darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-07-10 03:14:58 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix header test

Browse Source
This commit is contained in:
Ryan Ahearn
2023-01-23 11:05:51 -05:00
parent fb0c3e99d9
commit 9615f9d0c2
2 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
app/__init__.py
View File

@@ -356,7 +356,8 @@ def useful_headers_after_request(response):
response.headers.add('X-XSS-Protection', '1; mode=block')
response.headers.add('Content-Security-Policy', (
"default-src 'self' {asset_domain} 'unsafe-inline';"
"script-src 'self' {asset_domain} *.google-analytics.com https://js-agent.newrelic.com https://*.nr-data.net 'unsafe-inline' 'unsafe-eval' data:;"
"script-src 'self' {asset_domain} *.google-analytics.com https://js-agent.newrelic.com https://*.nr-data.net "
"'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com https://*.nr-data.net;"
"object-src 'self';"
"font-src 'self' {asset_domain} data:;"

10
tests/app/main/views/test_headers.py
View File

@@ -13,8 +13,9 @@ def test_owasp_useful_headers_set(
assert response.headers['X-XSS-Protection'] == '1; mode=block'
assert response.headers['Content-Security-Policy'] == (
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com;"
"script-src 'self' static.example.com *.google-analytics.com https://js-agent.newrelic.com "
"https://*.nr-data.net 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com https://*.nr-data.net;"
"object-src 'self';"
"font-src 'self' static.example.com data:;"
"img-src "
@@ -43,8 +44,9 @@ def test_headers_non_ascii_characters_are_replaced(
assert response.headers['Content-Security-Policy'] == (
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com;"
"script-src 'self' static.example.com *.google-analytics.com https://js-agent.newrelic.com "
"https://*.nr-data.net 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com https://*.nr-data.net;"
"object-src 'self';"
"font-src 'self' static.example.com data:;"
"img-src"