Bugzilla – Attachment 194448 Details for
Bug 38365
Add Content-Security-Policy HTTP header to HTML responses
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 38365: (follow-up) Merge CSP middleware tests
Bug-38365-follow-up-Merge-CSP-middleware-tests.patch (text/plain), 7.01 KB, created by
Lari Taskula
on 2026-03-04 13:53:22 UTC
(
hide
)
Description:
Bug 38365: (follow-up) Merge CSP middleware tests
Filename:
MIME Type:
Creator:
Lari Taskula
Created:
2026-03-04 13:53:22 UTC
Size:
7.01 KB
patch
obsolete
>From 8945e0ad794b1439a2003aa2bb865f889e5c12bd Mon Sep 17 00:00:00 2001 >From: Lari Taskula <lari.taskula@hypernova.fi> >Date: Wed, 4 Mar 2026 13:30:50 +0200 >Subject: [PATCH] Bug 38365: (follow-up) Merge CSP middleware tests > >It seems the test outside of db_dependent required presence of database after all > >To test: >1. prove t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >--- > t/Koha/Middleware/ContentSecurityPolicy.t | 99 ------------------- > .../Koha/Middleware/ContentSecurityPolicy.t | 68 ++++++++++++- > 2 files changed, 67 insertions(+), 100 deletions(-) > delete mode 100755 t/Koha/Middleware/ContentSecurityPolicy.t > >diff --git a/t/Koha/Middleware/ContentSecurityPolicy.t b/t/Koha/Middleware/ContentSecurityPolicy.t >deleted file mode 100755 >index 38164b49161..00000000000 >--- a/t/Koha/Middleware/ContentSecurityPolicy.t >+++ /dev/null >@@ -1,99 +0,0 @@ >-#!/usr/bin/perl >- >-# >-# Copyright 2025 Hypernova Oy >-# >-# This file is part of Koha. >-# >-# Koha is free software; you can redistribute it and/or modify it >-# under the terms of the GNU General Public License as published by >-# the Free Software Foundation; either version 3 of the License, or >-# (at your option) any later version. >-# >-# Koha is distributed in the hope that it will be useful, but >-# WITHOUT ANY WARRANTY; without even the implied warranty of >-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the >-# GNU General Public License for more details. >-# >-# You should have received a copy of the GNU General Public License >-# along with Koha; if not, see <https://www.gnu.org/licenses>. >- >-use Modern::Perl; >-use Test::NoWarnings; >-use Test::More tests => 3; >-use Test::Warn; >- >-use File::Basename qw(dirname); >-use HTTP::Request::Common; >-use Plack::Builder; >-use Plack::Util; >-use Plack::Test; >- >-use C4::Templates; >- >-use t::lib::Mocks; >- >-use_ok("Koha::Middleware::ContentSecurityPolicy"); >- >-my $conf_csp_section = 'content_security_policy'; >- >-subtest 'test Content-Security-Policy header' => sub { >- plan tests => 3; >- >- my $csp_header_value = >- "default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; >- >- t::lib::Mocks::mock_config( >- $conf_csp_section, >- { opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } >- ); >- >- t::lib::Mocks::mock_config( 'opachtdocs', C4::Context->config('intranetdir') . '/t/mock_templates/opac-tmpl' ); >- >- my $env = {}; >- my $app = sub { >- require Koha::Plugins; # this should probably be "use Koha::Plugins;" in C4::Templates instead >- my $template = C4::Templates::gettemplate( 'opac-csp.tt', 'opac' ); >- my $resp = [ >- 200, >- [ >- 'Content-Type', >- 'text/plain', >- 'Content-Length', >- 12 >- ], >- [ $template->output ] >- ]; >- return $resp; >- }; >- >- $app = builder { >- enable "+Koha::Middleware::ContentSecurityPolicy"; >- $app; >- }; >- >- my $test = Plack::Test->create($app); >- my $res = $test->request( GET "/" ); >- my $test_nonce = Koha::ContentSecurityPolicy->new->get_nonce(); >- my $expected_csp_header_value = $csp_header_value; >- $expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; >- is( >- $res->header('content-security-policy'), $expected_csp_header_value, >- "Response contains Content-Security-Policy header with the expected value" >- ); >- is( >- $res->content, '<script nonce="' . $test_nonce . '">' . "\n" . '</script>' . "\n", >- "Response contains generated nonce in the body" >- ); >- >- t::lib::Mocks::mock_config( >- $conf_csp_section, >- { opac => { csp_mode => '', csp_header_value => $csp_header_value } } >- ); >- >- $res = $test->request( GET "/" ); >- is( >- $res->header('content-security-policy'), undef, >- "Response does not contain Content-Security-Policy header when it is disabled in koha-conf.xml" >- ); >-}; >diff --git a/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t b/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >index f451af93719..3e05e5c36f4 100755 >--- a/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >+++ b/t/db_dependent/Koha/Middleware/ContentSecurityPolicy.t >@@ -20,7 +20,7 @@ > > use Modern::Perl; > use Test::NoWarnings; >-use Test::More tests => 5; >+use Test::More tests => 6; > > use HTTP::Request::Common; > use Plack::App::CGIBin; >@@ -37,6 +37,72 @@ my $conf_csp_section = 'content_security_policy'; > > my $schema = Koha::Database->schema; > >+subtest 'test Content-Security-Policy header in a minimal environment' => sub { >+ plan tests => 3; >+ >+ my $csp_header_value = >+ "default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; img-src 'self' data:; font-src 'self'; object-src 'none'"; >+ >+ t::lib::Mocks::mock_config( >+ $conf_csp_section, >+ { opac => { csp_mode => 'enabled', csp_header_value => $csp_header_value } } >+ ); >+ >+ my $original_opachtdocs = C4::Context->config('opachtdocs'); >+ t::lib::Mocks::mock_config( 'opachtdocs', C4::Context->config('intranetdir') . '/t/mock_templates/opac-tmpl' ); >+ >+ my $env = {}; >+ my $app = sub { >+ require Koha::Plugins; # this should probably be "use Koha::Plugins;" in C4::Templates instead >+ my $template = C4::Templates::gettemplate( 'opac-csp.tt', 'opac' ); >+ my $resp = [ >+ 200, >+ [ >+ 'Content-Type', >+ 'text/plain', >+ 'Content-Length', >+ 12 >+ ], >+ [ $template->output ] >+ ]; >+ return $resp; >+ }; >+ >+ $app = builder { >+ enable "+Koha::Middleware::ContentSecurityPolicy"; >+ $app; >+ }; >+ >+ my $test = Plack::Test->create($app); >+ my $res = $test->request( GET "/" ); >+ my $test_nonce = Koha::ContentSecurityPolicy->new->get_nonce(); >+ my $expected_csp_header_value = $csp_header_value; >+ $expected_csp_header_value =~ s/_CSP_NONCE_/$test_nonce/g; >+ is( >+ $res->header('content-security-policy'), $expected_csp_header_value, >+ "Response contains Content-Security-Policy header with the expected value" >+ ); >+ is( >+ $res->content, '<script nonce="' . $test_nonce . '">' . "\n" . '</script>' . "\n", >+ "Response contains generated nonce in the body" >+ ); >+ >+ t::lib::Mocks::mock_config( >+ $conf_csp_section, >+ { opac => { csp_mode => '', csp_header_value => $csp_header_value } } >+ ); >+ >+ $res = $test->request( GET "/" ); >+ is( >+ $res->header('content-security-policy'), undef, >+ "Response does not contain Content-Security-Policy header when it is disabled in koha-conf.xml" >+ ); >+ >+ # cleanup >+ t::lib::Mocks::mock_config( 'opachtdocs', $original_opachtdocs ); >+ >+}; >+ > subtest 'test CSP in OPAC' => sub { > plan tests => 5; > >-- >2.34.1
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 38365
:
174054
|
188487
|
188488
|
188489
|
188490
|
188491
|
188733
|
188734
|
188735
|
188736
|
188737
|
188881
|
188882
|
189465
|
189466
|
189467
|
189468
|
189469
|
189470
|
189471
|
189472
|
191618
|
191619
|
191620
|
191621
|
191622
|
191623
|
191660
|
191661
|
191662
|
191663
|
191664
|
191665
|
191666
|
191667
|
191668
|
192294
|
192295
|
192296
|
192297
|
192298
|
192299
|
192300
|
192301
|
192302
|
192303
|
192304
|
192305
|
192306
|
192412
|
192413
|
192414
|
192415
|
192416
|
192417
|
192418
|
192419
|
192420
|
192421
|
192422
|
192423
|
192424
|
192425
|
192426
|
192427
|
192428
|
192429
|
192524
|
192535
|
192536
|
192537
|
192553
|
192554
|
192555
|
192556
|
192557
|
192558
|
192559
|
192560
|
192561
|
192562
|
192563
|
192564
|
192565
|
192566
|
192567
|
192568
|
192569
|
192570
|
192571
|
192572
|
192573
|
192574
|
192684
|
192685
|
192686
|
192691
|
192692
|
192693
|
192694
|
192695
|
192696
|
192697
|
192698
|
192699
|
192700
|
192701
|
192702
|
192703
|
192704
|
192705
|
192706
|
192707
|
192708
|
192709
|
192738
|
192843
|
192844
|
192934
|
192935
|
192936
|
192937
|
193288
|
193289
|
193290
|
193291
|
193292
|
193293
|
193294
|
193295
|
193296
|
193297
|
193298
|
193299
|
193300
|
193301
|
193302
|
193303
|
193304
|
193305
|
193306
|
193307
|
193308
|
193309
|
193310
|
193311
|
193312
|
193335
|
193705
|
193706
|
193707
|
193708
|
193709
|
193710
|
193711
|
193712
|
193713
|
193714
|
193941
|
193942
|
193943
|
193944
|
193945
|
193946
|
193947
|
193948
|
193949
|
193950
|
193951
|
193952
|
193953
|
193954
|
193955
|
193956
|
193957
|
193958
|
193959
|
193960
|
193961
|
193962
|
193963
|
193964
|
193965
|
193966
|
193967
|
193968
|
194374
|
194422
|
194423
|
194424
|
194425
|
194426
|
194427
|
194428
|
194440
|
194441
| 194448 |
194449