darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-02-23 11:51:05 -05:00
Code Issues Packages Projects Releases Wiki Activity
Files
203393de235631db0ce3c38dec85da170a634fba
notifications-admin/tests/app/main/views/test_headers.py

38 lines
1.7 KiB
Python
Raw Normal View History

Update emails to use logos cdn
2017-07-24 15:20:40 +01:00
def test_owasp_useful_headers_set(client, mocker):
Use named arguments for clearer string formatting Helps when the string is long. Also helps disambiguate between the CDN domain used for the logos and those for CSS/JS.
2018-11-29 11:41:13 +00:00
mocker.patch('app.get_logo_cdn_domain', return_value='static-logos.test.com')
Add some useful owasp suggested headers
2016-01-07 13:58:38 +00:00
Use `client` and `logged_in_client` fixtures Wherever possible, because Don’t Repeat Yourself.
2017-02-03 12:07:21 +00:00
response = client.get('/')
Update emails to use logos cdn
2017-07-24 15:20:40 +01:00
Add some useful owasp suggested headers
2016-01-07 13:58:38 +00:00
assert response.status_code == 200
assert response.headers['X-Frame-Options'] == 'deny'
assert response.headers['X-Content-Type-Options'] == 'nosniff'
assert response.headers['X-XSS-Protection'] == '1; mode=block'
Allow images to be served from live domain Currently images in our email template are hardcoded to be served from the live domain[1]. In order for the admin app, running locally or in preview/staging, to be able to load these images when previewing an email template, the CSP headers need to allow this domain. Also splits the header string up using string literal concatenation[2] so that it’s easier to read. 1. https://notifications.service.gov.uk 2. https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation
2016-07-05 07:12:21 +01:00
assert response.headers['Content-Security-Policy'] == (
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
Stop content security policy blocking GA In https://github.com/alphagov/notifications-admin/pull/1583 we changed our Google Analytics settings to use newer browsers’ `sendBeacon` feature. The advantage of this is that it > [ensures] that the data has been sent during the unloading of a > document [which] is something that has traditionally been difficult > for developers – https://developer.mozilla.org/en-US/docs/Web/API/Navigator/sendBeacon To transmit this data it uses a AJAX request (`XMLHttpRequest`) underneath. AJAX requests are governed by the `connect-src` content security policy (or the `default-src` if one is not present). `connect-src`: > Applies to XMLHttpRequest (AJAX), WebSocket or EventSource. If not > allowed the browser emulates a 400 HTTP status code. – https://content-security-policy.com/ Because we didn’t have one in place, `sendBeacon` requests to GA were getting blocked in browsers that support content security policy (pretty much everything better than IE11[1]). 1. https://caniuse.com/#feat=beacon
2017-11-06 10:25:30 +00:00
"connect-src 'self' *.google-analytics.com;"
Allow images to be served from live domain Currently images in our email template are hardcoded to be served from the live domain[1]. In order for the admin app, running locally or in preview/staging, to be able to load these images when previewing an email template, the CSP headers need to allow this domain. Also splits the header string up using string literal concatenation[2] so that it’s easier to read. 1. https://notifications.service.gov.uk 2. https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation
2016-07-05 07:12:21 +01:00
"object-src 'self';"
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"font-src 'self' static.example.com data:;"
"img-src "
"'self' static.example.com *.google-analytics.com *.notifications.service.gov.uk static-logos.test.com data:;"
Fixes for tests broken by changes - corrects target page for set_email_branding to new preview step instead of itself - removed check for helper method being called in email page test - updates expected result for test of global headers to include changes to `frame-src` - updates navigation config with brand preview page
2018-08-03 17:39:58 +01:00
"frame-src 'self' www.youtube.com;"
Allow images to be served from live domain Currently images in our email template are hardcoded to be served from the live domain[1]. In order for the admin app, running locally or in preview/staging, to be able to load these images when previewing an email template, the CSP headers need to allow this domain. Also splits the header string up using string literal concatenation[2] so that it’s easier to read. 1. https://notifications.service.gov.uk 2. https://docs.python.org/3/reference/lexical_analysis.html#string-literal-concatenation
2016-07-05 07:12:21 +01:00
)
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
def test_headers_non_ascii_characters_are_replaced(client, mocker):
Use named arguments for clearer string formatting Helps when the string is long. Also helps disambiguate between the CDN domain used for the logos and those for CSS/JS.
2018-11-29 11:41:13 +00:00
mocker.patch('app.get_logo_cdn_domain', return_value='static-logos۾.test.com')
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
response = client.get('/')
assert response.status_code == 200
assert response.headers['Content-Security-Policy'] == (
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
"connect-src 'self' *.google-analytics.com;"
"object-src 'self';"
Fix content security policy for the CDN The CDN URLs aren’t in included in the content security policy. So browsers will refuse to load them. This commit: - adds each of the CDN URLs to the - only prepend URLs in CSS files with `/static/` if we’re running locally (because the CDN URLs are like `static.example.com` not `example.com/static`)
2018-11-29 11:29:52 +00:00
"font-src 'self' static.example.com data:;"
"img-src "
"'self' static.example.com *.google-analytics.com *.notifications.service.gov.uk static-logos??.test.com data:;"
Fixes for tests broken by changes - corrects target page for set_email_branding to new preview step instead of itself - removed check for helper method being called in email page test - updates expected result for test of global headers to include changes to `frame-src` - updates navigation config with brand preview page
2018-08-03 17:39:58 +01:00
"frame-src 'self' www.youtube.com;"
Bump utils and sanitise header values Updated notifications-utils. This brings in - the renamed character sanitization classes - the change to allow unicode in letter addresses (this lets us delete a test that is no longer relevant) Also replaced non-ascii characters in headers. This fixes a bug where non-ascii characters in a CSV filename were causing errors since the filename is also used in the header.
2018-05-25 10:18:39 +01:00
)
Reference in New Issue Copy Permalink