View | Details | Raw Unified | Return to bug 38365
Collapse All | Expand All

(-)a/t/Koha/Middleware/ContentSecurityPolicy.t (-99 lines)
Lines 1-99 Link Here
1
#!/usr/bin/perl
2
3
#
4
# Copyright 2025 Hypernova Oy
5
#
6
# This file is part of Koha.
7
#
8
# Koha is free software; you can redistribute it and/or modify it
9
# under the terms of the GNU General Public License as published by
10
# the Free Software Foundation; either version 3 of the License, or
11
# (at your option) any later version.
12
#
13
# Koha is distributed in the hope that it will be useful, but
14
# WITHOUT ANY WARRANTY; without even the implied warranty of
15
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16
# GNU General Public License for more details.
17
#
18
# You should have received a copy of the GNU General Public License
19
# along with Koha; if not, see <https://www.gnu.org/licenses>.
20
21
use Modern::Perl;
22
use Test::NoWarnings;
23
use Test::More tests => 3;
24
use Test::Warn;
25
26
use File::Basename qw(dirname);
27
use HTTP::Request::Common;
28
use Plack::Builder;
29
use Plack::Util;
30
use Plack::Test;
31
32
use C4::Templates;
33
34
use t::lib::Mocks;
35
36
use_ok("Koha::Middleware::ContentSecurityPolicy");
37
38
my $conf_csp_section = 'content_security_policy';
39
40
subtest 'test Content-Security-Policy header' => sub {
41
    plan tests => 3;
42
43
    my $csp_header_value =
44
        "default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'";
45
46
    t::lib::Mocks::mock_config(
47
        $conf_csp_section,
48
        { opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } }
49
    );
50
51
    t::lib::Mocks::mock_config( 'opachtdocs', C4::Context->config('intranetdir') . '/t/mock_templates/opac-tmpl' );
52
53
    my $env = {};
54
    my $app = sub {
55
        require Koha::Plugins;    # this should probably be "use Koha::Plugins;" in C4::Templates instead
56
        my $template = C4::Templates::gettemplate( 'opac-csp.tt', 'opac' );
57
        my $resp     = [
58
            200,
59
            [
60
                'Content-Type',
61
                'text/plain',
62
                'Content-Length',
63
                12
64
            ],
65
            [ $template->output ]
66
        ];
67
        return $resp;
68
    };
69
70
    $app = builder {
71
        enable "+Koha::Middleware::ContentSecurityPolicy";
72
        $app;
73
    };
74
75
    my $test                      = Plack::Test->create($app);
76
    my $res                       = $test->request( GET "/" );
77
    my $test_nonce                = Koha::ContentSecurityPolicy->new->get_nonce();
78
    my $expected_csp_header_value = $csp_header_value;
79
    $expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g;
80
    is(
81
        $res->header('content-security-policy'), $expected_csp_header_value,
82
        "Response contains Content-Security-Policy header with the expected value"
83
    );
84
    is(
85
        $res->content, '<script nonce="' . $test_nonce . '">' . "\n" . '</script>' . "\n",
86
        "Response contains generated nonce in the body"
87
    );
88
89
    t::lib::Mocks::mock_config(
90
        $conf_csp_section,
91
        { opac => { csp_mode => '', csp_header_value => $csp_header_value } }
92
    );
93
94
    $res = $test->request( GET "/" );
95
    is(
96
        $res->header('content-security-policy'), undef,
97
        "Response does not contain Content-Security-Policy header when it is disabled in koha-conf.xml"
98
    );
99
};
(-)a/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t (-2 / +67 lines)
Lines 20-26 Link Here
20
20
21
use Modern::Perl;
21
use Modern::Perl;
22
use Test::NoWarnings;
22
use Test::NoWarnings;
23
use Test::More tests => 5;
23
use Test::More tests => 6;
24
24
25
use HTTP::Request::Common;
25
use HTTP::Request::Common;
26
use Plack::App::CGIBin;
26
use Plack::App::CGIBin;
Lines 37-42 my $conf_csp_section = 'content_security_policy'; Link Here
37
37
38
my $schema = Koha::Database->schema;
38
my $schema = Koha::Database->schema;
39
39
40
subtest 'test Content-Security-Policy header in a minimal environment' => sub {
41
    plan tests => 3;
42
43
    my $csp_header_value =
44
        "default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'";
45
46
    t::lib::Mocks::mock_config(
47
        $conf_csp_section,
48
        { opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } }
49
    );
50
51
    my $original_opachtdocs = C4::Context->config('opachtdocs');
52
    t::lib::Mocks::mock_config( 'opachtdocs', C4::Context->config('intranetdir') . '/t/mock_templates/opac-tmpl' );
53
54
    my $env = {};
55
    my $app = sub {
56
        require Koha::Plugins;    # this should probably be "use Koha::Plugins;" in C4::Templates instead
57
        my $template = C4::Templates::gettemplate( 'opac-csp.tt', 'opac' );
58
        my $resp     = [
59
            200,
60
            [
61
                'Content-Type',
62
                'text/plain',
63
                'Content-Length',
64
                12
65
            ],
66
            [ $template->output ]
67
        ];
68
        return $resp;
69
    };
70
71
    $app = builder {
72
        enable "+Koha::Middleware::ContentSecurityPolicy";
73
        $app;
74
    };
75
76
    my $test                      = Plack::Test->create($app);
77
    my $res                       = $test->request( GET "/" );
78
    my $test_nonce                = Koha::ContentSecurityPolicy->new->get_nonce();
79
    my $expected_csp_header_value = $csp_header_value;
80
    $expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g;
81
    is(
82
        $res->header('content-security-policy'), $expected_csp_header_value,
83
        "Response contains Content-Security-Policy header with the expected value"
84
    );
85
    is(
86
        $res->content, '<script nonce="' . $test_nonce . '">' . "\n" . '</script>' . "\n",
87
        "Response contains generated nonce in the body"
88
    );
89
90
    t::lib::Mocks::mock_config(
91
        $conf_csp_section,
92
        { opac => { csp_mode => '', csp_header_value => $csp_header_value } }
93
    );
94
95
    $res = $test->request( GET "/" );
96
    is(
97
        $res->header('content-security-policy'), undef,
98
        "Response does not contain Content-Security-Policy header when it is disabled in koha-conf.xml"
99
    );
100
101
    # cleanup
102
    t::lib::Mocks::mock_config( 'opachtdocs', $original_opachtdocs );
103
104
};
105
40
subtest 'test CSP in OPAC' => sub {
106
subtest 'test CSP in OPAC' => sub {
41
    plan tests => 5;
107
    plan tests => 5;
42
108
43
- 

Return to bug 38365