public CspConfiguration(bool initializeDirectives = true)
{
if (!initializeDirectives)
{
return;
}
DefaultSrcDirective = new CspDirectiveConfiguration();
ScriptSrcDirective = new CspDirectiveConfiguration();
ObjectSrcDirective = new CspDirectiveConfiguration();
StyleSrcDirective = new CspDirectiveConfiguration();
ImgSrcDirective = new CspDirectiveConfiguration();
MediaSrcDirective = new CspDirectiveConfiguration();
FrameSrcDirective = new CspDirectiveConfiguration();
FontSrcDirective = new CspDirectiveConfiguration();
ConnectSrcDirective = new CspDirectiveConfiguration();
BaseUriDirective = new CspDirectiveConfiguration();
ChildSrcDirective = new CspDirectiveConfiguration();
FormActionDirective = new CspDirectiveConfiguration();
FrameAncestorsDirective = new CspDirectiveConfiguration();
ManifestSrcDirective = new CspDirectiveConfiguration();
PluginTypesDirective = new CspPluginTypesDirectiveConfiguration();
SandboxDirective = new CspSandboxDirectiveConfiguration();
UpgradeInsecureRequestsDirective = new CspUpgradeDirectiveConfiguration();
MixedContentDirective = new CspMixedContentDirectiveConfiguration();
ReportUriDirective = new CspReportUriDirectiveConfiguration();
}
public void GetCspSandboxConfigCloned_Configured_ClonesDirective()
{
var firstDirective = new CspSandboxDirectiveConfiguration
{
AllowForms = true,
AllowPointerLock = true,
AllowPopups = true
};
var firstConfig = new CspConfiguration(false)
{
SandboxDirective = firstDirective
};
var secondDirective = new CspSandboxDirectiveConfiguration()
{
AllowSameOrigin = true,
AllowScripts = true,
AllowTopNavigation = true,
Enabled = true
};
var secondConfig = new CspConfiguration(false)
{
SandboxDirective = secondDirective
};
var mapper = new CspConfigMapper();
var firstResult = mapper.GetCspSandboxConfigCloned(firstConfig);
var secondResult = mapper.GetCspSandboxConfigCloned(secondConfig);
Assert.That(firstResult, Is.EqualTo(firstDirective).Using(new CspSandboxDirectiveConfigurationComparer()));
Assert.That(secondResult, Is.EqualTo(secondDirective).Using(new CspSandboxDirectiveConfigurationComparer()));
}
public void GetCspSandboxConfigCloned_Configured_ClonesDirective()
{
var firstDirective = new CspSandboxDirectiveConfiguration
{
AllowForms = true,
AllowModals = true,
AllowOrientationLock = true,
AllowPointerLock = true,
AllowPopups = true
};
var firstConfig = new CspConfiguration(false)
{
SandboxDirective = firstDirective
};
var secondDirective = new CspSandboxDirectiveConfiguration()
{
AllowPopupsToEscapeSandbox = true,
AllowPresentation = true,
AllowSameOrigin = true,
AllowScripts = true,
AllowTopNavigation = true,
Enabled = true
};
var secondConfig = new CspConfiguration(false)
{
SandboxDirective = secondDirective
};
var mapper = new CspConfigMapper();
var firstResult = mapper.GetCspSandboxConfigCloned(firstConfig);
var secondResult = mapper.GetCspSandboxConfigCloned(secondConfig);
Assert.Equal(firstResult, firstDirective, new CspSandboxDirectiveConfigurationEqualityComparer());
Assert.Equal(secondResult, secondDirective, new CspSandboxDirectiveConfigurationEqualityComparer());
}
public CspConfiguration(bool initializeDirectives=true)
{
if (!initializeDirectives)
{
return;
}
DefaultSrcDirective = new CspDirectiveConfiguration();
ScriptSrcDirective = new CspDirectiveConfiguration();
ObjectSrcDirective = new CspDirectiveConfiguration();
StyleSrcDirective = new CspDirectiveConfiguration();
ImgSrcDirective = new CspDirectiveConfiguration();
MediaSrcDirective = new CspDirectiveConfiguration();
FrameSrcDirective = new CspDirectiveConfiguration();
FontSrcDirective = new CspDirectiveConfiguration();
ConnectSrcDirective = new CspDirectiveConfiguration();
BaseUriDirective = new CspDirectiveConfiguration();
ChildSrcDirective = new CspDirectiveConfiguration();
FormActionDirective = new CspDirectiveConfiguration();
FrameAncestorsDirective = new CspDirectiveConfiguration();
PluginTypesDirective = new CspPluginTypesDirectiveConfiguration();
SandboxDirective = new CspSandboxDirectiveConfiguration();
UpgradeInsecureRequestsDirective = new CspUpgradeDirectiveConfiguration();
ReportUriDirective = new CspReportUriDirectiveConfiguration();
}
public void GetOverridenCspSandboxConfig_AllowTopNavigationNotSet_InheritsAllowTopNavigation(bool expectedResult)
{
var directiveConfig = new CspSandboxDirectiveConfiguration {
AllowTopNavigation = expectedResult
};
var directiveOverride = new CspSandboxOverride();
var newConfig = _overrideHelper.GetOverridenCspSandboxConfig(directiveOverride, directiveConfig);
Assert.Equal(expectedResult, newConfig.AllowTopNavigation);
}
public void GetOverridenCspSandboxConfig_AllowScriptsNotSet_InheritsAllowScripts([Values(true, false)] bool expectedResult)
{
var directiveConfig = new CspSandboxDirectiveConfiguration {
AllowScripts = expectedResult
};
var directiveOverride = new CspSandboxOverride();
var newConfig = _overrideHelper.GetOverridenCspSandboxConfig(directiveOverride, directiveConfig);
Assert.AreEqual(expectedResult, newConfig.AllowScripts);
}
public void Equals_AllowPopupsDiffers_ReturnsFalse()
{
var firstConfig = new CspSandboxDirectiveConfiguration {
AllowPopups = false
};
var secondConfig = new CspSandboxDirectiveConfiguration {
AllowPopups = true
};
Assert.False(_equalityComparer.Equals(firstConfig, secondConfig));
Assert.False(_equalityComparer.Equals(secondConfig, firstConfig));
}
public void GetOverridenCspSandboxConfig_AllowScriptsOverride_OverridesAllowScripts(bool expectedResult)
{
var directiveConfig = new CspSandboxDirectiveConfiguration {
AllowScripts = !expectedResult
};
var directiveOverride = new CspSandboxOverride {
AllowScripts = expectedResult
};
var newConfig = _overrideHelper.GetOverridenCspSandboxConfig(directiveOverride, directiveConfig);
Assert.Equal(expectedResult, newConfig.AllowScripts);
}
public void GetOverridenCspSandboxConfig_EnableOverride_OverridesEnabled(bool expectedResult)
{
var directiveConfig = new CspSandboxDirectiveConfiguration {
Enabled = !expectedResult
};
var directiveOverride = new CspSandboxOverride {
Enabled = expectedResult
};
var newConfig = _overrideHelper.GetOverridenCspSandboxConfig(directiveOverride, directiveConfig);
Assert.Equal(expectedResult, newConfig.Enabled);
}
public void GetOverridenCspSandboxConfig_AllowTopNavigationOverride_OverridesAllowTopNavigation([Values(true, false)] bool expectedResult)
{
var directiveConfig = new CspSandboxDirectiveConfiguration {
AllowTopNavigation = !expectedResult
};
var directiveOverride = new CspSandboxOverride {
AllowTopNavigation = expectedResult
};
var newConfig = _overrideHelper.GetOverridenCspSandboxConfig(directiveOverride, directiveConfig);
Assert.AreEqual(expectedResult, newConfig.AllowTopNavigation);
}
public void SetCspSandboxOverride_HasOverride_OverridesExistingOverride([Values(false, true)] bool reportOnly)
{
//There's an override for directive
var currentDirectiveOverride = new CspSandboxDirectiveConfiguration();
var overrideConfig = new CspOverrideConfiguration {
SandboxDirective = currentDirectiveOverride
};
_contextHelper.Setup(h => h.GetCspConfigurationOverride(It.IsAny <HttpContextBase>(), reportOnly, false)).Returns(overrideConfig);
//We need an override and a result.
var directiveOverride = new CspSandboxOverride();
var directiveOverrideResult = new CspSandboxDirectiveConfiguration();
_directiveOverrideHelper.Setup(h => h.GetOverridenCspSandboxConfig(directiveOverride, currentDirectiveOverride)).Returns(directiveOverrideResult);
CspConfigurationOverrideHelper.SetCspSandboxOverride(MockContext, directiveOverride, reportOnly);
//Verify that the override result was set on the override config.
Assert.AreSame(directiveOverrideResult, overrideConfig.SandboxDirective);
}
public void SetCspSandboxOverride_NoCurrentOverride_ClonesConfigFromContextAndOverrides([Values(false, true)] bool reportOnly)
{
var contextConfig = new CspConfiguration();
var overrideConfig = new CspOverrideConfiguration();
//Returns CSP config from context
_contextHelper.Setup(h => h.GetCspConfiguration(It.IsAny <HttpContextBase>(), reportOnly)).Returns(contextConfig);
_contextHelper.Setup(h => h.GetCspConfigurationOverride(It.IsAny <HttpContextBase>(), reportOnly, false)).Returns(overrideConfig);
//Returns cloned directive config from context config
var clonedContextDirective = new CspSandboxDirectiveConfiguration();
_directiveConfigMapper.Setup(m => m.GetCspSandboxConfigCloned(contextConfig)).Returns(clonedContextDirective);
//We need an override and a result.
var directiveOverride = new CspSandboxOverride();
var directiveOverrideResult = new CspSandboxDirectiveConfiguration();
_directiveOverrideHelper.Setup(h => h.GetOverridenCspSandboxConfig(directiveOverride, clonedContextDirective)).Returns(directiveOverrideResult);
CspConfigurationOverrideHelper.SetCspSandboxOverride(MockContext, directiveOverride, reportOnly);
//Verify that the override result was set on the override config.
Assert.AreSame(directiveOverrideResult, overrideConfig.SandboxDirective);
}
