~cytrogen/masto-fe

ref: 7581b1ff9664b90d1ba2cd75e7e332cc5bab4d36 masto-fe/spec/requests/content_security_policy_spec.rb -rw-r--r-- 1.1 KiB
7581b1ff — Matt Jankowski Profiling tools configuration improvement (#25383) 2 years ago 
                                                                                
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27

# frozen_string_literal: true

require 'rails_helper'

describe 'Content-Security-Policy' do
  it 'sets the expected CSP headers' do
    allow(SecureRandom).to receive(:base64).with(16).and_return('ZbA+JmE7+bK8F5qvADZHuQ==')

    get '/'
    expect(response.headers['Content-Security-Policy'].split(';').map(&:strip)).to contain_exactly(
      "base-uri 'none'",
      "default-src 'none'",
      "frame-ancestors 'none'",
      "font-src 'self' https://cb6e6126.ngrok.io",
      "img-src 'self' https: data: blob: https://cb6e6126.ngrok.io",
      "style-src 'self' https://cb6e6126.ngrok.io 'nonce-ZbA+JmE7+bK8F5qvADZHuQ=='",
      "media-src 'self' https: data: https://cb6e6126.ngrok.io",
      "frame-src 'self' https:",
      "manifest-src 'self' https://cb6e6126.ngrok.io",
      "form-action 'self'",
      "child-src 'self' blob: https://cb6e6126.ngrok.io",
      "worker-src 'self' blob: https://cb6e6126.ngrok.io",
      "connect-src 'self' data: blob: https://cb6e6126.ngrok.io https://cb6e6126.ngrok.io ws://localhost:4000",
      "script-src 'self' https://cb6e6126.ngrok.io 'wasm-unsafe-eval'"
    )
  end
end