Bugzilla – Attachment 189470 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: (follow-up) Add more comprehensive unit tests
Bug-38365-follow-up-Add-more-comprehensive-unit-te.patch (text/plain), 13.71 KB, created by
David Cook
on 2025-11-11 03:57:40 UTC
(
hide
)
Description:
Bug 38365: (follow-up) Add more comprehensive unit tests
Filename:
MIME Type:
Creator:
David Cook
Created:
2025-11-11 03:57:40 UTC
Size:
13.71 KB
patch
obsolete
>From b67cdab8dc85cff3d6bd5b898cb5ed88fa4d2987 Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@hypernova.fi> >Date: Fri, 31 Oct 2025 11:00:10 +0200 >Subject: [PATCH] Bug 38365: (follow-up) Add more comprehensive unit tests > >Previous patch only covered OPAC interface. > >These tests cover both opac and intranet, as well as adding a test to ensure >the other interface is still disabled while only the other is enabled. > >Adds more readable test output. > >To test: >1. prove t/db_dependent/Output.t > >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > t/db_dependent/Output.t | 278 ++++++++++++++++++++-------------------- > 1 file changed, 138 insertions(+), 140 deletions(-) > >diff --git a/t/db_dependent/Output.t b/t/db_dependent/Output.t >index bc0d2b78bfd..424701bdd90 100755 >--- a/t/db_dependent/Output.t >+++ b/t/db_dependent/Output.t >@@ -162,166 +162,164 @@ subtest 'redirect_if_opac_suppressed() tests' => sub { > }; > > subtest 'Content-Security-Policy tests' => sub { >- plan tests => 1; >- >- subtest 'OPAC' => sub { >- >- plan tests => 3; >- >- subtest 'turned off' => sub { >- >- plan tests => 2; >+ my @interfaces = ( 'opac', 'intranet' ); >+ my $modes = { >+ 'enabled' => 'Content-security-policy', >+ 'report-only' => 'Content-security-policy-report-only', >+ }; >+ my @conf_modes = keys %$modes; > >- $schema->storage->txn_begin; >+ plan tests => scalar @interfaces; >+ foreach my $interface (@interfaces) { > >- t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' ); >+ subtest "interface: $interface" => sub { > >- my $query = CGI->new(); >+ # # one subtest per mode + disabled >+ plan tests => scalar @conf_modes + 1; > >- { >- local *STDOUT; >- my $stdout; >- open STDOUT, '>', \$stdout; >+ subtest 'disabled' => sub { > >- my ( $template, $borrowernumber, $cookie ) = C4::Auth::get_template_and_user( >- { >- template_name => "opac-main.tt", >- type => "opac", >- query => $query, >- authnotrequired => 1, >- } >- ); >+ $schema->storage->txn_begin; > >- C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); >+ t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' ); > >- unlike( $stdout, qr{Content-Security-Policy:}, 'No header present: Content-Security-Policy' ); >- unlike( >- $stdout, qr{Content-Security-Policy-Report-Only:}, >- 'No header present: Content-Security-Policy-Report-Only' >+ t::lib::Mocks::mock_config( >+ 'content_security_policy', >+ { $interface => { csp_mode => '', csp_header_value => '' } } > ); > >- close STDOUT; >- }; >- >- $schema->storage->txn_rollback; >- >- }; >+ my $query = CGI->new(); > >- subtest 'report-only' => sub { >+ { >+ local *STDOUT; >+ my $stdout; >+ open STDOUT, '>', \$stdout; > >- plan tests => 3; >+ my ( $template, $borrowernumber, $cookie ) = C4::Auth::get_template_and_user( >+ { >+ template_name => "${interface}-main.tt", >+ type => $interface, >+ query => $query, >+ authnotrequired => 1, >+ } >+ ); > >- $schema->storage->txn_begin; >+ C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); > >- t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' ); >+ unlike( >+ $stdout, qr/Content-Security-Policy:/i, >+ "While feature is disabled, and requesting '$interface', no header present: 'Content-Security-Policy'" >+ ); >+ unlike( >+ $stdout, qr/Content-Security-Policy-Report-Only:/i, >+ "While feature is disabled, and requesting '$interface', no header present: 'Content-Security-Policy-Report-Only'" >+ ); > >- C4::Context->interface('opac'); >+ close STDOUT; >+ }; > >- my $expected_csp_header = 'Content-security-policy-report-only'; >- my $expected_csp_header_value = >- "default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'"; >- t::lib::Mocks::mock_config( >- 'content_security_policy', >- { 'opac' => { csp_mode => 'report-only', csp_header_value => $expected_csp_header_value } } >- ); >+ $schema->storage->txn_rollback; > >- my $query = CGI->new(); >- >- { >- local *STDOUT; >- my $stdout; >- open STDOUT, '>', \$stdout; >- >- my ( $template, $borrowernumber, $cookie ) = C4::Auth::get_template_and_user( >- { >- template_name => "opac-main.tt", >- type => "opac", >- query => $query, >- authnotrequired => 1, >- } >- ); >- >- my $cache = Koha::Cache::Memory::Lite->get_instance; >- my $nonce = $cache->get_from_cache("csp_nonce"); >- $expected_csp_header_value =~ s/_CSP_NONCE_/nonce-$nonce/g; >- C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); >- >- $stdout =~ /(Content-Security-Policy[A-Za-z\-]*): (.*)\r/im; >- my ( $csp_header, $csp_header_value ) = ( $1, $2 ); >- isnt( >- $csp_header, 'Content-Security-Policy', >- 'No header present: Content-Security-Policy' >- ); >- is( $csp_header, $expected_csp_header, 'Header present: Content-Security-Policy-Report-Only' ); >- is( >- $csp_header_value, $expected_csp_header_value, >- 'Content-Security-Policy-Report-Only value matches expected value' >- ); >- >- close STDOUT; > }; > >- $schema->storage->txn_rollback; >- >- }; >- >- subtest 'enabled' => sub { >- >- plan tests => 3; >- >- $schema->storage->txn_begin; >- >- t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' ); >- >- C4::Context->interface('opac'); >- >- my $expected_csp_header = 'Content-security-policy'; >- my $expected_csp_header_value = >- "default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none'"; >- t::lib::Mocks::mock_config( >- 'content_security_policy', >- { 'opac' => { csp_mode => 'enabled', csp_header_value => $expected_csp_header_value } } >- ); >- >- my $query = CGI->new(); >- >- { >- local *STDOUT; >- my $stdout; >- open STDOUT, '>', \$stdout; >- >- my ( $template, $borrowernumber, $cookie ) = C4::Auth::get_template_and_user( >- { >- template_name => "opac-main.tt", >- type => "opac", >- query => $query, >- authnotrequired => 1, >+ foreach my $mode (@conf_modes) { >+ subtest "CSP mode: $mode" => sub { >+ >+ # # while enabled, but req.. # no header present # header present + value matches >+ plan tests => ( scalar @interfaces - 1 ) * 2 + ( scalar @conf_modes - 1 ) * 1 + 2; >+ >+ $schema->storage->txn_begin; >+ >+ t::lib::Mocks::mock_preference( 'SessionStorage', 'tmp' ); >+ >+ C4::Context->interface($interface); >+ >+ my $expected_csp_header = $modes->{$mode}; >+ my $expected_csp_header_value = >+ "default-src 'self'; script-src 'self' 'unsafe-eval' _CSP_NONCE_; style-src 'self' 'unsafe-inline' _CSP_NONCE_; img-src 'self' data:; font-src 'self'; object-src 'none'"; >+ t::lib::Mocks::mock_config( >+ 'content_security_policy', >+ { $interface => { csp_mode => $mode, csp_header_value => $expected_csp_header_value } } >+ ); >+ >+ my $query = CGI->new(); >+ >+ foreach my $other_interface (@interfaces) { >+ next if $other_interface eq $interface; >+ { >+ local *STDOUT; >+ my $stdout; >+ open STDOUT, '>', \$stdout; >+ >+ my ( $template, $borrowernumber, $cookie ) = C4::Auth::get_template_and_user( >+ { >+ template_name => "${other_interface}-main.tt", >+ type => $other_interface, >+ query => $query, >+ authnotrequired => 1, >+ } >+ ); >+ >+ C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); >+ >+ unlike( >+ $stdout, qr/Content-Security-Policy:/i, >+ "While feature is enabled on '$interface', but requesting '$other_interface', where the feature is disabled, no header present: 'Content-Security-Policy'" >+ ); >+ unlike( >+ $stdout, qr/Content-Security-Policy-Report-Only:/i, >+ "While feature is enabled on '$interface', but requesting '$other_interface', where the feature is disabled, no header present: 'Content-Security-Policy-Report-Only'" >+ ); >+ >+ close STDOUT; >+ }; > } >- ); >- >- my $cache = Koha::Cache::Memory::Lite->get_instance; >- my $nonce = $cache->get_from_cache("csp_nonce"); >- $expected_csp_header_value =~ s/_CSP_NONCE_/nonce-$nonce/g; >- >- C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); >- >- $stdout =~ /(Content-Security-Policy[A-Za-z\-]*): (.*)\r/im; >- my ( $csp_header, $csp_header_value ) = ( $1, $2 ); >- isnt( >- $csp_header, 'Content-Security-Policy-Report-Only:', >- 'No header present: Content-Security-Policy-Report-Only' >- ); >- is( $csp_header, $expected_csp_header, 'Header present: Content-Security-Policy' ); >- is( >- $csp_header_value, $expected_csp_header_value, >- 'Content-Security-Policy value matches expected value' >- ); > >- close STDOUT; >- }; >- >- $schema->storage->txn_rollback; >+ { >+ local *STDOUT; >+ my $stdout; >+ open STDOUT, '>', \$stdout; >+ >+ my ( $template, $borrowernumber, $cookie ) = C4::Auth::get_template_and_user( >+ { >+ template_name => "${interface}-main.tt", >+ type => $interface, >+ query => $query, >+ authnotrequired => 1, >+ } >+ ); >+ >+ my $cache = Koha::Cache::Memory::Lite->get_instance; >+ my $nonce = $cache->get_from_cache("csp_nonce"); >+ $expected_csp_header_value =~ s/_CSP_NONCE_/nonce-$nonce/g; >+ C4::Output::output_html_with_http_headers( $query, $cookie, $template->output ); >+ >+ $stdout =~ /(Content-Security-Policy[A-Za-z\-]*): (.*)\r/im; >+ my ( $csp_header, $csp_header_value ) = ( $1, $2 ); >+ foreach my $other_mode (@conf_modes) { >+ next if $other_mode eq $mode; >+ isnt( >+ $csp_header, $modes->{$other_mode}, >+ "While feature is in '$mode' mode, header is not present: '$modes->{$other_mode}'" >+ ); >+ } >+ >+ is( >+ $csp_header, $expected_csp_header, >+ "While feature is in '$mode' mode, header is present: '$expected_csp_header'" >+ ); >+ is( >+ $csp_header_value, $expected_csp_header_value, >+ "The value of header '$csp_header' matches the expected value" >+ ); >+ >+ close STDOUT; >+ }; >+ >+ $schema->storage->txn_rollback; >+ }; > >+ } > }; >- }; >+ } > }; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968