mirror of
https://github.com/quantum5/django-csp-advanced.git
synced 2025-04-24 19:31:56 -04:00
76 lines
2.6 KiB
Python
76 lines
2.6 KiB
Python
|
from collections import OrderedDict
|
||
|
|
|
||
|
|
from django.test import SimpleTestCase
|
||
|
|
|
||
|
|
from csp import CSPCompiler, InvalidCSPError
|
||
|
|
|
||
|
|
|
||
|
|
class CSPCompileTest(SimpleTestCase):
|
||
|
|
def test_fetch(self):
|
||
|
|
self.assertEqual(CSPCompiler({
|
||
|
|
'script-src': ['self', 'https://dmoj.ca', 'nonce-123'],
|
||
|
|
}).compile(), "script-src 'self' https://dmoj.ca 'nonce-123'")
|
||
|
|
|
||
|
|
with self.assertRaises(InvalidCSPError):
|
||
|
|
CSPCompiler({
|
||
|
|
'script-src': 'https://dmoj.ca',
|
||
|
|
}).compile()
|
||
|
|
|
||
|
|
def test_sandbox(self):
|
||
|
|
self.assertEqual(CSPCompiler({
|
||
|
|
'sandbox': ['allow-same-origin', 'allow-scripts'],
|
||
|
|
}).compile(), "sandbox allow-same-origin allow-scripts")
|
||
|
|
|
||
|
|
with self.assertRaises(InvalidCSPError):
|
||
|
|
CSPCompiler({
|
||
|
|
'sandbox': ['allow-invalid', 'allow-scripts'],
|
||
|
|
}).compile()
|
||
|
|
|
||
|
|
with self.assertRaises(InvalidCSPError):
|
||
|
|
CSPCompiler({
|
||
|
|
'sandbox': 'allow-scripts',
|
||
|
|
}).compile()
|
||
|
|
|
||
|
|
def test_report_uri(self):
|
||
|
|
self.assertEqual(CSPCompiler({
|
||
|
|
'report-uri': '/dev/null',
|
||
|
|
}).compile(), "report-uri /dev/null")
|
||
|
|
|
||
|
|
with self.assertRaises(InvalidCSPError):
|
||
|
|
CSPCompiler({'report-uri': []}).compile()
|
||
|
|
|
||
|
|
def test_require_sri_for(self):
|
||
|
|
self.assertEqual(CSPCompiler({
|
||
|
|
'require-sri-for': 'script style',
|
||
|
|
}).compile(), "require-sri-for script style")
|
||
|
|
|
||
|
|
with self.assertRaises(InvalidCSPError):
|
||
|
|
CSPCompiler({'require-sri-for': []}).compile()
|
||
|
|
|
||
|
|
with self.assertRaises(InvalidCSPError):
|
||
|
|
CSPCompiler({'require-sri-for': 'bad'}).compile()
|
||
|
|
|
||
|
|
def test_upgrade_insecure_requests(self):
|
||
|
|
self.assertEqual(CSPCompiler({
|
||
|
|
'upgrade-insecure-requests': True,
|
||
|
|
}).compile(), "upgrade-insecure-requests")
|
||
|
|
|
||
|
|
self.assertEqual(CSPCompiler({
|
||
|
|
'upgrade-insecure-requests': False,
|
||
|
|
}).compile(), '')
|
||
|
|
|
||
|
|
def test_integration(self):
|
||
|
|
self.assertEqual(CSPCompiler(OrderedDict([
|
||
|
|
('style-src', ['self']),
|
||
|
|
('script-src', ['self', 'https://dmoj.ca']),
|
||
|
|
('frame-src', ['none']),
|
||
|
|
('plugin-types', ['application/pdf']),
|
||
|
|
('block-all-mixed-content', True),
|
||
|
|
('upgrade-insecure-requests', False),
|
||
|
|
('sandbox', ['allow-scripts']),
|
||
|
|
('report-uri', '/dev/null')
|
||
|
|
])).compile(),
|
||
|
|
"style-src 'self'; script-src 'self' https://dmoj.ca; frame-src 'none'; "
|
||
|
|
"plugin-types application/pdf; block-all-mixed-content; sandbox allow-scripts; "
|
||
|
|
"report-uri /dev/null")
|