darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-14 23:08:07 -04:00
Code Issues Packages Projects Releases Wiki Activity

Add flask-talisman for security headers

Browse Source
This commit is contained in:
Ryan Ahearn
2023-03-07 14:56:31 -05:00
parent 218f0d0c85
commit e8e8c889d6
6 changed files with 324 additions and 362 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
tests/app/main/views/test_headers.py
View File

@@ -12,45 +12,12 @@ def test_owasp_useful_headers_set(
assert response.headers['X-Content-Type-Options'] == 'nosniff'
assert response.headers['X-XSS-Protection'] == '1; mode=block'
assert response.headers['Content-Security-Policy'] == (
"default-src 'self' static.example.com 'unsafe-inline';"
"default-src 'self' static.example.com; "
"script-src 'self' static.example.com *.google-analytics.com https://js-agent.newrelic.com "
"https://*.nr-data.net 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com https://*.nr-data.net;"
"object-src 'self';"
"font-src 'self' static.example.com data:;"
"https://*.nr-data.net data:; "
"connect-src 'self' *.google-analytics.com https://*.nr-data.net; "
"font-src 'self' static.example.com data:; "
"img-src "
"'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
" *.notifications.service.gov.uk static-logos.test.com data:;"
"frame-src 'self' www.youtube-nocookie.com;"
)
assert response.headers['Link'] == (
'<https://static.example.com>; rel=dns-prefetch, '
'<https://static.example.com>; rel=preconnect'
)
def test_headers_non_ascii_characters_are_replaced(
client_request,
mocker,
mock_get_service_and_organisation_counts,
):
client_request.logout()
mocker.patch.dict(
'app.current_app.config',
values={'LOGO_CDN_DOMAIN': 'static-logos۾.test.com'},
)
response = client_request.get_response('.index')
assert response.headers['Content-Security-Policy'] == (
"default-src 'self' static.example.com 'unsafe-inline';"
"script-src 'self' static.example.com *.google-analytics.com https://js-agent.newrelic.com "
"https://*.nr-data.net 'unsafe-inline' 'unsafe-eval' data:;"
"connect-src 'self' *.google-analytics.com https://*.nr-data.net;"
"object-src 'self';"
"font-src 'self' static.example.com data:;"
"img-src"
" 'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
" *.notifications.service.gov.uk static-logos??.test.com data:;"
"frame-src 'self' www.youtube-nocookie.com;"
"'self' static.example.com static-logos.test.com"
" *.google-analytics.com data:"
)