sandrodachandClaude Opus 5.5
b2ecda9896
MindSift CI & Docker Release / Build, Test in Container & Push (push) Successful in 1m48s
safeHref lets only http, https and mailto become links (Markdown viewer, outliner, legal links); javascript: and friends show as text. A middleware sets a Content-Security-Policy (scripts only from MindSift, no framing, connections only to this server), X-Frame-Options, nosniff, Referrer-Policy and a Permissions-Policy. The two inline scripts of index.html moved to files so script-src stays 'self'. The second inline script also deleted every cache on each page load, which undermined the offline start; it is gone. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
35 lines
1.2 KiB
Go
35 lines
1.2 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestSecurityHeaders(t *testing.T) {
|
|
srv, _, _ := setupTestServer(t)
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/api/v1/health", nil)
|
|
req.Host = "notes.example.com"
|
|
srv.Router().ServeHTTP(rec, req)
|
|
csp := rec.Header().Get("Content-Security-Policy")
|
|
for _, want := range []string{"script-src 'self'", "frame-ancestors 'none'", "object-src 'none'", "wss://notes.example.com"} {
|
|
if !strings.Contains(csp, want) {
|
|
t.Errorf("CSP lacks %q: %s", want, csp)
|
|
}
|
|
}
|
|
if strings.Contains(csp, "unsafe-eval") || strings.Contains(strings.Split(strings.Split(csp, "script-src")[1], ";")[0], "unsafe-inline") {
|
|
t.Errorf("scripts must not allow inline or eval: %s", csp)
|
|
}
|
|
for k, v := range map[string]string{"X-Frame-Options": "DENY", "X-Content-Type-Options": "nosniff", "Referrer-Policy": "same-origin"} {
|
|
if rec.Header().Get(k) != v {
|
|
t.Errorf("%s = %q, want %q", k, rec.Header().Get(k), v)
|
|
}
|
|
}
|
|
// A Host header with quotes or semicolons must not be able to extend the policy
|
|
if p := contentSecurityPolicy("evil.com; script-src *"); strings.Contains(p, "evil.com") {
|
|
t.Errorf("host must not be copied into the policy unchecked: %s", p)
|
|
}
|
|
}
|