|
Lines 21-39
Link Here
|
| 21 |
use strict; |
21 |
use strict; |
| 22 |
use warnings; |
22 |
use warnings; |
| 23 |
use Test::NoWarnings; |
23 |
use Test::NoWarnings; |
| 24 |
use Test::More tests => 4; |
24 |
use Test::More tests => 5; |
| 25 |
|
25 |
|
| 26 |
use HTTP::Request::Common; |
26 |
use HTTP::Request::Common; |
| 27 |
use Plack::App::CGIBin; |
27 |
use Plack::App::CGIBin; |
| 28 |
use Plack::Builder; |
28 |
use Plack::Builder; |
| 29 |
use Plack::Test; |
29 |
use Plack::Test; |
| 30 |
|
30 |
|
|
|
31 |
use Koha::Database; |
| 32 |
|
| 31 |
use t::lib::Mocks; |
33 |
use t::lib::Mocks; |
| 32 |
|
34 |
|
| 33 |
use_ok("Koha::Middleware::ContentSecurityPolicy"); |
35 |
use_ok("Koha::Middleware::ContentSecurityPolicy"); |
| 34 |
|
36 |
|
| 35 |
my $conf_csp_section = 'content_security_policy'; |
37 |
my $conf_csp_section = 'content_security_policy'; |
| 36 |
|
38 |
|
|
|
39 |
my $schema = Koha::Database->schema; |
| 40 |
|
| 37 |
subtest 'test CSP in OPAC' => sub { |
41 |
subtest 'test CSP in OPAC' => sub { |
| 38 |
plan tests => 5; |
42 |
plan tests => 5; |
| 39 |
|
43 |
|
|
Lines 159-161
subtest 'test CSP in staff client' => sub {
Link Here
|
| 159 |
|
163 |
|
| 160 |
like( $res->content, qr/<body id="main_auth"/, 'mainpage.pl looks okay' ); |
164 |
like( $res->content, qr/<body id="main_auth"/, 'mainpage.pl looks okay' ); |
| 161 |
}; |
165 |
}; |
| 162 |
- |
166 |
|
|
|
167 |
subtest 'test Reporting-Endpoints for CSP violation reports' => sub { |
| 168 |
plan tests => 1; |
| 169 |
|
| 170 |
my $test_nonce = 'TEST_NONCE'; |
| 171 |
my $csp_header_value = |
| 172 |
"default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; |
| 173 |
|
| 174 |
t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' ); |
| 175 |
|
| 176 |
$schema->storage->txn_begin; |
| 177 |
|
| 178 |
t::lib::Mocks::mock_preference( 'OpacPublic', 1 ); |
| 179 |
t::lib::Mocks::mock_config( |
| 180 |
$conf_csp_section, |
| 181 |
{ opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } |
| 182 |
); |
| 183 |
|
| 184 |
# Set nonce |
| 185 |
Koha::ContentSecurityPolicy->new->set_nonce($test_nonce); |
| 186 |
|
| 187 |
my $env = {}; |
| 188 |
my $home = $ENV{KOHA_HOME}; |
| 189 |
my $app = Plack::App::CGIBin->new( root => $ENV{GIT_INSTALL} ? "$home/opac" : "$home/opac/cgi-bin/opac" )->to_app; |
| 190 |
|
| 191 |
$app = builder { |
| 192 |
mount '/opac' => builder { |
| 193 |
enable "+Koha::Middleware::ContentSecurityPolicy"; |
| 194 |
$app; |
| 195 |
}; |
| 196 |
}; |
| 197 |
|
| 198 |
my $test = Plack::Test->create($app); |
| 199 |
my $res = $test->request( GET "/opac/opac-main.pl" ); |
| 200 |
my $expected_csp_header_value = $csp_header_value; |
| 201 |
$expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; |
| 202 |
like( |
| 203 |
$res->header('reporting-endpoints'), qr/^csp-violations="\/api\/v1\/public\/csp-reports"$/, |
| 204 |
"Response contains Reporting-Endpoints header with the expected value" |
| 205 |
); |
| 206 |
|
| 207 |
$schema->storage->txn_rollback; |
| 208 |
}; |