darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-25 00:33:58 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #1002 from GSA/966-add-GA-and-DAP-to-CSP

Browse Source 
966 - Added 2 urls to the CSP configuration + adjusted the test
This commit is contained in:
Steven Reilly
2023-12-12 17:05:23 -05:00
committed by GitHub
parent 8493aaea5c 13ed67b18b
commit 6c4b1dc2b6
3 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/__init__.py
View File

@@ -150,6 +150,8 @@ def _csp(config):
"https://js-agent.newrelic.com", "https://js-agent.newrelic.com",
"https://gov-bam.nr-data.net", "https://gov-bam.nr-data.net",
"https://www.googletagmanager.com", "https://www.googletagmanager.com",
"https://www.google-analytics.com",
"https://dap.digitalgov.gov",
], ],
"connect-src": ["'self'", "https://gov-bam.nr-data.net"], "connect-src": ["'self'", "https://gov-bam.nr-data.net"],
"style-src": ["'self'", asset_domain], "style-src": ["'self'", asset_domain],

4
tests/app/main/views/test_headers.py
View File

@@ -18,7 +18,9 @@ def test_owasp_useful_headers_set(
assert search( assert search(
r"script-src 'self' static\.example\.com 'unsafe-eval' https:\/\/js-agent\.new" r"script-src 'self' static\.example\.com 'unsafe-eval' https:\/\/js-agent\.new"
r"relic\.com https:\/\/gov-bam\.nr-data\.net https:\/\/www\.googletagmanager\." r"relic\.com https:\/\/gov-bam\.nr-data\.net https:\/\/www\.googletagmanager\."
r"com 'nonce-.*';", r"com https:\/\/www\.google-analytics\."
r"com https:\/\/dap\.digitalgov\."
r"gov 'nonce-.*';",
csp, csp,
) )
assert search(r"connect-src 'self' https:\/\/gov-bam.nr-data\.net;", csp) assert search(r"connect-src 'self' https:\/\/gov-bam.nr-data\.net;", csp)

12
tests/app/main/views/test_manage_users.py
View File

@@ -775,15 +775,11 @@ def test_should_show_page_for_inviting_user(
def test_should_not_show_page_for_inviting_user_without_permissions( def test_should_not_show_page_for_inviting_user_without_permissions(
client_request, client_request, mock_get_template_folders, active_user_empty_permissions
mock_get_template_folders,
active_user_empty_permissions
): ):
client_request.login(active_user_empty_permissions) client_request.login(active_user_empty_permissions)
page = client_request.get( page = client_request.get(
"main.invite_user", "main.invite_user", service_id=SERVICE_ONE_ID, _expected_status=403
service_id=SERVICE_ONE_ID,
_expected_status=403
) )
assert "not allowed to see this page" in page.h1.string.strip() assert "not allowed to see this page" in page.h1.string.strip()
@@ -815,7 +811,7 @@ def test_should_show_page_for_inviting_user_with_email_prefilled(
user_id=fake_uuid, user_id=fake_uuid,
# We have the user’s name in the H1 but don’t want it duplicated # We have the user’s name in the H1 but don’t want it duplicated
# in the page title # in the page title
_test_page_title=False _test_page_title=False,
) )
assert normalize_spaces(page.select_one("title").text).startswith( assert normalize_spaces(page.select_one("title").text).startswith(
"Invite a team member" "Invite a team member"
@@ -830,7 +826,7 @@ def test_should_show_page_if_prefilled_user_is_already_a_team_member(
mock_get_template_folders, mock_get_template_folders,
fake_uuid, fake_uuid,
active_user_with_permissions, active_user_with_permissions,
active_caseworking_user active_caseworking_user,
): ):
client_request.login(active_user_with_permissions) client_request.login(active_user_with_permissions)
mocker.patch( mocker.patch(