FilesExpand file tree

 master

/

SecurityHeaderTest.php

Copy path

Blame

More file actions

Blame

More file actions

Latest commit

 

History

History

History

133 lines (110 loc) · 4.48 KB

 master

/

SecurityHeaderTest.php

Copy path

Top

File metadata and controls

• Code
• Blame

133 lines (110 loc) · 4.48 KB

Raw

Copy raw file

Download raw file

Open symbols panel

Edit and raw actions

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

<?php

namespace Tests;

use BookStack\Util\CspService;

class SecurityHeaderTest extends TestCase

{

public function test_cookies_samesite_lax_by_default()

{

$resp = $this->get('/');

foreach ($resp->headers->getCookies() as $cookie) {

$this->assertEquals('lax', $cookie->getSameSite());

}

}

public function test_cookies_samesite_none_when_iframe_hosts_set()

{

$this->runWithEnv('ALLOWED_IFRAME_HOSTS', 'http://example.com', function () {

$resp = $this->get('/');

foreach ($resp->headers->getCookies() as $cookie) {

$this->assertEquals('none', $cookie->getSameSite());

}

});

}

public function test_secure_cookies_controlled_by_app_url()

{

$this->runWithEnv('APP_URL', 'http://example.com', function () {

$resp = $this->get('/');

foreach ($resp->headers->getCookies() as $cookie) {

$this->assertFalse($cookie->isSecure());

}

});

$this->runWithEnv('APP_URL', 'https://example.com', function () {

$resp = $this->get('/');

foreach ($resp->headers->getCookies() as $cookie) {

$this->assertTrue($cookie->isSecure());

}

});

}

public function test_iframe_csp_self_only_by_default()

{

$resp = $this->get('/');

$frameHeader = $this->getCspHeader($resp, 'frame-ancestors');

$this->assertEquals('frame-ancestors \'self\'', $frameHeader);

}

public function test_iframe_csp_includes_extra_hosts_if_configured()

{

$this->runWithEnv('ALLOWED_IFRAME_HOSTS', 'https://a.example.com https://b.example.com', function () {

$resp = $this->get('/');

$frameHeader = $this->getCspHeader($resp, 'frame-ancestors');

$this->assertNotEmpty($frameHeader);

$this->assertEquals('frame-ancestors \'self\' https://a.example.com https://b.example.com', $frameHeader);

});

}

public function test_script_csp_set_on_responses()

{

$resp = $this->get('/');

$scriptHeader = $this->getCspHeader($resp, 'script-src');

$this->assertStringContainsString('\'strict-dynamic\'', $scriptHeader);

$this->assertStringContainsString('\'nonce-', $scriptHeader);

}

public function test_script_csp_nonce_matches_nonce_used_in_custom_head()

{

$this->setSettings(['app-custom-head' => '<script>console.log("cat");</script>']);

$resp = $this->get('/login');

$scriptHeader = $this->getCspHeader($resp, 'script-src');

$nonce = app()->make(CspService::class)->getNonce();

$this->assertStringContainsString('nonce-' . $nonce, $scriptHeader);

$resp->assertSee('<script nonce="' . $nonce . '">console.log("cat");</script>');

}

public function test_script_csp_nonce_changes_per_request()

{

$resp = $this->get('/');

$firstHeader = $this->getCspHeader($resp, 'script-src');

$this->refreshApplication();

$resp = $this->get('/');

$secondHeader = $this->getCspHeader($resp, 'script-src');

$this->assertNotEquals($firstHeader, $secondHeader);

}

public function test_allow_content_scripts_settings_controls_csp_script_headers()

{

config()->set('app.allow_content_scripts', true);

$resp = $this->get('/');

$scriptHeader = $this->getCspHeader($resp, 'script-src');

$this->assertEmpty($scriptHeader);

config()->set('app.allow_content_scripts', false);

$resp = $this->get('/');

$scriptHeader = $this->getCspHeader($resp, 'script-src');

$this->assertNotEmpty($scriptHeader);

}

public function test_object_src_csp_header_set()

{

$resp = $this->get('/');

$scriptHeader = $this->getCspHeader($resp, 'object-src');

$this->assertEquals('object-src \'self\'', $scriptHeader);

}

public function test_base_uri_csp_header_set()

{

$resp = $this->get('/');

$scriptHeader = $this->getCspHeader($resp, 'base-uri');

$this->assertEquals('base-uri \'self\'', $scriptHeader);

}

/**

* Get the value of the first CSP header of the given type.

*/

protected function getCspHeader(TestResponse $resp, string $type): string

{

$cspHeaders = collect($resp->headers->all('Content-Security-Policy'));

return $cspHeaders->filter(function ($val) use ($type) {

return strpos($val, $type) === 0;

})->first() ?? '';

}

}