|
Lines 40-46
my $csp = Koha::ContentSecurityPolicy->new;
Link Here
|
| 40 |
|
40 |
|
| 41 |
subtest 'add() tests' => sub { |
41 |
subtest 'add() tests' => sub { |
| 42 |
|
42 |
|
| 43 |
plan tests => 16; |
43 |
plan tests => 24; |
| 44 |
|
44 |
|
| 45 |
$schema->storage->txn_begin; |
45 |
$schema->storage->txn_begin; |
| 46 |
|
46 |
|
|
Lines 56-62
subtest 'add() tests' => sub {
Link Here
|
| 56 |
'blocked-uri' => 'inline', |
56 |
'blocked-uri' => 'inline', |
| 57 |
'line-number' => 42, |
57 |
'line-number' => 42, |
| 58 |
'column-number' => 10, |
58 |
'column-number' => 10, |
| 59 |
'source-file' => 'https://library.example.org/cgi-bin/koha/opac-main.pl', |
59 |
'source-file' => 'https://library.example.org/cgi-bin/koah/opac-main.pl', |
| 60 |
'status-code' => 200, |
60 |
'status-code' => 200, |
| 61 |
} |
61 |
} |
| 62 |
}; |
62 |
}; |
|
Lines 88-93
subtest 'add() tests' => sub {
Link Here
|
| 88 |
->status_is( 400, 'CSP report denied (400)' ) |
88 |
->status_is( 400, 'CSP report denied (400)' ) |
| 89 |
->json_is( '/error', 'This token has expired.', '...because of an expired token' ); |
89 |
->json_is( '/error', 'This token has expired.', '...because of an expired token' ); |
| 90 |
|
90 |
|
|
|
91 |
$csp_report->{'csp-report'}->{'line-number'} = 99999999999999999; |
| 92 |
|
| 93 |
# Too large integers should be rejected |
| 94 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 95 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 96 |
->status_is( 400, 'CSP report rejected (400) because of line-number exceeding maximum value' ); |
| 97 |
|
| 98 |
$csp_report->{'csp-report'}->{'line-number'} = -1; |
| 99 |
|
| 100 |
# Too small integers should be rejected |
| 101 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 102 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 103 |
->status_is( 400, 'CSP report rejected (400) because of line-number not reaching minimum value' ); |
| 104 |
$csp_report->{'csp-report'}->{'line-number'} = 42; |
| 105 |
|
| 106 |
$csp_report->{'csp-report'}->{'disposition'} = 'this is not okay'; |
| 107 |
|
| 108 |
# Enum values should be confirmed |
| 109 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 110 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 111 |
->status_is( 400, 'CSP report rejected (400) because of disposition is not either "enforce" nor "report"' ); |
| 112 |
$csp_report->{'csp-report'}->{'disposition'} = 'enforce'; |
| 113 |
|
| 114 |
$csp_report->{'csp-report'}->{'script-sample'} = |
| 115 |
'this is way too long script sample. a maximum of only 40 characters is allowed'; |
| 116 |
|
| 117 |
# Too long strings should be rejected |
| 118 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 119 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 120 |
->status_is( 400, 'CSP report rejected (400) because of script-sample exceeding maximum length' ); |
| 121 |
$csp_report->{'csp-report'}->{'script-sample'} = 'console.log("hi");'; |
| 122 |
|
| 91 |
# Anonymous request should work (browsers send these without auth) |
123 |
# Anonymous request should work (browsers send these without auth) |
| 92 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
124 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 93 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
125 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 94 |
- |
|
|