|
Lines 37-43
my $conf_csp_section = 'content_security_policy';
Link Here
|
| 37 |
subtest 'test CSP in OPAC' => sub { |
37 |
subtest 'test CSP in OPAC' => sub { |
| 38 |
plan tests => 5; |
38 |
plan tests => 5; |
| 39 |
|
39 |
|
| 40 |
my $test_nonce = 'TEST_NONCE'; |
|
|
| 41 |
my $csp_header_value = |
40 |
my $csp_header_value = |
| 42 |
"default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; |
41 |
"default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; |
| 43 |
|
42 |
|
|
Lines 47-55
subtest 'test CSP in OPAC' => sub {
Link Here
|
| 47 |
{ opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } |
46 |
{ opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } |
| 48 |
); |
47 |
); |
| 49 |
|
48 |
|
| 50 |
# Set nonce |
|
|
| 51 |
Koha::ContentSecurityPolicy->new->nonce($test_nonce); |
| 52 |
|
| 53 |
my $env = {}; |
49 |
my $env = {}; |
| 54 |
my $home = $ENV{KOHA_HOME}; |
50 |
my $home = $ENV{KOHA_HOME}; |
| 55 |
my $app = Plack::App::CGIBin->new( root => $ENV{GIT_INSTALL} ? "$home/opac" : "$home/opac/cgi-bin/opac" )->to_app; |
51 |
my $app = Plack::App::CGIBin->new( root => $ENV{GIT_INSTALL} ? "$home/opac" : "$home/opac/cgi-bin/opac" )->to_app; |
|
Lines 63-68
subtest 'test CSP in OPAC' => sub {
Link Here
|
| 63 |
|
59 |
|
| 64 |
my $test = Plack::Test->create($app); |
60 |
my $test = Plack::Test->create($app); |
| 65 |
my $res = $test->request( GET "/opac/opac-main.pl" ); |
61 |
my $res = $test->request( GET "/opac/opac-main.pl" ); |
|
|
62 |
my $test_nonce = Koha::ContentSecurityPolicy->new->get_nonce(); |
| 66 |
my $expected_csp_header_value = $csp_header_value; |
63 |
my $expected_csp_header_value = $csp_header_value; |
| 67 |
$expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; |
64 |
$expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; |
| 68 |
is( |
65 |
is( |
|
Lines 100-106
subtest 'test CSP in OPAC' => sub {
Link Here
|
| 100 |
subtest 'test CSP in staff client' => sub { |
97 |
subtest 'test CSP in staff client' => sub { |
| 101 |
plan tests => 5; |
98 |
plan tests => 5; |
| 102 |
|
99 |
|
| 103 |
my $test_nonce = 'TEST_NONCE'; |
|
|
| 104 |
my $csp_header_value = |
100 |
my $csp_header_value = |
| 105 |
"default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; |
101 |
"default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; |
| 106 |
|
102 |
|
|
Lines 109-117
subtest 'test CSP in staff client' => sub {
Link Here
|
| 109 |
{ opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } |
105 |
{ opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } |
| 110 |
); |
106 |
); |
| 111 |
|
107 |
|
| 112 |
# Set nonce |
|
|
| 113 |
Koha::ContentSecurityPolicy->new->nonce($test_nonce); |
| 114 |
|
| 115 |
my $env = {}; |
108 |
my $env = {}; |
| 116 |
my $home = $ENV{KOHA_HOME}; |
109 |
my $home = $ENV{KOHA_HOME}; |
| 117 |
my $app = Plack::App::CGIBin->new( root => $ENV{GIT_INSTALL} ? $home : "$home/intranet/cgi-bin/" )->to_app; |
110 |
my $app = Plack::App::CGIBin->new( root => $ENV{GIT_INSTALL} ? $home : "$home/intranet/cgi-bin/" )->to_app; |
|
Lines 125-130
subtest 'test CSP in staff client' => sub {
Link Here
|
| 125 |
|
118 |
|
| 126 |
my $test = Plack::Test->create($app); |
119 |
my $test = Plack::Test->create($app); |
| 127 |
my $res = $test->request( GET "/intranet/mainpage.pl" ); |
120 |
my $res = $test->request( GET "/intranet/mainpage.pl" ); |
|
|
121 |
my $test_nonce = Koha::ContentSecurityPolicy->new->get_nonce(); |
| 128 |
my $expected_csp_header_value = $csp_header_value; |
122 |
my $expected_csp_header_value = $csp_header_value; |
| 129 |
$expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; |
123 |
$expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; |
| 130 |
is( |
124 |
is( |
|
Lines 154-160
subtest 'test CSP in staff client' => sub {
Link Here
|
| 154 |
{ intranet => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } |
148 |
{ intranet => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } |
| 155 |
); |
149 |
); |
| 156 |
|
150 |
|
| 157 |
$res = $test->request( GET "/intranet/mainpage.pl" ); |
151 |
$res = $test->request( GET "/intranet/mainpage.pl" ); |
|
|
152 |
$test_nonce = Koha::ContentSecurityPolicy->new->get_nonce(); |
| 153 |
$expected_csp_header_value = $csp_header_value; |
| 154 |
$expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; |
| 158 |
is( |
155 |
is( |
| 159 |
$res->header('content-security-policy'), $expected_csp_header_value, |
156 |
$res->header('content-security-policy'), $expected_csp_header_value, |
| 160 |
"Response contains Content-Security-Policy header when it is enabled in koha-conf.xml" |
157 |
"Response contains Content-Security-Policy header when it is enabled in koha-conf.xml" |