mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-06-08 07:21:13 -04:00
7e707db4b2
We have a `client_request` fixture which does a bunch of useful stuff
like:
- checking the status code of the response
- returning a `BeautifulSoup` object
Lots of our tests still use an older fixture called `client`. This is
not as good because it:
- returns a raw `Response` object
- doesn’t do the additional checks
- means our tests contain a lot of repetetive boilerplate like `page = BeautifulSoup(response.data.decode('utf-8'), 'html.parser')`
This commit converts all the tests which had a `client.get(…)` or
`client.post(…)` statement to use their equivalents on `client_request`
instead.
Subsequent commits will remove uses of `client` in other tests, but
doing it this way means the work can be broken up into more manageable
chunks.
54 lines
2.1 KiB
Python
54 lines
2.1 KiB
Python
|
|
|
|
def test_owasp_useful_headers_set(
|
|
client_request,
|
|
mocker,
|
|
mock_get_service_and_organisation_counts,
|
|
):
|
|
client_request.logout()
|
|
mocker.patch('app.get_logo_cdn_domain', return_value='static-logos.test.com')
|
|
|
|
response = client_request.get_response('.index')
|
|
|
|
assert response.headers['X-Frame-Options'] == 'deny'
|
|
assert response.headers['X-Content-Type-Options'] == 'nosniff'
|
|
assert response.headers['X-XSS-Protection'] == '1; mode=block'
|
|
assert response.headers['Content-Security-Policy'] == (
|
|
"default-src 'self' static.example.com 'unsafe-inline';"
|
|
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
|
|
"connect-src 'self' *.google-analytics.com;"
|
|
"object-src 'self';"
|
|
"font-src 'self' static.example.com data:;"
|
|
"img-src "
|
|
"'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
|
|
" *.notifications.service.gov.uk static-logos.test.com data:;"
|
|
"frame-src 'self' www.youtube-nocookie.com;"
|
|
)
|
|
assert response.headers['Link'] == (
|
|
'<https://static.example.com>; rel=dns-prefetch, '
|
|
'<https://static.example.com>; rel=preconnect'
|
|
)
|
|
|
|
|
|
def test_headers_non_ascii_characters_are_replaced(
|
|
client_request,
|
|
mocker,
|
|
mock_get_service_and_organisation_counts,
|
|
):
|
|
client_request.logout()
|
|
mocker.patch('app.get_logo_cdn_domain', return_value='static-logos۾.test.com')
|
|
|
|
response = client_request.get_response('.index')
|
|
|
|
assert response.headers['Content-Security-Policy'] == (
|
|
"default-src 'self' static.example.com 'unsafe-inline';"
|
|
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
|
|
"connect-src 'self' *.google-analytics.com;"
|
|
"object-src 'self';"
|
|
"font-src 'self' static.example.com data:;"
|
|
"img-src"
|
|
" 'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
|
|
" *.notifications.service.gov.uk static-logos??.test.com data:;"
|
|
"frame-src 'self' www.youtube-nocookie.com;"
|
|
)
|