Bugzilla – Attachment 193960 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: (follow-up) Add support for both CSP report syntaxes
Bug-38365-follow-up-Add-support-for-both-CSP-repor.patch (text/plain), 11.45 KB, created by
David Cook
on 2026-02-26 02:07:37 UTC
(
hide
)
Description:
Bug 38365: (follow-up) Add support for both CSP report syntaxes
Filename:
MIME Type:
Creator:
David Cook
Created:
2026-02-26 02:07:37 UTC
Size:
11.45 KB
patch
obsolete
>From 71d5ac0c08354c7eb8a81e23107fd6b1b07c5e71 Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@hypernova.fi> >Date: Tue, 10 Feb 2026 13:45:09 +0200 >Subject: [PATCH] Bug 38365: (follow-up) Add support for both CSP report > syntaxes > >This patch fixes failing tests from the previous patch and adds more tests that >cover multiple violation reports in one POST request. > >To test: >1. prove t/db_dependent/api/v1/public/csp_reports.t > >Signed-off-by: David Cook <dcook@prosentient.com.au> >--- > t/db_dependent/api/v1/public/csp_reports.t | 121 ++++++++++++++++----- > 1 file changed, 93 insertions(+), 28 deletions(-) > >diff --git a/t/db_dependent/api/v1/public/csp_reports.t b/t/db_dependent/api/v1/public/csp_reports.t >index 8cbfac4a88e..5d290bbb8f8 100755 >--- a/t/db_dependent/api/v1/public/csp_reports.t >+++ b/t/db_dependent/api/v1/public/csp_reports.t >@@ -57,34 +57,32 @@ subtest 'add() tests' => sub { > 'blocked-uri' => 'inline', > 'line-number' => 42, > 'column-number' => 10, >+ 'script-sample' => 'console.log("hi");', > 'source-file' => 'https://library.example.org/cgi-bin/koah/opac-main.pl', > 'status-code' => 200, > } > }; >- if ( $csp_report_type eq 'report-to' ) { >- $csp_report->{'body'} = delete $csp_report->{'csp-report'}; >- $csp_report->{'age'} = 1; >- $csp_report->{'type'} = 'csp-violation'; >- $csp_report->{'url'} = 'https://library.example.org/cgi-bin/koha/opac-main.pl'; >- $csp_report->{'user_agent'} = 'Test::Mojo'; >- } > >+ # as the parameters between report-to and report-uri differ, the following hashref maintains >+ # the proper parameter keys for both types >+ my $csp_param_names = { map { $_ => $_ } keys %{ $csp_report->{'csp-report'} } }; >+ _convert_report_uri_to_report_to( $csp_param_names, $csp_report ) if $csp_report_type eq 'report-to'; > my $csp_report_body_key = $csp_report_type eq 'report-uri' ? 'csp-report' : 'body'; > >- $csp_report->{$csp_report_body_key}->{'line-number'} = 99999999999999999; >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } = 99999999999999999; > > # Too large integers should be rejected > $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) > ->status_is( 400, 'CSP report rejected (400) because of line-number exceeding maximum value' ); > >- $csp_report->{$csp_report_body_key}->{'line-number'} = -1; >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } = -1; > > # Too small integers should be rejected > $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) > ->status_is( 400, 'CSP report rejected (400) because of line-number not reaching minimum value' ); >- $csp_report->{$csp_report_body_key}->{'line-number'} = 42; >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } = 42; > >- $csp_report->{$csp_report_body_key}->{'disposition'} = 'this is not okay'; >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'disposition'} } = 'this is not okay'; > > # Enum values should be confirmed > $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) >@@ -92,15 +90,15 @@ subtest 'add() tests' => sub { > 400, > 'CSP report rejected (400) because of disposition is not either "enforce" nor "report"' > ); >- $csp_report->{$csp_report_body_key}->{'disposition'} = 'enforce'; >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'disposition'} } = 'enforce'; > >- $csp_report->{$csp_report_body_key}->{'script-sample'} = >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'script-sample'} } = > 'this is way too long script sample. a maximum of only 40 characters is allowed'; > > # Too long strings should be rejected > $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) > ->status_is( 400, 'CSP report rejected (400) because of script-sample exceeding maximum length' ); >- $csp_report->{$csp_report_body_key}->{'script-sample'} = 'console.log("hi");'; >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'script-sample'} } = 'console.log("hi");'; > > # Anonymous request should work (browsers send these without auth) > $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) >@@ -118,20 +116,14 @@ subtest 'add() tests' => sub { > 'blocked-uri' => 'https://evil.example.com/script.js', > } > }; >- if ( $csp_report_type eq 'report-to' ) { >- $minimal_report->{'body'} = delete $minimal_report->{'csp-report'}; >- $minimal_report->{'age'} = 1; >- $minimal_report->{'type'} = 'csp-violation'; >- $minimal_report->{'url'} = 'https://library.example.org/cgi-bin/koha/opac-main.pl'; >- $minimal_report->{'user_agent'} = 'Test::Mojo'; >- } >+ _convert_report_uri_to_report_to( $csp_param_names, $minimal_report ) if $csp_report_type eq 'report-to'; > > $t->post_ok( > '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $minimal_report ) > ->status_is( 204, 'Minimal CSP report accepted' ); > > subtest 'make sure log entries are being written' => sub { >- plan tests => 17; >+ plan tests => 18; > > my $log4perl_conf_file = C4::Context->config('intranetdir') . '/etc/log4perl.conf'; > open my $fh, '<:encoding(UTF-8)', $log4perl_conf_file or do { >@@ -173,13 +165,13 @@ subtest 'add() tests' => sub { > > my $expected_log_entry = sprintf( > "CSP violation: '%s' blocked '%s' on page '%s'%s", >- $csp_report->{$csp_report_body_key}->{'violated-directive'}, >- $csp_report->{$csp_report_body_key}->{'blocked-uri'}, >- $csp_report->{$csp_report_body_key}->{'document-uri'}, >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'violated-directive'} }, >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'blocked-uri'} }, >+ $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'document-uri'} }, > ' at ' >- . $csp_report->{$csp_report_body_key}->{'source-file'} . ':' >- . $csp_report->{$csp_report_body_key}->{'line-number'} . ':' >- . $csp_report->{$csp_report_body_key}->{'column-number'} >+ . $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'source-file'} } . ':' >+ . $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'line-number'} } . ':' >+ . $csp_report->{$csp_report_body_key}->{ $csp_param_names->{'column-number'} } > ); > > like( >@@ -189,6 +181,49 @@ subtest 'add() tests' => sub { > is( $appenderplack->buffer, '', 'Nothing in plack log buffer yet' ); > $appender->clear(); > >+ # clear buffers >+ $appender->clear(); >+ $appenderplack->clear(); >+ >+ subtest 'test array as input' => sub { >+ plan tests => 7; >+ >+ my $csp_report_copy = {%$csp_report}; # make a shallow copy >+ $csp_report_copy->{'body'} = { %{ $csp_report->{'body'} } }; >+ >+ # for testing multiple reports being logged correctly, differentiate the two reports >+ # by violatedDir >+ $csp_report_copy->{'body'}->{'effectiveDirective'} = 'style-src'; >+ ( my $expected_log_entry_copy = $expected_log_entry ) =~ s/script-src/style-src/; >+ >+ $t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => >+ [ $csp_report, $csp_report_copy ] )->status_is( 204, 'Multiple CSP reports accepted' ); >+ my @log_entries = split( /\n/, $appender->buffer ); >+ is( >+ scalar @log_entries, 2, >+ 'There are two log entries because we sent two reports simultaneously.' >+ ); >+ like( $expected_log_entry, qr/: 'script-src' blocked/, 'Verify correct directive' ); >+ like( >+ $log_entries[0], qr/^\[\d+.*?\] $expected_log_entry$/, >+ 'First entry is the expected log entry' >+ ); >+ like( >+ $expected_log_entry_copy, qr/: 'style-src' blocked/, >+ 'Verify correct directive for the second entry' >+ ); >+ like( >+ $log_entries[1], qr/^\[\d+.*?\] $expected_log_entry_copy$/, >+ 'Second entry is the expected log entry' >+ ); >+ $appender->clear(); >+ } >+ if $csp_report_type eq 'report-to'; >+ ok( >+ 1, >+ 'report-uri does not support array format. this test is just a placeholder for counting planned tests' >+ ) if $csp_report_type eq 'report-uri'; >+ > $ENV{'plack.is.enabled.for.this.test'} = 1; # tricking C4::Context->psgi_env > $t->post_ok( > '/api/v1/public/csp-reports' => { 'Content-Type' => $content_type } => json => $csp_report ) >@@ -226,4 +261,34 @@ HERE > $schema->storage->txn_rollback; > }; > >+sub _convert_report_uri_to_report_to { >+ my ( $csp_param_names, $csp_report ) = @_; >+ >+ foreach my $key ( keys %{ $csp_report->{'csp-report'} } ) { >+ my $orig_key = $key; >+ $key =~ s/uri/URL/g; # uri is replaced with URL in the camelCase version >+ my @parts = split( /-/, $key ); >+ my $camelcased = shift(@parts); >+ foreach my $part (@parts) { >+ $camelcased .= ucfirst($part); >+ } >+ $csp_report->{'csp-report'}->{$camelcased} = delete $csp_report->{'csp-report'}->{$orig_key}; >+ $csp_param_names->{$orig_key} = $camelcased; >+ } >+ >+ $csp_report->{'body'} = delete $csp_report->{'csp-report'}; >+ $csp_report->{'age'} = 1; >+ $csp_report->{'type'} = 'csp-violation'; >+ $csp_report->{'url'} = 'https://library.example.org/cgi-bin/koha/opac-main.pl'; >+ $csp_report->{'user_agent'} = 'Test::Mojo'; >+ >+ # script-sample (report-uri) => sample (report-to) >+ $csp_report->{'body'}->{'sample'} = delete $csp_report->{'body'}->{'scriptSample'} >+ if exists $csp_report->{'body'}->{'scriptSample'}; >+ $csp_param_names->{'script-sample'} = 'sample'; >+ >+ # violated-directive does not exist in report-to >+ delete $csp_report->{'body'}->{'violatedDir'}; >+} >+ > 1; >-- >2.39.5
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
| 193960 |
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968