Download this file
| 1 | package home |
| 2 | |
| 3 | import ( |
| 4 | "net/http" |
| 5 | "net/http/httptest" |
| 6 | "strings" |
| 7 | "testing" |
| 8 | |
| 9 | "amadan.net/rastrillo/rastrillo" |
| 10 | ) |
| 11 | |
| 12 | func TestSecurityPolicyPreservesFrameworkDefaults(t *testing.T) { |
| 13 | mux := http.NewServeMux() |
| 14 | mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(200) }) |
| 15 | handler, cleanup, err := rastrillo.Handler(rastrillo.Options{Mux: mux, Logger: quietLogger()}) |
| 16 | if err != nil { |
| 17 | t.Fatal(err) |
| 18 | } |
| 19 | if cleanup != nil { |
| 20 | defer cleanup() |
| 21 | } |
| 22 | rec := httptest.NewRecorder() |
| 23 | handler.ServeHTTP(rec, httptest.NewRequest("GET", "https://id.example.test/", nil)) |
| 24 | baseline := rec.Header().Get("Content-Security-Policy") |
| 25 | for _, origins := range []Origins{{Origin, directoryOrigin}, {"https://id.example.test", "https://directory.example.test"}} { |
| 26 | if err := origins.validate(); err != nil { |
| 27 | t.Fatal(err) |
| 28 | } |
| 29 | app := &App{origins: origins} |
| 30 | want := strings.Replace(baseline, "form-action 'self'", "form-action 'self' "+origins.Directory, 1) |
| 31 | if baseline == want { |
| 32 | t.Fatal("framework form-action changed; review policy") |
| 33 | } |
| 34 | if got := app.SecurityPolicy(); got != want { |
| 35 | t.Fatalf("policy differs beyond directory permission: %q", got) |
| 36 | } |
| 37 | } |
| 38 | } |
| 39 | |
amadan