nesquena-hermes
bc6949219d
Phase-3-LOW backend security fix. #3727 (@rodboev, #1909): enforced CSP now honors the same connect-src as report-only (built from one shared template). Full suite 8205 passed, Codex SAFE (live-verified headers), Opus SHIP. Co-authored-by: rodboev <rodboev@users.noreply.github.com>
38 lines
1.6 KiB
Python
38 lines
1.6 KiB
Python
"""Regression test for #1850 — CSP connect-src must allow cdn.jsdelivr.net.
|
|
|
|
xterm.js, xterm-addon-fit, and xterm-addon-web-links are loaded from
|
|
cdn.jsdelivr.net via <script> tags. Their bundled source maps also live on
|
|
jsDelivr and are fetched via connect (not script load), so connect-src must
|
|
include cdn.jsdelivr.net or browsers block the fetch and emit CSP violations.
|
|
"""
|
|
import re
|
|
|
|
from api.helpers import _build_csp_enforced_policy
|
|
|
|
|
|
def _policy() -> str:
|
|
return _build_csp_enforced_policy("")
|
|
|
|
|
|
class TestCSPConnectSrcJsdelivr:
|
|
"""connect-src must allow cdn.jsdelivr.net for xterm source map fetches."""
|
|
|
|
def test_connect_src_includes_jsdelivr(self):
|
|
"""connect-src must include https://cdn.jsdelivr.net."""
|
|
policy = _policy()
|
|
connect_match = re.search(r"connect-src\s+([^;]+);", policy)
|
|
assert connect_match, "connect-src directive must exist in CSP"
|
|
assert "https://cdn.jsdelivr.net" in connect_match.group(1), (
|
|
"connect-src must allow cdn.jsdelivr.net — xterm.js source maps are "
|
|
"fetched from that origin and the CSP blocks them without this entry"
|
|
)
|
|
|
|
def test_connect_src_still_includes_self(self):
|
|
"""connect-src must still include 'self' alongside the new jsdelivr entry."""
|
|
policy = _policy()
|
|
connect_match = re.search(r"connect-src\s+([^;]+);", policy)
|
|
assert connect_match, "connect-src directive must exist in CSP"
|
|
assert "'self'" in connect_match.group(1), (
|
|
"connect-src must retain 'self' after adding cdn.jsdelivr.net"
|
|
)
|