|
@@ -10,9 +10,7 @@ module.exports = ({extensions, advanced, content}) => {
|
|
|
// remove origin
|
|
|
if (await advanced.evaluate(() => Object.keys(state.origins).length > 1)) {
|
|
|
// expand origin
|
|
|
- if (!await advanced.evaluate(() =>
|
|
|
- document.querySelector('.m-list li:nth-of-type(2)')
|
|
|
- .classList.contains('m-expanded'))) {
|
|
|
+ if (!await advanced.evaluate(() => document.querySelector('.m-list li:nth-of-type(2)').classList.contains('m-expanded'))) {
|
|
|
await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
}
|
|
|
await advanced.click('.m-list li:nth-of-type(2) .m-footer .m-button')
|
|
@@ -26,91 +24,69 @@ module.exports = ({extensions, advanced, content}) => {
|
|
|
|
|
|
// expand origin
|
|
|
if (!await advanced.evaluate(() =>
|
|
|
- document.querySelector('.m-list li:nth-of-type(2)')
|
|
|
- .classList.contains('m-expanded'))) {
|
|
|
+ document.querySelector('.m-list li:nth-of-type(2)').classList.contains('m-expanded'))) {
|
|
|
await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
}
|
|
|
|
|
|
+ // enable header detection
|
|
|
+ if (!await advanced.evaluate(() => state.header)) {
|
|
|
+ await advanced.click('.m-switch')
|
|
|
+ }
|
|
|
+
|
|
|
// enable path matching
|
|
|
await advanced.evaluate(() => {
|
|
|
- document.querySelector('.m-list li:nth-of-type(2) input')
|
|
|
- .value = 'csp-match-path'
|
|
|
- document.querySelector('.m-list li:nth-of-type(2) input')
|
|
|
- .dispatchEvent(new Event('keyup'))
|
|
|
+ document.querySelector('.m-list li:nth-of-type(2) input').value = 'csp-match-path'
|
|
|
+ document.querySelector('.m-list li:nth-of-type(2) input').dispatchEvent(new Event('keyup'))
|
|
|
})
|
|
|
// there is debounce timeout of 750ms in the options UI
|
|
|
await advanced.waitFor(800)
|
|
|
})
|
|
|
|
|
|
- describe('preserve state', () => {
|
|
|
- it('enable csp', async () => {
|
|
|
+ describe('not correct content-type + non matching path', () => {
|
|
|
+ before(async () => {
|
|
|
await advanced.bringToFront()
|
|
|
|
|
|
// enable csp
|
|
|
if (!await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|
|
|
await advanced.click('.m-list li:nth-of-type(2) .m-switch')
|
|
|
}
|
|
|
- await advanced.reload()
|
|
|
- await advanced.waitFor(200)
|
|
|
|
|
|
- // expand origin
|
|
|
- await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
-
|
|
|
- t.strictEqual(
|
|
|
- await advanced.evaluate(() =>
|
|
|
- document.querySelector('.m-list li:nth-of-type(2) .m-switch')
|
|
|
- .classList.contains('is-checked')
|
|
|
- ),
|
|
|
- true,
|
|
|
- 'csp checkbox should be enabled'
|
|
|
- )
|
|
|
+ // go to page serving content with strict csp
|
|
|
+ await content.goto('http://localhost:3000/csp-no-header-no-path')
|
|
|
+ await content.bringToFront()
|
|
|
+ await content.waitFor(200)
|
|
|
})
|
|
|
- it('disable csp', async () => {
|
|
|
- await advanced.bringToFront()
|
|
|
-
|
|
|
- // disable csp
|
|
|
- if (await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|
|
|
- await advanced.click('.m-list li:nth-of-type(2) .m-switch')
|
|
|
- }
|
|
|
- await advanced.reload()
|
|
|
- await advanced.waitFor(200)
|
|
|
-
|
|
|
- // expand origin
|
|
|
- await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
-
|
|
|
+ it('non matching urls should be skipped', async () => {
|
|
|
t.strictEqual(
|
|
|
- await advanced.evaluate(() =>
|
|
|
- document.querySelector('.m-list li:nth-of-type(2) .m-switch')
|
|
|
- .classList.contains('is-checked')
|
|
|
- ),
|
|
|
- false,
|
|
|
- 'csp checkbox should be disabled'
|
|
|
+ await content.evaluate(() => {
|
|
|
+ try {
|
|
|
+ window.localStorage
|
|
|
+ }
|
|
|
+ catch (err) {
|
|
|
+ return err.message.split(':')[1].trim()
|
|
|
+ }
|
|
|
+ }),
|
|
|
+ `The document is sandboxed and lacks the 'allow-same-origin' flag.`,
|
|
|
+ 'localStorage should not be accessible'
|
|
|
)
|
|
|
})
|
|
|
})
|
|
|
|
|
|
- describe('strip csp header only on matching content type or url', () => {
|
|
|
+ describe('correct content-type + non matching path', () => {
|
|
|
before(async () => {
|
|
|
await advanced.bringToFront()
|
|
|
|
|
|
- // expand origin
|
|
|
- if (!await advanced.evaluate(() =>
|
|
|
- document.querySelector('.m-list li:nth-of-type(2)')
|
|
|
- .classList.contains('m-expanded'))) {
|
|
|
- await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
- }
|
|
|
-
|
|
|
// enable csp
|
|
|
if (!await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|
|
|
await advanced.click('.m-list li:nth-of-type(2) .m-switch')
|
|
|
}
|
|
|
|
|
|
// go to page serving content with strict csp
|
|
|
- await content.goto('http://localhost:3000/csp-wrong-path')
|
|
|
+ await content.goto('http://localhost:3000/csp-match-header')
|
|
|
await content.bringToFront()
|
|
|
await content.waitFor(200)
|
|
|
})
|
|
|
- it('non matching urls should be skipped', async () => {
|
|
|
+ it('non matching urls cannot be checked for enabled csp', async () => {
|
|
|
t.strictEqual(
|
|
|
await content.evaluate(() => {
|
|
|
try {
|
|
@@ -126,17 +102,10 @@ module.exports = ({extensions, advanced, content}) => {
|
|
|
})
|
|
|
})
|
|
|
|
|
|
- describe('enable csp', () => {
|
|
|
+ describe('not correct content-type + matching path', () => {
|
|
|
before(async () => {
|
|
|
await advanced.bringToFront()
|
|
|
|
|
|
- // expand origin
|
|
|
- if (!await advanced.evaluate(() =>
|
|
|
- document.querySelector('.m-list li:nth-of-type(2)')
|
|
|
- .classList.contains('m-expanded'))) {
|
|
|
- await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
- }
|
|
|
-
|
|
|
// enable csp
|
|
|
if (!await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|
|
|
await advanced.click('.m-list li:nth-of-type(2) .m-switch')
|
|
@@ -158,17 +127,58 @@ module.exports = ({extensions, advanced, content}) => {
|
|
|
})
|
|
|
})
|
|
|
|
|
|
- describe('disable csp', () => {
|
|
|
- before(async () => {
|
|
|
+ describe('disable - enable - disable', () => {
|
|
|
+ it('full cycle', async () => {
|
|
|
+ // 1. disable
|
|
|
await advanced.bringToFront()
|
|
|
|
|
|
- // expand origin
|
|
|
- if (!await advanced.evaluate(() =>
|
|
|
- document.querySelector('.m-list li:nth-of-type(2)')
|
|
|
- .classList.contains('m-expanded'))) {
|
|
|
- await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
+ // disable csp
|
|
|
+ if (await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|
|
|
+ await advanced.click('.m-list li:nth-of-type(2) .m-switch')
|
|
|
}
|
|
|
|
|
|
+ // go to page serving content with strict csp
|
|
|
+ await content.goto('http://localhost:3000/csp-match-path')
|
|
|
+ await content.bringToFront()
|
|
|
+ await content.waitFor(200)
|
|
|
+
|
|
|
+ t.strictEqual(
|
|
|
+ await content.evaluate(() => {
|
|
|
+ try {
|
|
|
+ window.localStorage
|
|
|
+ }
|
|
|
+ catch (err) {
|
|
|
+ return err.message.split(':')[1].trim()
|
|
|
+ }
|
|
|
+ }),
|
|
|
+ `The document is sandboxed and lacks the 'allow-same-origin' flag.`,
|
|
|
+ 'localStorage should not be accessible'
|
|
|
+ )
|
|
|
+
|
|
|
+ // 2. enable
|
|
|
+ await advanced.bringToFront()
|
|
|
+
|
|
|
+ // enable csp
|
|
|
+ if (!await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|
|
|
+ await advanced.click('.m-list li:nth-of-type(2) .m-switch')
|
|
|
+ }
|
|
|
+
|
|
|
+ // go to page serving content with strict csp
|
|
|
+ await content.goto('http://localhost:3000/csp-match-path')
|
|
|
+ await content.bringToFront()
|
|
|
+ await content.waitFor(200)
|
|
|
+
|
|
|
+ t.strictEqual(
|
|
|
+ await content.evaluate(() =>
|
|
|
+ window.localStorage.toString()
|
|
|
+ ),
|
|
|
+ '[object Storage]',
|
|
|
+ 'localStorage should be accessible'
|
|
|
+ )
|
|
|
+
|
|
|
+ // 3. disable
|
|
|
+ await advanced.bringToFront()
|
|
|
+
|
|
|
// disable csp
|
|
|
if (await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|
|
|
await advanced.click('.m-list li:nth-of-type(2) .m-switch')
|
|
@@ -178,8 +188,7 @@ module.exports = ({extensions, advanced, content}) => {
|
|
|
await content.goto('http://localhost:3000/csp-match-path')
|
|
|
await content.bringToFront()
|
|
|
await content.waitFor(200)
|
|
|
- })
|
|
|
- it('webRequest.onHeadersReceived event is disabled', async () => {
|
|
|
+
|
|
|
t.strictEqual(
|
|
|
await content.evaluate(() => {
|
|
|
try {
|
|
@@ -195,16 +204,54 @@ module.exports = ({extensions, advanced, content}) => {
|
|
|
})
|
|
|
})
|
|
|
|
|
|
- describe('enable csp + suspend the event page', () => {
|
|
|
- before(async () => {
|
|
|
+ describe('persist state', () => {
|
|
|
+ it('enable csp', async () => {
|
|
|
await advanced.bringToFront()
|
|
|
|
|
|
+ // enable csp
|
|
|
+ if (!await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|
|
|
+ await advanced.click('.m-list li:nth-of-type(2) .m-switch')
|
|
|
+ }
|
|
|
+ await advanced.reload()
|
|
|
+ await advanced.waitFor(200)
|
|
|
+
|
|
|
// expand origin
|
|
|
- if (!await advanced.evaluate(() =>
|
|
|
- document.querySelector('.m-list li:nth-of-type(2)')
|
|
|
- .classList.contains('m-expanded'))) {
|
|
|
- await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
+ await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
+
|
|
|
+ t.strictEqual(
|
|
|
+ await advanced.evaluate(() =>
|
|
|
+ document.querySelector('.m-list li:nth-of-type(2) .m-switch').classList.contains('is-checked')
|
|
|
+ ),
|
|
|
+ true,
|
|
|
+ 'csp checkbox should be enabled'
|
|
|
+ )
|
|
|
+ })
|
|
|
+ it('disable csp', async () => {
|
|
|
+ await advanced.bringToFront()
|
|
|
+
|
|
|
+ // disable csp
|
|
|
+ if (await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|
|
|
+ await advanced.click('.m-list li:nth-of-type(2) .m-switch')
|
|
|
}
|
|
|
+ await advanced.reload()
|
|
|
+ await advanced.waitFor(200)
|
|
|
+
|
|
|
+ // expand origin
|
|
|
+ await advanced.click('.m-list li:nth-of-type(2)')
|
|
|
+
|
|
|
+ t.strictEqual(
|
|
|
+ await advanced.evaluate(() =>
|
|
|
+ document.querySelector('.m-list li:nth-of-type(2) .m-switch').classList.contains('is-checked')
|
|
|
+ ),
|
|
|
+ false,
|
|
|
+ 'csp checkbox should be disabled'
|
|
|
+ )
|
|
|
+ })
|
|
|
+ })
|
|
|
+
|
|
|
+ describe('enable csp + suspend the event page', () => {
|
|
|
+ before(async () => {
|
|
|
+ await advanced.bringToFront()
|
|
|
|
|
|
// enable csp
|
|
|
if (!await advanced.evaluate(() => state.origins['http://localhost:3000'].csp)) {
|