aboutsummaryrefslogtreecommitdiff
path: root/test/unit/test_policy_enforcing.py
diff options
context:
space:
mode:
authorWojtek Kosior <koszko@koszko.org>2022-02-16 22:01:38 +0100
committerWojtek Kosior <koszko@koszko.org>2022-02-16 22:01:38 +0100
commitfd9f2fc4783cc606734e61116185c032a63d54a0 (patch)
treeddc162b1df608c3ae51d74f19fbffc92e5cfc3e3 /test/unit/test_policy_enforcing.py
parent7965f1b455144220c137bcb25c4967283a6b7ff3 (diff)
downloadbrowser-extension-fd9f2fc4783cc606734e61116185c032a63d54a0.tar.gz
browser-extension-fd9f2fc4783cc606734e61116185c032a63d54a0.zip
fix out-of-source builds
Diffstat (limited to 'test/unit/test_policy_enforcing.py')
-rw-r--r--test/unit/test_policy_enforcing.py114
1 files changed, 0 insertions, 114 deletions
diff --git a/test/unit/test_policy_enforcing.py b/test/unit/test_policy_enforcing.py
deleted file mode 100644
index 4b7c173..0000000
--- a/test/unit/test_policy_enforcing.py
+++ /dev/null
@@ -1,114 +0,0 @@
-# SPDX-License-Identifier: CC0-1.0
-
-"""
-Haketilo unit tests - enforcing script blocking policy from content script
-"""
-
-# This file is part of Haketilo
-#
-# Copyright (C) 2022 Wojtek Kosior <koszko@koszko.org>
-#
-# This program is free software: you can redistribute it and/or modify
-# it under the terms of the CC0 1.0 Universal License as published by
-# the Creative Commons Corporation.
-#
-# This program is distributed in the hope that it will be useful,
-# but WITHOUT ANY WARRANTY; without even the implied warranty of
-# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-# CC0 1.0 Universal License for more details.
-
-import pytest
-import json
-import urllib.parse
-from selenium.webdriver.support.ui import WebDriverWait
-
-from ..script_loader import load_script
-from .utils import are_scripts_allowed
-
-# For simplicity, we'll use one nonce in all test cases.
-nonce = 'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855'
-
-allow_policy = {'allow': True}
-block_policy = {
- 'allow': False,
- 'csp': f"prefetch-src 'none'; script-src-attr 'none'; script-src 'none'; script-src-elem 'none'; frame-src http://* https://*;"
-}
-payload_policy = {
- 'mapping': 'somemapping',
- 'payload': {'identifier': 'someresource'},
- 'csp': f"prefetch-src 'none'; script-src-attr 'none'; script-src 'nonce-{nonce}'; script-src-elem 'nonce-{nonce}';"
-}
-
-content_script = load_script('content/policy_enforcing.js') + ''';{
-const smuggled_what_to_do = /^[^#]*#?(.*)$/.exec(document.URL)[1];
-const what_to_do = smuggled_what_to_do === "" ? {policy: {allow: true}} :
- JSON.parse(decodeURIComponent(smuggled_what_to_do));
-
-if (what_to_do.csp_off) {
- const orig_DOMParser = window.DOMParser;
- window.DOMParser = function() {
- const parser = new orig_DOMParser();
- this.parseFromString = () => parser.parseFromString('', 'text/html');
- }
-}
-
-enforce_blocking(what_to_do.policy);
-}'''
-
-def get(driver, page, what_to_do):
- driver.get(page + '#' + urllib.parse.quote(json.dumps(what_to_do)))
- driver.execute_script('window.before_reload = true; location.reload();')
- done = lambda _: not driver.execute_script('return window.before_reload;')
- WebDriverWait(driver, 10).until(done)
-
-@pytest.mark.ext_data({'content_script': content_script})
-@pytest.mark.usefixtures('webextension')
-# Under Mozilla we use several mechanisms of script blocking. Some serve as
-# fallbacks in case others break. CSP one of those mechanisms. Here we run the
-# test once with CSP blocking on and once without it. This allows us to verify
-# that the CSP-less blocking approaches by themselves also work. We don't do the
-# reverse (CSP on and other mechanisms off) because CSP rules added through
-# <meta> injection are not reliable enough - they do not always take effect
-# immediately and there's nothing we can do to fix it.
-@pytest.mark.parametrize('csp_off_setting', [{}, {'csp_off': True}])
-def test_policy_enforcing_html(driver, execute_in_page, csp_off_setting):
- """
- A test case of sanitizing <script>s and intrinsic javascript in pages.
- """
- # First, see if scripts run when not blocked.
- get(driver, 'https://gotmyowndoma.in/scripts_to_block_1.html', {
- 'policy': allow_policy,
- **csp_off_setting
- })
-
- for i in range(1, 3):
- driver.find_element_by_id(f'clickme{i}').click()
-
- assert set(driver.execute_script('return window.__run || [];')) == \
- {'inline', 'on', 'href', 'src', 'data'}
- assert are_scripts_allowed(driver)
-
- # Now, verify scripts don't run when blocked.
- get(driver, 'https://gotmyowndoma.in/scripts_to_block_1.html', {
- 'policy': block_policy,
- **csp_off_setting
- })
-
- for i in range(1, 3):
- driver.find_element_by_id(f'clickme{i}').click()
-
- assert set(driver.execute_script('return window.__run || [];')) == set()
- assert bool(csp_off_setting) == are_scripts_allowed(driver)
-
- # Now, verify only scripts with nonce can run when payload is injected.
- get(driver, 'https://gotmyowndoma.in/scripts_to_block_1.html', {
- 'policy': payload_policy,
- **csp_off_setting
- })
-
- for i in range(1, 3):
- driver.find_element_by_id(f'clickme{i}').click()
-
- assert set(driver.execute_script('return window.__run || [];')) == set()
- assert bool(csp_off_setting) == are_scripts_allowed(driver)
- assert are_scripts_allowed(driver, nonce)