diff options
author | Wojtek Kosior <koszko@koszko.org> | 2022-02-16 22:01:38 +0100 |
---|---|---|
committer | Wojtek Kosior <koszko@koszko.org> | 2022-02-16 22:01:38 +0100 |
commit | fd9f2fc4783cc606734e61116185c032a63d54a0 (patch) | |
tree | ddc162b1df608c3ae51d74f19fbffc92e5cfc3e3 /test/unit/test_policy_enforcing.py | |
parent | 7965f1b455144220c137bcb25c4967283a6b7ff3 (diff) | |
download | browser-extension-fd9f2fc4783cc606734e61116185c032a63d54a0.tar.gz browser-extension-fd9f2fc4783cc606734e61116185c032a63d54a0.zip |
fix out-of-source builds
Diffstat (limited to 'test/unit/test_policy_enforcing.py')
-rw-r--r-- | test/unit/test_policy_enforcing.py | 114 |
1 files changed, 0 insertions, 114 deletions
diff --git a/test/unit/test_policy_enforcing.py b/test/unit/test_policy_enforcing.py deleted file mode 100644 index 4b7c173..0000000 --- a/test/unit/test_policy_enforcing.py +++ /dev/null @@ -1,114 +0,0 @@ -# SPDX-License-Identifier: CC0-1.0 - -""" -Haketilo unit tests - enforcing script blocking policy from content script -""" - -# This file is part of Haketilo -# -# Copyright (C) 2022 Wojtek Kosior <koszko@koszko.org> -# -# This program is free software: you can redistribute it and/or modify -# it under the terms of the CC0 1.0 Universal License as published by -# the Creative Commons Corporation. -# -# This program is distributed in the hope that it will be useful, -# but WITHOUT ANY WARRANTY; without even the implied warranty of -# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -# CC0 1.0 Universal License for more details. - -import pytest -import json -import urllib.parse -from selenium.webdriver.support.ui import WebDriverWait - -from ..script_loader import load_script -from .utils import are_scripts_allowed - -# For simplicity, we'll use one nonce in all test cases. -nonce = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855' - -allow_policy = {'allow': True} -block_policy = { - 'allow': False, - 'csp': f"prefetch-src 'none'; script-src-attr 'none'; script-src 'none'; script-src-elem 'none'; frame-src http://* https://*;" -} -payload_policy = { - 'mapping': 'somemapping', - 'payload': {'identifier': 'someresource'}, - 'csp': f"prefetch-src 'none'; script-src-attr 'none'; script-src 'nonce-{nonce}'; script-src-elem 'nonce-{nonce}';" -} - -content_script = load_script('content/policy_enforcing.js') + ''';{ -const smuggled_what_to_do = /^[^#]*#?(.*)$/.exec(document.URL)[1]; -const what_to_do = smuggled_what_to_do === "" ? {policy: {allow: true}} : - JSON.parse(decodeURIComponent(smuggled_what_to_do)); - -if (what_to_do.csp_off) { - const orig_DOMParser = window.DOMParser; - window.DOMParser = function() { - const parser = new orig_DOMParser(); - this.parseFromString = () => parser.parseFromString('', 'text/html'); - } -} - -enforce_blocking(what_to_do.policy); -}''' - -def get(driver, page, what_to_do): - driver.get(page + '#' + urllib.parse.quote(json.dumps(what_to_do))) - driver.execute_script('window.before_reload = true; location.reload();') - done = lambda _: not driver.execute_script('return window.before_reload;') - WebDriverWait(driver, 10).until(done) - -@pytest.mark.ext_data({'content_script': content_script}) -@pytest.mark.usefixtures('webextension') -# Under Mozilla we use several mechanisms of script blocking. Some serve as -# fallbacks in case others break. CSP one of those mechanisms. Here we run the -# test once with CSP blocking on and once without it. This allows us to verify -# that the CSP-less blocking approaches by themselves also work. We don't do the -# reverse (CSP on and other mechanisms off) because CSP rules added through -# <meta> injection are not reliable enough - they do not always take effect -# immediately and there's nothing we can do to fix it. -@pytest.mark.parametrize('csp_off_setting', [{}, {'csp_off': True}]) -def test_policy_enforcing_html(driver, execute_in_page, csp_off_setting): - """ - A test case of sanitizing <script>s and intrinsic javascript in pages. - """ - # First, see if scripts run when not blocked. - get(driver, 'https://gotmyowndoma.in/scripts_to_block_1.html', { - 'policy': allow_policy, - **csp_off_setting - }) - - for i in range(1, 3): - driver.find_element_by_id(f'clickme{i}').click() - - assert set(driver.execute_script('return window.__run || [];')) == \ - {'inline', 'on', 'href', 'src', 'data'} - assert are_scripts_allowed(driver) - - # Now, verify scripts don't run when blocked. - get(driver, 'https://gotmyowndoma.in/scripts_to_block_1.html', { - 'policy': block_policy, - **csp_off_setting - }) - - for i in range(1, 3): - driver.find_element_by_id(f'clickme{i}').click() - - assert set(driver.execute_script('return window.__run || [];')) == set() - assert bool(csp_off_setting) == are_scripts_allowed(driver) - - # Now, verify only scripts with nonce can run when payload is injected. - get(driver, 'https://gotmyowndoma.in/scripts_to_block_1.html', { - 'policy': payload_policy, - **csp_off_setting - }) - - for i in range(1, 3): - driver.find_element_by_id(f'clickme{i}').click() - - assert set(driver.execute_script('return window.__run || [];')) == set() - assert bool(csp_off_setting) == are_scripts_allowed(driver) - assert are_scripts_allowed(driver, nonce) |