View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/api/v1/swagger/definitions/csp_report.yaml (+17 lines)
Lines 11-47 properties: Link Here
11
      document-uri:
11
      document-uri:
12
        type: string
12
        type: string
13
        description: The URI of the document where the violation occurred
13
        description: The URI of the document where the violation occurred
14
        maxLength: 200
14
      referrer:
15
      referrer:
15
        type: string
16
        type: string
16
        description: The referrer of the document where the violation occurred
17
        description: The referrer of the document where the violation occurred
18
        maxLength: 200
17
      violated-directive:
19
      violated-directive:
18
        type: string
20
        type: string
19
        description: The directive that was violated (e.g., "script-src 'self'")
21
        description: The directive that was violated (e.g., "script-src 'self'")
22
        maxLength: 100
20
      effective-directive:
23
      effective-directive:
21
        type: string
24
        type: string
22
        description: The effective directive that was violated
25
        description: The effective directive that was violated
26
        maxLength: 100
23
      original-policy:
27
      original-policy:
24
        type: string
28
        type: string
25
        description: The original CSP policy as specified in the header
29
        description: The original CSP policy as specified in the header
30
        maxLength: 400
26
      disposition:
31
      disposition:
27
        type: string
32
        type: string
28
        description: Either "enforce" or "report" depending on CSP mode
33
        description: Either "enforce" or "report" depending on CSP mode
34
        enum:
35
          - enforce
36
          - report
29
      blocked-uri:
37
      blocked-uri:
30
        type: string
38
        type: string
31
        description: The URI of the resource that was blocked
39
        description: The URI of the resource that was blocked
40
        maxLength: 200
32
      line-number:
41
      line-number:
33
        type: integer
42
        type: integer
34
        description: Line number in the document where the violation occurred
43
        description: Line number in the document where the violation occurred
44
        minimum: 0
45
        maximum: 999999
35
      column-number:
46
      column-number:
36
        type: integer
47
        type: integer
37
        description: Column number where the violation occurred
48
        description: Column number where the violation occurred
49
        minimum: 0
50
        maximum: 999999
38
      source-file:
51
      source-file:
39
        type: string
52
        type: string
40
        description: The URI of the script where the violation occurred
53
        description: The URI of the script where the violation occurred
54
        maxLength: 200
41
      status-code:
55
      status-code:
42
        type: integer
56
        type: integer
43
        description: HTTP status code of the document
57
        description: HTTP status code of the document
58
        minimum: 0
59
        maximum: 999
44
      script-sample:
60
      script-sample:
45
        type: string
61
        type: string
46
        description: First 40 characters of the inline script that caused the violation
62
        description: First 40 characters of the inline script that caused the violation
63
        maxLength: 41
47
additionalProperties: true
64
additionalProperties: true
(-)a/t/db_dependent/api/v1/public/csp_reports.t (-3 / +34 lines)
Lines 40-46 my $csp = Koha::ContentSecurityPolicy->new; Link Here
40
40
41
subtest 'add() tests' => sub {
41
subtest 'add() tests' => sub {
42
42
43
    plan tests => 16;
43
    plan tests => 24;
44
44
45
    $schema->storage->txn_begin;
45
    $schema->storage->txn_begin;
46
46
Lines 56-62 subtest 'add() tests' => sub { Link Here
56
            'blocked-uri'         => 'inline',
56
            'blocked-uri'         => 'inline',
57
            'line-number'         => 42,
57
            'line-number'         => 42,
58
            'column-number'       => 10,
58
            'column-number'       => 10,
59
            'source-file'         => 'https://library.example.org/cgi-bin/koha/opac-main.pl',
59
            'source-file'         => 'https://library.example.org/cgi-bin/koah/opac-main.pl',
60
            'status-code'         => 200,
60
            'status-code'         => 200,
61
        }
61
        }
62
    };
62
    };
Lines 88-93 subtest 'add() tests' => sub { Link Here
88
        ->status_is( 400, 'CSP report denied (400)' )
88
        ->status_is( 400, 'CSP report denied (400)' )
89
        ->json_is( '/error', 'This token has expired.', '...because of an expired token' );
89
        ->json_is( '/error', 'This token has expired.', '...because of an expired token' );
90
90
91
    $csp_report->{'csp-report'}->{'line-number'} = 99999999999999999;
92
93
    # Too large integers should be rejected
94
    $t->post_ok( '/api/v1/public/csp-reports?token='
95
            . $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
96
        ->status_is( 400, 'CSP report rejected (400) because of line-number exceeding maximum value' );
97
98
    $csp_report->{'csp-report'}->{'line-number'} = -1;
99
100
    # Too small integers should be rejected
101
    $t->post_ok( '/api/v1/public/csp-reports?token='
102
            . $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
103
        ->status_is( 400, 'CSP report rejected (400) because of line-number not reaching minimum value' );
104
    $csp_report->{'csp-report'}->{'line-number'} = 42;
105
106
    $csp_report->{'csp-report'}->{'disposition'} = 'this is not okay';
107
108
    # Enum values should be confirmed
109
    $t->post_ok( '/api/v1/public/csp-reports?token='
110
            . $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
111
        ->status_is( 400, 'CSP report rejected (400) because of disposition is not either "enforce" nor "report"' );
112
    $csp_report->{'csp-report'}->{'disposition'} = 'enforce';
113
114
    $csp_report->{'csp-report'}->{'script-sample'} =
115
        'this is way too long script sample. a maximum of only 40 characters is allowed';
116
117
    # Too long strings should be rejected
118
    $t->post_ok( '/api/v1/public/csp-reports?token='
119
            . $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
120
        ->status_is( 400, 'CSP report rejected (400) because of script-sample exceeding maximum length' );
121
    $csp_report->{'csp-report'}->{'script-sample'} = 'console.log("hi");';
122
91
    # Anonymous request should work (browsers send these without auth)
123
    # Anonymous request should work (browsers send these without auth)
92
    $t->post_ok( '/api/v1/public/csp-reports?token='
124
    $t->post_ok( '/api/v1/public/csp-reports?token='
93
            . $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
125
            . $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
94
- 

Return to bug 38365