You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@couchdb.apache.org by ch...@apache.org on 2014/08/11 22:20:13 UTC
[41/50] couch commit: updated refs/heads/1963-eunit-bigcouch to
6845303
Port 232-csp.t etap test suite to eunit
Project: http://git-wip-us.apache.org/repos/asf/couchdb-couch/repo
Commit: http://git-wip-us.apache.org/repos/asf/couchdb-couch/commit/3d277764
Tree: http://git-wip-us.apache.org/repos/asf/couchdb-couch/tree/3d277764
Diff: http://git-wip-us.apache.org/repos/asf/couchdb-couch/diff/3d277764
Branch: refs/heads/1963-eunit-bigcouch
Commit: 3d277764e4a8e9a62b9474d17f9efc96f87b4a94
Parents: 4216409
Author: Alexander Shorin <kx...@apache.org>
Authored: Tue Jun 10 19:54:20 2014 +0400
Committer: Russell Branca <ch...@apache.org>
Committed: Mon Aug 11 13:16:27 2014 -0700
----------------------------------------------------------------------
test/couchdb/couchdb_csp_tests.erl | 96 +++++++++++++++++++++++++++++++++
1 file changed, 96 insertions(+)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/couchdb-couch/blob/3d277764/test/couchdb/couchdb_csp_tests.erl
----------------------------------------------------------------------
diff --git a/test/couchdb/couchdb_csp_tests.erl b/test/couchdb/couchdb_csp_tests.erl
new file mode 100644
index 0000000..adb0e6d
--- /dev/null
+++ b/test/couchdb/couchdb_csp_tests.erl
@@ -0,0 +1,96 @@
+% Licensed under the Apache License, Version 2.0 (the "License"); you may not
+% use this file except in compliance with the License. You may obtain a copy of
+% the License at
+%
+% http://www.apache.org/licenses/LICENSE-2.0
+%
+% Unless required by applicable law or agreed to in writing, software
+% distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+% WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+% License for the specific language governing permissions and limitations under
+% the License.
+
+-module(couchdb_csp_tests).
+
+-include("couch_eunit.hrl").
+
+-define(TIMEOUT, 1000).
+
+
+start() ->
+ {ok, Pid} = couch_server_sup:start_link(?CONFIG_CHAIN),
+ Pid.
+
+stop(Pid) ->
+ couch_server_sup:stop(),
+ erlang:monitor(process, Pid),
+ receive
+ {'DOWN', _, _, Pid, _} ->
+ ok
+ after ?TIMEOUT ->
+ throw({timeout, server_stop})
+ end.
+
+setup() ->
+ ok = couch_config:set("csp", "enable", "true", false),
+ Addr = couch_config:get("httpd", "bind_address", "127.0.0.1"),
+ Port = integer_to_list(mochiweb_socket_server:get(couch_httpd, port)),
+ lists:concat(["http://", Addr, ":", Port, "/_utils/"]).
+
+teardown(_) ->
+ ok.
+
+
+csp_test_() ->
+ {
+ "Content Security Policy tests",
+ {
+ setup,
+ fun start/0, fun stop/1,
+ {
+ foreach,
+ fun setup/0, fun teardown/1,
+ [
+ fun should_not_return_any_csp_headers_when_disabled/1,
+ fun should_apply_default_policy/1,
+ fun should_return_custom_policy/1,
+ fun should_only_enable_csp_when_true/1
+ ]
+ }
+ }
+ }.
+
+
+should_not_return_any_csp_headers_when_disabled(Url) ->
+ ?_assertEqual(undefined,
+ begin
+ ok = couch_config:set("csp", "enable", "false", false),
+ {ok, _, Headers, _} = test_request:get(Url),
+ proplists:get_value("Content-Security-Policy", Headers)
+ end).
+
+should_apply_default_policy(Url) ->
+ ?_assertEqual(
+ "default-src 'self'; img-src 'self'; font-src 'self'; "
+ "script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline';",
+ begin
+ {ok, _, Headers, _} = test_request:get(Url),
+ proplists:get_value("Content-Security-Policy", Headers)
+ end).
+
+should_return_custom_policy(Url) ->
+ ?_assertEqual("default-src 'http://example.com';",
+ begin
+ ok = couch_config:set("csp", "header_value",
+ "default-src 'http://example.com';", false),
+ {ok, _, Headers, _} = test_request:get(Url),
+ proplists:get_value("Content-Security-Policy", Headers)
+ end).
+
+should_only_enable_csp_when_true(Url) ->
+ ?_assertEqual(undefined,
+ begin
+ ok = couch_config:set("csp", "enable", "tru", false),
+ {ok, _, Headers, _} = test_request:get(Url),
+ proplists:get_value("Content-Security-Policy", Headers)
+ end).