Skip to content

Commit 489d201

Browse files
patel-vanshpatel-vansh
committed
Added tests
1 parent 19380aa commit 489d201

File tree

2 files changed

+139
-0
lines changed

2 files changed

+139
-0
lines changed

‎tests/system/HTTP/ContentSecurityPolicyTest.php‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -937,4 +937,67 @@ public function testClearDirective(): void
937937
$this->assertNotContains('report-uri http://example.com/csp/reports', $directives);
938938
$this->assertNotContains('report-to default', $directives);
939939
}
940+
941+
public function testClearNoncePlaceholdersWithDefaultTags(): void
942+
{
943+
$config = new CSPConfig();
944+
$csp = new ContentSecurityPolicy($config);
945+
946+
$body = 'Test {csp-script-nonce} and {csp-style-nonce} here';
947+
$cleaned = $csp->clearNoncePlaceholders($body);
948+
949+
$this->assertSame('Test and here', $cleaned);
950+
$this->assertStringNotContainsString('{csp-script-nonce}', $cleaned);
951+
$this->assertStringNotContainsString('{csp-style-nonce}', $cleaned);
952+
}
953+
954+
public function testClearNoncePlaceholdersWithCustomTags(): void
955+
{
956+
$config = new CSPConfig();
957+
$config->scriptNonceTag = '{custom-script-nonce}';
958+
$config->styleNonceTag = '{custom-style-nonce}';
959+
$csp = new ContentSecurityPolicy($config);
960+
961+
$body = 'Test {custom-script-nonce} and {custom-style-nonce} here';
962+
$cleaned = $csp->clearNoncePlaceholders($body);
963+
964+
$this->assertSame('Test and here', $cleaned);
965+
$this->assertStringNotContainsString('{custom-script-nonce}', $cleaned);
966+
$this->assertStringNotContainsString('{custom-style-nonce}', $cleaned);
967+
}
968+
969+
public function testClearNoncePlaceholdersWithEmptyBody(): void
970+
{
971+
$config = new CSPConfig();
972+
$csp = new ContentSecurityPolicy($config);
973+
974+
$body = '';
975+
$cleaned = $csp->clearNoncePlaceholders($body);
976+
977+
$this->assertSame('', $cleaned);
978+
}
979+
980+
public function testClearNoncePlaceholdersWithNoPlaceholders(): void
981+
{
982+
$config = new CSPConfig();
983+
$csp = new ContentSecurityPolicy($config);
984+
985+
$body = 'Test body with no placeholders';
986+
$cleaned = $csp->clearNoncePlaceholders($body);
987+
988+
$this->assertSame($body, $cleaned);
989+
}
990+
991+
public function testClearNoncePlaceholdersWithMultiplePlaceholders(): void
992+
{
993+
$config = new CSPConfig();
994+
$csp = new ContentSecurityPolicy($config);
995+
996+
$body = '<script {csp-script-nonce}>a</script><script {csp-script-nonce}>b</script><style {csp-style-nonce}>c</style>';
997+
$cleaned = $csp->clearNoncePlaceholders($body);
998+
999+
$this->assertStringNotContainsString('{csp-script-nonce}', $cleaned);
1000+
$this->assertStringNotContainsString('{csp-style-nonce}', $cleaned);
1001+
$this->assertSame('<script >a</script><script >b</script><style >c</style>', $cleaned);
1002+
}
9401003
}

‎tests/system/HTTP/ResponseTest.php‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -577,4 +577,80 @@ public function testPretendOutput(): void
577577

578578
$this->assertSame('Happy days', $actual);
579579
}
580+
581+
public function testSendRemovesDefaultNoncePlaceholdersWhenCSPDisabled(): void
582+
{
583+
$config = new App();
584+
$config->CSPEnabled = false;
585+
586+
$response = new Response($config);
587+
$response->pretend(true);
588+
589+
$body = '<html><script {csp-script-nonce}>console.log("test")</script><style {csp-style-nonce}>.test{}</style></html>';
590+
$response->setBody($body);
591+
592+
ob_start();
593+
$response->send();
594+
$actual = ob_get_contents();
595+
ob_end_clean();
596+
597+
// Nonce placeholders should be removed when CSP is disabled
598+
$this->assertStringNotContainsString('{csp-script-nonce}', $actual);
599+
$this->assertStringNotContainsString('{csp-style-nonce}', $actual);
600+
$this->assertStringContainsString('<script >console.log("test")</script>', $actual);
601+
$this->assertStringContainsString('<style >.test{}</style>', $actual);
602+
}
603+
604+
public function testSendRemovesCustomNoncePlaceholdersWhenCSPDisabled(): void
605+
{
606+
$appConfig = new App();
607+
$appConfig->CSPEnabled = false;
608+
609+
// Create custom CSP config with custom nonce tags
610+
$cspConfig = new \Config\ContentSecurityPolicy();
611+
$cspConfig->scriptNonceTag = '{custom-script-tag}';
612+
$cspConfig->styleNonceTag = '{custom-style-tag}';
613+
614+
$response = new Response($appConfig);
615+
$response->pretend(true);
616+
617+
// Inject the custom CSP config
618+
$reflection = new \ReflectionClass($response);
619+
$cspProperty = $reflection->getProperty('CSP');
620+
$cspProperty->setValue($response, new ContentSecurityPolicy($cspConfig));
621+
622+
$body = '<html><script {custom-script-tag}>test()</script><style {custom-style-tag}>.x{}</style></html>';
623+
$response->setBody($body);
624+
625+
ob_start();
626+
$response->send();
627+
$actual = ob_get_contents();
628+
ob_end_clean();
629+
630+
// Custom nonce placeholders should be removed when CSP is disabled
631+
$this->assertStringNotContainsString('{custom-script-tag}', $actual);
632+
$this->assertStringNotContainsString('{custom-style-tag}', $actual);
633+
$this->assertStringContainsString('<script >test()</script>', $actual);
634+
$this->assertStringContainsString('<style >.x{}</style>', $actual);
635+
}
636+
637+
public function testSendWithCSPDisabledDoesNotAffectBodyWithoutNonceTags(): void
638+
{
639+
$config = new App();
640+
$config->CSPEnabled = false;
641+
642+
$response = new Response($config);
643+
$response->pretend(true);
644+
645+
$body = '<html><script>console.log("test")</script></html>';
646+
$response->setBody($body);
647+
648+
ob_start();
649+
$response->send();
650+
$actual = ob_get_contents();
651+
ob_end_clean();
652+
653+
// Body without nonce tags should remain unchanged
654+
$this->assertSame($body, $actual);
655+
}
580656
}

0 commit comments

Comments
 (0)