|
Lines 42-48
subtest 'add() tests' => sub {
Link Here
|
| 42 |
|
42 |
|
| 43 |
foreach my $csp_report_type ( 'report-uri', 'report-to' ) { |
43 |
foreach my $csp_report_type ( 'report-uri', 'report-to' ) { |
| 44 |
subtest "Test $csp_report_type" => sub { |
44 |
subtest "Test $csp_report_type" => sub { |
| 45 |
plan tests => 17; |
45 |
plan tests => 9; |
| 46 |
my $content_type = $csp_report_type eq 'report-to' ? 'application/csp-report' : 'application/reports+json'; |
46 |
my $content_type = $csp_report_type eq 'report-to' ? 'application/csp-report' : 'application/reports+json'; |
| 47 |
|
47 |
|
| 48 |
# Test with standard CSP report-uri format |
48 |
# Test with standard CSP report-uri format |
|
Lines 69-105
subtest 'add() tests' => sub {
Link Here
|
| 69 |
_convert_report_uri_to_report_to( $csp_param_names, $csp_report ) if $csp_report_type eq 'report-to'; |
69 |
_convert_report_uri_to_report_to( $csp_param_names, $csp_report ) if $csp_report_type eq 'report-to'; |
| 70 |
my $csp_report_body_key = $csp_report_type eq 'report-uri' ? 'csp-report' : 'body'; |
70 |
my $csp_report_body_key = $csp_report_type eq 'report-uri' ? 'csp-report' : 'body'; |
| 71 |
|
71 |
|
| 72 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } = 99999999999999999; |
|
|
| 73 |
|
| 74 |
# Too large integers should be rejected |
| 75 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) |
| 76 |
->status_is( 400, 'CSP report rejected (400) because of line-number exceeding maximum value' ); |
| 77 |
|
| 78 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } = -1; |
| 79 |
|
| 80 |
# Too small integers should be rejected |
| 81 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) |
| 82 |
->status_is( 400, 'CSP report rejected (400) because of line-number not reaching minimum value' ); |
| 83 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } = 42; |
| 84 |
|
| 85 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'disposition'} } = 'this is not okay'; |
| 86 |
|
| 87 |
# Enum values should be confirmed |
| 88 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) |
| 89 |
->status_is( |
| 90 |
400, |
| 91 |
'CSP report rejected (400) because of disposition is not either "enforce" nor "report"' |
| 92 |
); |
| 93 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'disposition'} } = 'enforce'; |
| 94 |
|
| 95 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'script-sample'} } = |
| 96 |
'this is way too long script sample. a maximum of only 40 characters is allowed'; |
| 97 |
|
| 98 |
# Too long strings should be rejected |
| 99 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) |
| 100 |
->status_is( 400, 'CSP report rejected (400) because of script-sample exceeding maximum length' ); |
| 101 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'script-sample'} } = 'console.log("hi");'; |
| 102 |
|
| 103 |
# Anonymous request should work (browsers send these without auth) |
72 |
# Anonymous request should work (browsers send these without auth) |
| 104 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) |
73 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) |
| 105 |
->status_is( 204, 'CSP report accepted' ); |
74 |
->status_is( 204, 'CSP report accepted' ); |
|
Lines 135-141
subtest 'add() tests' => sub {
Link Here
|
| 135 |
->status_is( 204, 'Minimal CSP report accepted' ); |
104 |
->status_is( 204, 'Minimal CSP report accepted' ); |
| 136 |
|
105 |
|
| 137 |
subtest 'make sure log entries are being written' => sub { |
106 |
subtest 'make sure log entries are being written' => sub { |
| 138 |
plan tests => 22; |
107 |
plan tests => 30; |
| 139 |
|
108 |
|
| 140 |
my $log4perl_conf_file = C4::Context->config('intranetdir') . '/etc/log4perl.conf'; |
109 |
my $log4perl_conf_file = C4::Context->config('intranetdir') . '/etc/log4perl.conf'; |
| 141 |
open my $fh, '<:encoding(UTF-8)', $log4perl_conf_file or do { |
110 |
open my $fh, '<:encoding(UTF-8)', $log4perl_conf_file or do { |
|
Lines 213-218
subtest 'add() tests' => sub {
Link Here
|
| 213 |
$appender->clear(); |
182 |
$appender->clear(); |
| 214 |
$appenderplack->clear(); |
183 |
$appenderplack->clear(); |
| 215 |
|
184 |
|
|
|
185 |
# Do not crash if input is not JSON |
| 186 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => "not json" ) |
| 187 |
->status_is( 204, 'CSP report accepted' ); |
| 188 |
|
| 189 |
# Too large integers should be truncated |
| 190 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } = 99999999999999999; |
| 191 |
$t->post_ok( |
| 192 |
'/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) |
| 193 |
->status_is(204); |
| 194 |
$expected_log_entry = sprintf( |
| 195 |
"CSP violation: '%s' blocked '%s' on page '%s'%s", |
| 196 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'violated-directive'} }, |
| 197 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'blocked-uri'} }, |
| 198 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'document-uri'} }, |
| 199 |
' at ' |
| 200 |
. $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'source-file'} } . ':' |
| 201 |
. '9999999...:' |
| 202 |
. $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'column-number'} } |
| 203 |
); |
| 204 |
|
| 205 |
like( |
| 206 |
$appender->buffer, qr/$expected_log_entry/ |
| 207 |
, 'Too long line number was truncated' |
| 208 |
); |
| 209 |
$appender->clear(); |
| 210 |
|
| 211 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } = 42; |
| 212 |
|
| 213 |
# Too long strings should be rejected |
| 214 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'effective-directive'} } = |
| 215 |
'this is an example of a way too long effective-directive. a maximum of only 100 characters is allowed. so this should be truncated'; |
| 216 |
$t->post_ok( |
| 217 |
'/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) |
| 218 |
->status_is(204); |
| 219 |
|
| 220 |
$expected_log_entry = sprintf( |
| 221 |
"CSP violation: '%s' blocked '%s' on page '%s'%s", |
| 222 |
substr( |
| 223 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'effective-directive'} }, 0, 100 |
| 224 |
) |
| 225 |
. '...', |
| 226 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'blocked-uri'} }, |
| 227 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'document-uri'} }, |
| 228 |
' at ' |
| 229 |
. $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'source-file'} } . ':' |
| 230 |
. $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } . ':' |
| 231 |
. $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'column-number'} } |
| 232 |
); |
| 233 |
|
| 234 |
like( |
| 235 |
$appender->buffer, qr/$expected_log_entry/ |
| 236 |
, 'Too long line number was truncated' |
| 237 |
); |
| 238 |
$appender->clear(); |
| 239 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'effective-directive'} } = 'script-src'; |
| 240 |
|
| 241 |
$expected_log_entry = sprintf( |
| 242 |
"CSP violation: '%s' blocked '%s' on page '%s'%s", |
| 243 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'violated-directive'} }, |
| 244 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'blocked-uri'} }, |
| 245 |
$csp_report->{$csp_report_body_key}->{ $csp_param_names->{'document-uri'} }, |
| 246 |
' at ' |
| 247 |
. $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'source-file'} } . ':' |
| 248 |
. $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } . ':' |
| 249 |
. $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'column-number'} } |
| 250 |
); |
| 251 |
|
| 216 |
subtest 'test array as input' => sub { |
252 |
subtest 'test array as input' => sub { |
| 217 |
plan tests => 7; |
253 |
plan tests => 7; |
| 218 |
|
254 |
|
| 219 |
- |
|
|