View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/api/v1/swagger/definitions/csp_report.yaml (+17 lines)
Lines 11-47 properties: Link Here
11
      document-uri:
11
      document-uri:
12
        type: string
12
        type: string
13
        description: The URI of the document where the violation occurred
13
        description: The URI of the document where the violation occurred
14
        maxLength: 200
14
      referrer:
15
      referrer:
15
        type: string
16
        type: string
16
        description: The referrer of the document where the violation occurred
17
        description: The referrer of the document where the violation occurred
18
        maxLength: 200
17
      violated-directive:
19
      violated-directive:
18
        type: string
20
        type: string
19
        description: The directive that was violated (e.g., "script-src 'self'")
21
        description: The directive that was violated (e.g., "script-src 'self'")
22
        maxLength: 100
20
      effective-directive:
23
      effective-directive:
21
        type: string
24
        type: string
22
        description: The effective directive that was violated
25
        description: The effective directive that was violated
26
        maxLength: 100
23
      original-policy:
27
      original-policy:
24
        type: string
28
        type: string
25
        description: The original CSP policy as specified in the header
29
        description: The original CSP policy as specified in the header
30
        maxLength: 400
26
      disposition:
31
      disposition:
27
        type: string
32
        type: string
28
        description: Either "enforce" or "report" depending on CSP mode
33
        description: Either "enforce" or "report" depending on CSP mode
34
        enum:
35
          - enforce
36
          - report
29
      blocked-uri:
37
      blocked-uri:
30
        type: string
38
        type: string
31
        description: The URI of the resource that was blocked
39
        description: The URI of the resource that was blocked
40
        maxLength: 200
32
      line-number:
41
      line-number:
33
        type: integer
42
        type: integer
34
        description: Line number in the document where the violation occurred
43
        description: Line number in the document where the violation occurred
44
        minimum: 0
45
        maximum: 999999
35
      column-number:
46
      column-number:
36
        type: integer
47
        type: integer
37
        description: Column number where the violation occurred
48
        description: Column number where the violation occurred
49
        minimum: 0
50
        maximum: 999999
38
      source-file:
51
      source-file:
39
        type: string
52
        type: string
40
        description: The URI of the script where the violation occurred
53
        description: The URI of the script where the violation occurred
54
        maxLength: 200
41
      status-code:
55
      status-code:
42
        type: integer
56
        type: integer
43
        description: HTTP status code of the document
57
        description: HTTP status code of the document
58
        minimum: 0
59
        maximum: 999
44
      script-sample:
60
      script-sample:
45
        type: string
61
        type: string
46
        description: First 40 characters of the inline script that caused the violation
62
        description: First 40 characters of the inline script that caused the violation
63
        maxLength: 41
47
additionalProperties: true
64
additionalProperties: true
(-)a/t/db_dependent/api/v1/public/csp_reports.t (-3 / +30 lines)
Lines 36-42 t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 ); Link Here
36
36
37
subtest 'add() tests' => sub {
37
subtest 'add() tests' => sub {
38
38
39
    plan tests => 7;
39
    plan tests => 15;
40
40
41
    $schema->storage->txn_begin;
41
    $schema->storage->txn_begin;
42
42
Lines 52-62 subtest 'add() tests' => sub { Link Here
52
            'blocked-uri'         => 'inline',
52
            'blocked-uri'         => 'inline',
53
            'line-number'         => 42,
53
            'line-number'         => 42,
54
            'column-number'       => 10,
54
            'column-number'       => 10,
55
            'source-file'         => 'https://library.example.org/cgi-bin/koha/opac-main.pl',
55
            'source-file'         => 'https://library.example.org/cgi-bin/koah/opac-main.pl',
56
            'status-code'         => 200,
56
            'status-code'         => 200,
57
        }
57
        }
58
    };
58
    };
59
59
60
    $csp_report->{'csp-report'}->{'line-number'} = 99999999999999999;
61
62
    # Too large integers should be rejected
63
    $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
64
        ->status_is( 400, 'CSP report rejected (400) because of line-number exceeding maximum value' );
65
66
    $csp_report->{'csp-report'}->{'line-number'} = -1;
67
68
    # Too small integers should be rejected
69
    $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
70
        ->status_is( 400, 'CSP report rejected (400) because of line-number not reaching minimum value' );
71
    $csp_report->{'csp-report'}->{'line-number'} = 42;
72
73
    $csp_report->{'csp-report'}->{'disposition'} = 'this is not okay';
74
75
    # Enum values should be confirmed
76
    $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
77
        ->status_is( 400, 'CSP report rejected (400) because of disposition is not either "enforce" nor "report"' );
78
    $csp_report->{'csp-report'}->{'disposition'} = 'enforce';
79
80
    $csp_report->{'csp-report'}->{'script-sample'} =
81
        'this is way too long script sample. a maximum of only 40 characters is allowed';
82
83
    # Too long strings should be rejected
84
    $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
85
        ->status_is( 400, 'CSP report rejected (400) because of script-sample exceeding maximum length' );
86
    $csp_report->{'csp-report'}->{'script-sample'} = 'console.log("hi");';
87
60
    # Anonymous request should work (browsers send these without auth)
88
    # Anonymous request should work (browsers send these without auth)
61
    $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
89
    $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report )
62
        ->status_is( 204, 'CSP report accepted' );
90
        ->status_is( 204, 'CSP report accepted' );
63
- 

Return to bug 38365