|
1
|
|
|
<?php |
|
2
|
|
|
|
|
3
|
|
|
namespace Signify\Tests; |
|
4
|
|
|
|
|
5
|
|
|
use SilverStripe\Dev\FunctionalTest; |
|
6
|
|
|
use SilverStripe\SiteConfig\SiteConfig; |
|
7
|
|
|
use Signify\Extensions\SecurityHeaderSiteconfigExtension; |
|
8
|
|
|
use Signify\Middleware\SecurityHeaderMiddleware; |
|
9
|
|
|
use SilverStripe\Control\Director; |
|
10
|
|
|
use SilverStripe\Versioned\Versioned; |
|
11
|
|
|
|
|
12
|
|
|
class SecurityHeaderSiteconfigExtensionTest extends FunctionalTest |
|
13
|
|
|
{ |
|
14
|
|
|
protected static $fixture_file = 'fixtures.yml'; |
|
15
|
|
|
|
|
16
|
|
|
public static function setUpBeforeClass(): void |
|
17
|
|
|
{ |
|
18
|
|
|
parent::setUpBeforeClass(); |
|
19
|
|
|
// Add extension. |
|
20
|
|
|
SiteConfig::add_extension(SecurityHeaderSiteconfigExtension::class); |
|
21
|
|
|
} |
|
22
|
|
|
|
|
23
|
|
|
public static function tearDownAfterClass(): void |
|
24
|
|
|
{ |
|
25
|
|
|
parent::tearDownAfterClass(); |
|
26
|
|
|
// Remove extension. |
|
27
|
|
|
SiteConfig::remove_extension(SecurityHeaderSiteconfigExtension::class); |
|
28
|
|
|
} |
|
29
|
|
|
|
|
30
|
|
|
public function testCSPisNotReportOnly() |
|
31
|
|
|
{ |
|
32
|
|
|
$response = $this->getResponse(); |
|
33
|
|
|
$csp = $response->getHeader('Content-Security-Policy'); |
|
34
|
|
|
$cspReportOnly = $response->getHeader('Content-Security-Policy-Report-Only'); |
|
35
|
|
|
|
|
36
|
|
|
$this->assertNotNull($csp, 'Test Content-Security-Policy header is present.'); |
|
37
|
|
|
$this->assertNull($cspReportOnly, 'Test Content-Security-Policy-Report-Only header is not present.'); |
|
38
|
|
|
} |
|
39
|
|
|
|
|
40
|
|
|
public function testCSPisReportOnly() |
|
41
|
|
|
{ |
|
42
|
|
|
$siteConfig = SiteConfig::current_site_config(); |
|
43
|
|
|
$siteConfig->CSPReportingOnly = true; |
|
44
|
|
|
$siteConfig->write(); |
|
45
|
|
|
$originalCSP = SecurityHeaderMiddleware::config()->get('headers')['global']['Content-Security-Policy']; |
|
46
|
|
|
$uri = Director::absoluteURL(SecurityHeaderMiddleware::config()->get('report_uri')); |
|
47
|
|
|
$originalCSP .= " report-uri $uri;"; |
|
48
|
|
|
|
|
49
|
|
|
$response = $this->getResponse(); |
|
50
|
|
|
$csp = $response->getHeader('Content-Security-Policy'); |
|
51
|
|
|
$cspReportOnly = $response->getHeader('Content-Security-Policy-Report-Only'); |
|
52
|
|
|
|
|
53
|
|
|
$this->assertNull($csp, 'Test Content-Security-Policy header is not present.'); |
|
54
|
|
|
$this->assertNotNull($cspReportOnly, 'Test Content-Security-Policy-Report-Only header is present.'); |
|
55
|
|
|
$this->assertEquals($originalCSP, $cspReportOnly, 'Test configured CSP is returned in the response.'); |
|
56
|
|
|
} |
|
57
|
|
|
|
|
58
|
|
|
protected function getResponse() |
|
59
|
|
|
{ |
|
60
|
|
|
$page = $this->objFromFixture('Page', 'page'); |
|
61
|
|
|
$page->copyVersionToStage(Versioned::DRAFT, Versioned::LIVE); |
|
62
|
|
|
return $this->get($page->Link()); |
|
63
|
|
|
} |
|
64
|
|
|
} |
|
65
|
|
|
|
signify-nz /
silverstripe-security-headers
