Browse files

Add more thorough check for CSP violations

  • Loading branch information...
1 parent c66a5e7 commit ee0d0e6e3f3773d15d3b9c3d654a05cbb914d7ab @markelog markelog committed Oct 30, 2013
View
3 test/data/support/csp-clean.php
@@ -0,0 +1,3 @@
+<?php
+ file_put_contents("csp.log", "", LOCK_EX);
+?>
View
3 test/data/support/csp-log.php
@@ -0,0 +1,3 @@
+<?php
+ file_put_contents("csp.log", "error", LOCK_EX);
+?>
View
0 test/data/support/csp.log
No changes.
View
11 test/data/support/csp.php
@@ -1,12 +1,7 @@
<?php
- # Support: Firefox
- header("X-Content-Security-Policy: default-src 'self';");
-
- # Support: Webkit, Safari 5
- # http://stackoverflow.com/questions/13663302/why-does-my-content-security-policy-work-everywhere-but-safari
- header("X-WebKit-CSP: script-src " . $_SERVER["HTTP_HOST"] . " 'self'");
-
- header("Content-Security-Policy: default-src 'self'");
+ # This test page checkes CSP only for browsers with "Content-Security-Policy" header support
+ # i.e. no old WebKit or old Firefox
+ header("Content-Security-Policy: default-src 'self'; report-uri csp-log.php");
?>
<!DOCTYPE html>
<html>
View
32 test/unit/support.js
@@ -30,6 +30,24 @@ if ( jQuery.css ) {
});
}
+
+// This test checkes CSP only for browsers with "Content-Security-Policy" header support
+// i.e. no old WebKit or old Firefox
+testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Security/CSP) restrictions",
+ "support/csp.php",
+ function( support ) {
+ expect( 2 );
+ deepEqual( jQuery.extend( {}, support ), computedSupport, "No violations of CSP polices" );
+
+ stop();
+
+ supportjQuery.get( "data/support/csp.log" ).done(function( data ) {
@gibson042
jQuery Foundation member

IE<11 seems not to process this done callback. We might want to try making it an always and/or update supportjQuery from 1.9.1.

@markelog
jQuery Foundation member
markelog added a note Nov 7, 2013

Yeah, i noticed, but didn't have an internet for couple of hours, it looks like IE requires full version of jQuery 1.9.1 to work properly in this case, so i will update it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
+ equal( data, "", "No log request should be sent" );
+ supportjQuery.get( "data/support/csp-clean.php" ).done( start );
+ });
+ }
+);
+
(function() {
var expected, version,
userAgent = window.navigator.userAgent;
@@ -175,17 +193,3 @@ if ( jQuery.css ) {
}
})();
-
-// Support: Safari 5.1
-// Shameless browser-sniff, but Safari 5.1 mishandles CSP
-if ( !( typeof navigator !== "undefined" &&
- (/ AppleWebKit\/\d.*? Version\/(\d+)/.exec(navigator.userAgent) || [])[1] < 6 ) ) {
-
- testIframeWithCallback( "Check CSP (https://developer.mozilla.org/en-US/docs/Security/CSP) restrictions",
- "support/csp.php",
- function( support ) {
- expect( 1 );
- deepEqual( jQuery.extend( {}, support ), computedSupport, "No violations of CSP polices" );
- }
- );
-}

0 comments on commit ee0d0e6

Please sign in to comment.