license fileoverview author lwe google import 'jasmine' ; import { Finding , Severity } from '../finding' ; import { CspParser } from '../parser' ; import { CheckerFunction } from './checker' ; import * as parserChecks from './parser_checks' ; param test param checkFunction function checkCsp ( test , checkFunction ) { const parsedCsp = ( new CspParser ( test ) ) . csp ; return checkFunction ( parsedCsp ) ; } describe ( 'Test parser checks' , ( ) => { /** Tests for csp.parserChecks.checkUnknownDirective */ it ( 'CheckUnknownDirective' , ( ) => { const test = 'foobar-src http:' ; const violations = checkCsp ( test , parserChecks . checkUnknownDirective ) ; expect ( violations . length ) . toBe ( 1 ) ; expect ( violations [ 0 ] . severity ) . toBe ( Severity . SYNTAX ) ; expect ( violations [ 0 ] . directive ) . toBe ( 'foobar-src' ) ; } ) ; /** Tests for csp.parserChecks.checkMissingSemicolon */ it ( 'CheckMissingSemicolon' , ( ) => { const test = 'default-src foo.bar script-src \'none\'' ; const violations = checkCsp ( test , parserChecks . checkMissingSemicolon ) ; expect ( violations . length ) . toBe ( 1 ) ; expect ( violations [ 0 ] . severity ) . toBe ( Severity . SYNTAX ) ; expect ( violations [ 0 ] . value ) . toBe ( 'script-src' ) ; } ) ; /** Tests for csp.parserChecks.checkInvalidKeyword */ it ( 'CheckInvalidKeywordForgottenSingleTicks' , ( ) => { const test = 'script-src strict-dynamic nonce-test sha256-asdf' ; const violations = checkCsp ( test , parserChecks . checkInvalidKeyword ) ; expect ( violations . length ) . toBe ( 3 ) ; expect ( violations . every ( ( v ) => v . severity === Severity . SYNTAX ) ) . toBeTrue ( ) ; expect ( violations . every ( ( v ) => v . description . includes ( 'single-ticks' ) ) ) . toBeTrue ( ) ; } ) ; it ( 'CheckInvalidKeywordUnknownKeyword' , ( ) => { const test = 'script-src \'foo-bar\'' ; const violations = checkCsp ( test , parserChecks . checkInvalidKeyword ) ; expect ( violations . length ) . toBe ( 1 ) ; expect ( violations [ 0 ] . severity ) . toBe ( Severity . SYNTAX ) ; expect ( violations [ 0 ] . value ) . toBe ( '\'foo-bar\'' ) ; } ) ; it ( 'CheckInvalidKeywordAllowsRequireTrustedTypesForScript' , ( ) => { const test = 'require-trusted-types-for \'script\'' ; const violations = checkCsp ( test , parserChecks . checkInvalidKeyword ) ; expect ( violations . length ) . toBe ( 0 ) ; } ) ; it ( 'CheckInvalidKeywordAllowsTrustedTypesAllowDuplicateKeyword' , ( ) => { const test = 'trusted-types \'allow-duplicates\' policy1' ; const violations = checkCsp ( test , parserChecks . checkInvalidKeyword ) ; expect ( violations . length ) . toBe ( 0 ) ; } ) ; } ) ;