darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-20 14:29:51 -04:00
Code Issues Packages Projects Releases Wiki Activity

Security scan updates

Browse Source
This commit is contained in:
alexjanousekGSA
2025-07-31 12:47:40 -04:00
parent 55340dbc4b
commit 611ada696f
25 changed files with 114 additions and 152 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
tests/app/test_zap_security_fixes.py
View File

@@ -1,4 +1,3 @@
"""Simple tests to verify ZAP security fixes"""
import pytest
@@ -24,11 +23,23 @@ def test_no_duplicate_form_action(client_request, mocker, mock_get_service_and_o
assert count == 1
def test_cross_origin_embedder_policy_exists(client_request, mocker, mock_get_service_and_organization_counts):
"""Check that Cross-Origin-Embedder-Policy header is present"""
def test_cross_origin_embedder_policy_set_to_credentialless(client_request, mocker, mock_get_service_and_organization_counts):
"""Check that Cross-Origin-Embedder-Policy is set to 'credentialless' for YouTube compatibility"""
mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
client_request.logout()
response = client_request.get_response('.index')
assert 'Cross-Origin-Embedder-Policy' in response.headers
assert response.headers['Cross-Origin-Embedder-Policy'] == 'credentialless'
assert response.headers.get('Cross-Origin-Embedder-Policy') == 'credentialless'
def test_permissions_policy_allows_youtube_features(client_request, mocker, mock_get_service_and_organization_counts):
"""Check that Permissions-Policy allows necessary features for YouTube embeds"""
mocker.patch("app.notify_client.user_api_client.UserApiClient.deactivate_user")
client_request.logout()
response = client_request.get_response('.index')
permissions_policy = response.headers.get('Permissions-Policy', '')
assert 'accelerometer=(self "https://www.youtube-nocookie.com")' in permissions_policy
assert 'autoplay=(self "https://www.youtube-nocookie.com")' in permissions_policy
assert 'gyroscope=(self "https://www.youtube-nocookie.com")' in permissions_policy