1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
|
// SPDX-FileCopyrightText: 2026 Progmasoft <support@progmasoft.com>
// SPDX-License-Identifier: AGPL-3.0-or-later WITH AdditionRef-Progmasoft-Patent-Grant-1.1
import assert from "node:assert/strict";
import { test } from "node:test";
import {
contentSecurityPolicy,
createNonce,
} from "../lib/content-security-policy.ts";
function directives(policy) {
return new Map(
policy.split("; ").map((directive) => {
const [name, ...values] = directive.split(" ");
return [name, values];
}),
);
}
test("a nonce is 128 random bits and differs on every call", () => {
const nonces = new Set(Array.from({ length: 100 }, createNonce));
assert.equal(nonces.size, 100);
for (const nonce of nonces) {
assert.match(nonce, /^[A-Za-z0-9+/]{22}==$/);
}
});
test("scripts run from this host, with the nonce, or from Cloudflare's beacon", () => {
const policy = directives(contentSecurityPolicy("abc", false));
assert.deepEqual(policy.get("script-src"), [
"'self'",
"'nonce-abc'",
"https://static.cloudflareinsights.com",
]);
assert.deepEqual(policy.get("connect-src"), [
"'self'",
"https://cloudflareinsights.com",
]);
assert.deepEqual(policy.get("object-src"), ["'none'"]);
assert.deepEqual(policy.get("frame-ancestors"), ["'none'"]);
assert.deepEqual(policy.get("base-uri"), ["'self'"]);
// OAuth ends in redirects to other hosts after a form is sent.
assert.equal(policy.has("form-action"), false);
for (const values of policy.values()) {
assert.equal(values.includes("'unsafe-eval'"), false);
assert.equal(values.includes("'strict-dynamic'"), false);
}
assert.equal(policy.get("script-src").includes("'unsafe-inline'"), false);
});
test("only the development server may evaluate code", () => {
const policy = directives(contentSecurityPolicy("abc", true));
assert.ok(policy.get("script-src").includes("'unsafe-eval'"));
});
|