 |
|
| 41 |
subtest 'add() tests' => sub { |
41 |
subtest 'add() tests' => sub { |
| 42 |
|
42 |
|
| 43 |
plan tests => 16; |
43 |
plan tests => 22; |
| 44 |
|
44 |
|
| 45 |
$schema->storage->txn_begin; |
45 |
$schema->storage->txn_begin; |
| 46 |
|
46 |
|
|
Lines 88-93
subtest 'add() tests' => sub {
Link Here
|
| 88 |
->status_is( 400, 'CSP report denied (400)' ) |
88 |
->status_is( 400, 'CSP report denied (400)' ) |
| 89 |
->json_is( '/error', 'This token has expired.', '...because of an expired token' ); |
89 |
->json_is( '/error', 'This token has expired.', '...because of an expired token' ); |
| 90 |
|
90 |
|
|
|
91 |
$csp_report->{'csp-report'}->{'line-number'} = 99999999999999999; |
| 92 |
|
| 93 |
# Anonymous request should reject too long integers |
| 94 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 95 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 96 |
->status_is( 400, 'CSP report rejected (400) because of line-number exceeding maximum value' ); |
| 97 |
$csp_report->{'csp-report'}->{'line-number'} = 42; |
| 98 |
|
| 99 |
$csp_report->{'csp-report'}->{'disposition'} = 'this is not okay'; |
| 100 |
|
| 101 |
# Anonymous request should reject values not in enum |
| 102 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 103 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 104 |
->status_is( 400, 'CSP report rejected (400) because of disposition is not either "enforce" nor "report"' ); |
| 105 |
$csp_report->{'csp-report'}->{'disposition'} = 'enforce'; |
| 106 |
|
| 107 |
$csp_report->{'csp-report'}->{'script-sample'} = |
| 108 |
'this is way too long script sample. a maximum of only 40 characters is allowed'; |
| 109 |
|
| 110 |
# Anonymous request should reject too long strings |
| 111 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 112 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 113 |
->status_is( 400, 'CSP report rejected (400) because of script-sample exceeding maximum length' ); |
| 114 |
$csp_report->{'csp-report'}->{'script-sample'} = 'console.log("hi");'; |
| 115 |
|
| 91 |
# Anonymous request should work (browsers send these without auth) |
116 |
# Anonymous request should work (browsers send these without auth) |
| 92 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
117 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 93 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
118 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 94 |
- |
|
|