starred/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-07-25 13:43:56 +03:00
Code Issues 784 Packages Projects Releases 25 Wiki Activity

Add CSP controls for image and CSS sources

Browse Source
This commit is contained in:
Zhey
2026-03-26 12:00:08 +01:00
parent 25790fd024
commit e42fda893c
6 changed files with 166 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
tests/SecurityHeaderTest.php
View File

@@ -151,6 +151,42 @@ class SecurityHeaderTest extends TestCase
$this->assertEquals('frame-src \'self\' https://example.com https://diagrams.example.com:8080', $scriptHeader);
}
public function test_style_src_csp_header_set_to_permissive_defaults_when_not_configured()
{
$resp = $this->get('/');
$header = $this->getCspHeader($resp, 'style-src');
$this->assertEquals("style-src 'self' 'unsafe-inline' http: https:", $header);
}
public function test_style_src_csp_header_can_be_overridden_by_config()
{
config()->set('app.css_sources', 'https://fonts.example.com');
$resp = $this->get('/');
$header = $this->getCspHeader($resp, 'style-src');
$this->assertEquals("style-src 'self' https://fonts.example.com", $header);
}
public function test_img_src_csp_header_set_to_permissive_defaults_when_not_configured()
{
$resp = $this->get('/');
$header = $this->getCspHeader($resp, 'img-src');
$this->assertEquals("img-src 'self' data: blob: http: https:", $header);
}
public function test_img_src_csp_header_can_be_overridden_by_config()
{
config()->set('app.image_sources', 'https://images.example.com data:');
$resp = $this->get('/');
$header = $this->getCspHeader($resp, 'img-src');
$this->assertEquals("img-src 'self' https://images.example.com data:", $header);
}
public function test_cache_control_headers_are_set_on_responses()
{
// Public access