mirror of
https://github.com/GSA/notifications-admin.git
synced 2026-02-13 06:54:20 -05:00
4f672cb5dc
Having this as a function which does string parsing and manipulation surprised me a bit when I was trying to figure out why something wasn’t working. It’s more in line with the way we do other config like this (for example `ASSET_PATH`) to make it a simple config variable, rather than trying to be clever and guess things based on other config variables. It’s also less code, and is explicit enough that it doesn’t need tests.
55 lines
2.0 KiB
Python
55 lines
2.0 KiB
Python
|
|
|
|
def test_owasp_useful_headers_set(
|
|
client_request,
|
|
mocker,
|
|
mock_get_service_and_organisation_counts,
|
|
):
|
|
client_request.logout()
|
|
response = client_request.get_response('.index')
|
|
|
|
assert response.headers['X-Frame-Options'] == 'deny'
|
|
assert response.headers['X-Content-Type-Options'] == 'nosniff'
|
|
assert response.headers['X-XSS-Protection'] == '1; mode=block'
|
|
assert response.headers['Content-Security-Policy'] == (
|
|
"default-src 'self' static.example.com 'unsafe-inline';"
|
|
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
|
|
"connect-src 'self' *.google-analytics.com;"
|
|
"object-src 'self';"
|
|
"font-src 'self' static.example.com data:;"
|
|
"img-src "
|
|
"'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
|
|
" *.notifications.service.gov.uk static-logos.test.com data:;"
|
|
"frame-src 'self' www.youtube-nocookie.com;"
|
|
)
|
|
assert response.headers['Link'] == (
|
|
'<https://static.example.com>; rel=dns-prefetch, '
|
|
'<https://static.example.com>; rel=preconnect'
|
|
)
|
|
|
|
|
|
def test_headers_non_ascii_characters_are_replaced(
|
|
client_request,
|
|
mocker,
|
|
mock_get_service_and_organisation_counts,
|
|
):
|
|
client_request.logout()
|
|
mocker.patch.dict(
|
|
'app.current_app.config',
|
|
values={'LOGO_CDN_DOMAIN': 'static-logos۾.test.com'},
|
|
)
|
|
|
|
response = client_request.get_response('.index')
|
|
|
|
assert response.headers['Content-Security-Policy'] == (
|
|
"default-src 'self' static.example.com 'unsafe-inline';"
|
|
"script-src 'self' static.example.com *.google-analytics.com 'unsafe-inline' 'unsafe-eval' data:;"
|
|
"connect-src 'self' *.google-analytics.com;"
|
|
"object-src 'self';"
|
|
"font-src 'self' static.example.com data:;"
|
|
"img-src"
|
|
" 'self' static.example.com *.tile.openstreetmap.org *.google-analytics.com"
|
|
" *.notifications.service.gov.uk static-logos??.test.com data:;"
|
|
"frame-src 'self' www.youtube-nocookie.com;"
|
|
)
|