Add Rack::Lint to ContentSecurityPolicy::Middleware tests #48812
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
nunosilva800
force-pushed
the
ns-rack-lint-content-security-policy-middleware
branch
2 times, most recently
from
50feb03
to
bccbb33
Compare
nunosilva800
commented
Jul 27, 2023
| @@ -25,9 +25,8 @@ module ActionDispatch # :nodoc: | |||
| # end | |||
| class ContentSecurityPolicy | |||
| class Middleware | |||
| CONTENT_TYPE = "Content-Type" | |||
There was a problem hiding this comment.
Was not used / referenced.
nunosilva800
commented
Jul 27, 2023
nunosilva800
force-pushed
the
ns-rack-lint-content-security-policy-middleware
branch
from
bccbb33
to
5094853
Compare
skipkayhil
reviewed
Jul 27, 2023
Comment on lines
330
to
337
| def test_does_not_override_app_content_security_policy | ||
| app = proc { [200, { "content-security-policy" => @default_csp }, []] } | ||
| _, headers, _ = Rack::Lint.new( | ||
| ActionDispatch::ContentSecurityPolicy::Middleware.new(Rack::Lint.new(app)) | ||
| ).call(@env) | ||
|
|
||
| assert_equal @default_csp, headers["content-security-policy"] | ||
| end | ||
|
|
||
| def test_does_not_override_app_content_security_policy_for_rack_v2 | ||
| app = proc { [200, { "Content-Security-Policy" => @default_csp }, []] } | ||
| _, headers, _ = ActionDispatch::ContentSecurityPolicy::Middleware.new(app).call(@env) | ||
|
|
||
| assert_equal @default_csp, headers["content-security-policy"] | ||
| end |
There was a problem hiding this comment.
When using conditional headers, we'll probably have to make this a single test that also uses conditional headers
There was a problem hiding this comment.
I opted to drop this v2 test as I don't know how to set the gem version for this test only.
Perhaps that is overthinking it anyway, as these dependencies should be set by the environment.
I did this in my local machine fwiw:
% export RACK=2.2.4
% bundle
# ...
% bundle show rack
/home/spin/.bundle/rails/gems/rack-2.2.4
% bin/test test/dispatch/content_security_policy_test.rb
#...
34 runs, 190 assertions, 0 failures, 0 errors, 0 skips
To ensure Rails is and remains compliant with [the Rack 3 spec](https://github.com/rack/rack/blob/6d16306192349e665e4ec820a9bfcc0967009b6a/UPGRADE-GUIDE.md) we can add `Rack::Lint` to the Rails middleware tests. This adds additional test coverage to `ContentSecurityPolicy::Middleware` to validate that its input and output follow the Rack SPEC. The changes made are because of: - [Response Headers must be lower case](https://github.com/rack/rack/blob/6d16306192349e665e4ec820a9bfcc0967009b6a/UPGRADE-GUIDE.md#response-headers-must-be-lower-case) Added tests to ensure that CSP headers set by an app are not overridden, regardless of the casing. An example of this is Sidekiq: https://github.com/sidekiq/sidekiq/blob/b3225ce/lib/sidekiq/web/application.rb#L353
nunosilva800
force-pushed
the
ns-rack-lint-content-security-policy-middleware
branch
from
5094853
to
d1381dc
Compare
nunosilva800
requested review from
guilleiguaran,
skipkayhil and
adrianna-chang-shopify
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation / Background
To ensure Rails is and remains compliant with the Rack 3 spec we can add
Rack::Lintto the Rails middleware tests.Detail
This adds additional test coverage to
ContentSecurityPolicy::Middlewareto validate that its input and output follow the Rack SPEC.The changes made are because of:
Added tests to ensure that CSP headers set by an app are not overridden, regardless of the casing.
An example of this is Sidekiq: https://github.com/sidekiq/sidekiq/blob/b3225ce/lib/sidekiq/web/application.rb#L353
Additional information
Checklist
Before submitting the PR make sure the following are checked:
[Fix #issue-number]