nesquena-hermes
8f3f6ea67a
santastabber: docs (README + EXTENSIONS.md) clarifying extension sidecar CSP behavior + test_issue1909_csp_enforcement / test_issue2901_csp_connect_extra assertions. Docs+tests only, no prod code. Co-authored-by: santastabber <santastabber@users.noreply.github.com>
98 lines
2.7 KiB
Python
98 lines
2.7 KiB
Python
"""Regression coverage for configurable CSP connect-src extras (#2901)."""
|
|
|
|
from __future__ import annotations
|
|
|
|
|
|
def test_csp_connect_src_default_header_unchanged(monkeypatch):
|
|
from server import Handler
|
|
|
|
monkeypatch.delenv("HERMES_WEBUI_CSP_CONNECT_EXTRA", raising=False)
|
|
|
|
policy = Handler.csp_report_only_policy()
|
|
expected = (
|
|
"connect-src 'self' http://127.0.0.1:* http://localhost:* "
|
|
"http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
|
|
"https://cdn.jsdelivr.net; "
|
|
)
|
|
|
|
assert expected in policy
|
|
|
|
|
|
def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
|
|
from server import Handler
|
|
|
|
monkeypatch.setenv(
|
|
"HERMES_WEBUI_CSP_CONNECT_EXTRA",
|
|
"https://metrics.example.com wss://events.example.com:443",
|
|
)
|
|
|
|
policy = Handler.csp_report_only_policy()
|
|
|
|
assert (
|
|
"connect-src 'self' http://127.0.0.1:* http://localhost:* "
|
|
"http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
|
|
"https://cdn.jsdelivr.net "
|
|
"https://metrics.example.com wss://events.example.com:443; "
|
|
) in policy
|
|
|
|
|
|
def test_csp_connect_src_includes_explicit_trusted_sidecar_origin(monkeypatch):
|
|
from server import Handler
|
|
|
|
monkeypatch.setenv(
|
|
"HERMES_WEBUI_CSP_CONNECT_EXTRA",
|
|
"http://127.0.0.1:17787 ws://127.0.0.1:17787",
|
|
)
|
|
|
|
report_only = Handler.csp_report_only_policy()
|
|
|
|
assert "http://127.0.0.1:17787" in report_only
|
|
assert "ws://127.0.0.1:17787" in report_only
|
|
|
|
from api.helpers import _build_csp_enforced_policy
|
|
|
|
enforced = _build_csp_enforced_policy()
|
|
assert "http://127.0.0.1:17787" in enforced
|
|
assert "ws://127.0.0.1:17787" in enforced
|
|
|
|
|
|
def test_csp_connect_src_rejects_directive_injection(monkeypatch, caplog):
|
|
from server import Handler
|
|
|
|
monkeypatch.setenv(
|
|
"HERMES_WEBUI_CSP_CONNECT_EXTRA",
|
|
"https://metrics.example.com; script-src *",
|
|
)
|
|
|
|
policy = Handler.csp_report_only_policy()
|
|
|
|
assert "https://metrics.example.com" not in policy
|
|
assert "script-src *" not in policy
|
|
assert "Ignoring invalid HERMES_WEBUI_CSP_CONNECT_EXTRA" in caplog.text
|
|
|
|
|
|
def test_csp_connect_src_rejects_paths(monkeypatch):
|
|
from server import Handler
|
|
|
|
monkeypatch.setenv(
|
|
"HERMES_WEBUI_CSP_CONNECT_EXTRA",
|
|
"https://metrics.example.com/api",
|
|
)
|
|
|
|
policy = Handler.csp_report_only_policy()
|
|
|
|
assert "https://metrics.example.com/api" not in policy
|
|
|
|
|
|
def test_csp_connect_src_rejects_invalid_ports(monkeypatch):
|
|
from server import Handler
|
|
|
|
monkeypatch.setenv(
|
|
"HERMES_WEBUI_CSP_CONNECT_EXTRA",
|
|
"https://metrics.example.com:99999",
|
|
)
|
|
|
|
policy = Handler.csp_report_only_policy()
|
|
|
|
assert "https://metrics.example.com:99999" not in policy
|