license fileoverview author lwe google import { Finding , Severity } from '../finding' ; import { CspParser } from '../parser' ; import { CheckerFunction } from './checker' ; import * as strictcspChecks from './strictcsp_checks' ; param test param checkFunction function checkCsp ( test , checkFunction ) { const parsedCsp = ( new CspParser ( test ) ) . csp ; return checkFunction ( parsedCsp ) ; } describe ( 'Test strictcsp checks' , ( ) => { /** Tests for csp.strictcspChecks.checkStrictDynamic */ it ( 'CheckStrictDynamic' , ( ) => { const test = 'script-src foo.bar' ; const violations = checkCsp ( test , strictcspChecks . checkStrictDynamic ) ; expect ( violations . length ) . toBe ( 1 ) ; expect ( violations [ 0 ] . severity ) . toBe ( Severity . STRICT_CSP ) ; } ) ; /** Tests for csp.strictcspChecks.checkStrictDynamicNotStandalone */ it ( 'CheckStrictDynamicNotStandalone' , ( ) => { const test = 'script-src \'strict-dynamic\'' ; const violations = checkCsp ( test , strictcspChecks . checkStrictDynamicNotStandalone ) ; expect ( violations [ 0 ] . severity ) . toBe ( Severity . INFO ) ; } ) ; it ( 'CheckStrictDynamicNotStandaloneDoesntFireIfNoncePresent' , ( ) => { const test = 'script-src \'strict-dynamic\' \'nonce-foobar\'' ; const violations = checkCsp ( test , strictcspChecks . checkStrictDynamicNotStandalone ) ; expect ( violations . length ) . toBe ( 0 ) ; } ) ; /** Tests for csp.strictcspChecks.checkUnsafeInlineFallback */ it ( 'CheckUnsafeInlineFallback' , ( ) => { const test = 'script-src \'nonce-test\'' ; const violations = checkCsp ( test , strictcspChecks . checkUnsafeInlineFallback ) ; expect ( violations . length ) . toBe ( 1 ) ; expect ( violations [ 0 ] . severity ) . toBe ( Severity . STRICT_CSP ) ; } ) ; it ( 'CheckUnsafeInlineFallbackDoesntFireIfFallbackPresent' , ( ) => { const test = 'script-src \'nonce-test\' \'unsafe-inline\'' ; const violations = checkCsp ( test , strictcspChecks . checkUnsafeInlineFallback ) ; expect ( violations . length ) . toBe ( 0 ) ; } ) ; /** Tests for csp.strictcspChecks.checkAllowlistFallback */ it ( 'checkAllowlistFallback' , ( ) => { const test = 'script-src \'nonce-test\' \'strict-dynamic\'' ; const violations = checkCsp ( test , strictcspChecks . checkAllowlistFallback ) ; expect ( violations . length ) . toBe ( 1 ) ; expect ( violations [ 0 ] . severity ) . toBe ( Severity . STRICT_CSP ) ; } ) ; it ( 'checkAllowlistFallbackDoesntFireIfSchemeFallbackPresent' , ( ) => { const test = 'script-src \'nonce-test\' \'strict-dynamic\' https:' ; const violations = checkCsp ( test , strictcspChecks . checkAllowlistFallback ) ; expect ( violations . length ) . toBe ( 0 ) ; } ) ; it ( 'checkAllowlistFallbackDoesntFireIfURLFallbackPresent' , ( ) => { const test = 'script-src \'nonce-test\' \'strict-dynamic\' foo.bar' ; const violations = checkCsp ( test , strictcspChecks . checkAllowlistFallback ) ; expect ( violations . length ) . toBe ( 0 ) ; } ) ; it ( 'checkAllowlistFallbackDoesntFireInAbsenceOfStrictDynamic' , ( ) => { const test = 'script-src \'nonce-test\'' ; const violations = checkCsp ( test , strictcspChecks . checkAllowlistFallback ) ; expect ( violations . length ) . toBe ( 0 ) ; } ) ; } ) ;