starred/BookStack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2026-02-06 19:06:02 +03:00
Code Issues 784 Packages Projects Releases 10 Wiki Activity

test_frame_src_csp_header_set fails on customized ALLOWED_IFRAME_SOURCES #4825

New Issue
Closed
opened 2026-02-05 09:18:50 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-05 09:18:50 +03:00
Owner
Copy Link

Originally created by @mueller-contria on GitHub (Jun 13, 2024).

Describe the Bug

test_frame_src_csp_header_set() (in tests/SecurityHeaderTest.php) tests the CspHeader->frame-src against a fixed string, identical to the default-setting for ALLOWED_IFRAME_SOURCES.
If we customize ALLOWED_IFRAME_SOURCES in our .env, the test fails.

Comparable Environment Variables are defined in the phpunit.xml, but unfortunately not ALLOWED_IFRAME_SOURCES

I will provide a Pull-Request for phpunit.xml soon.

Steps to Reproduce

  1. Add a line like ALLOWED_IFRAME_SOURCES="https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com https://*.google.com" to your .env-file
  2. Execute vendor/bin/phpunit --filter test_frame_src_csp_header_set
  3. The test fails
Failed asserting that two strings are equal.
--- Expected
+++ Actual
@@ @@
-'frame-src 'self' https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com'
+'frame-src 'self' https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com https://*.google.com'

Expected Behaviour

The test should pass.

The tests should not rely on the ALLOWED_IFRAME_SOURCES-value set in .env. Instead, phpunit.xml should define the value of this env-var.

Screenshots or Additional Context

No response

Browser Details

CLI / PHPUnit

Exact BookStack Version

v24.03-dev

Originally created by @mueller-contria on GitHub (Jun 13, 2024). ### Describe the Bug `test_frame_src_csp_header_set()` (in `tests/SecurityHeaderTest.php`) tests the CspHeader->frame-src against a fixed string, identical to the default-setting for ALLOWED_IFRAME_SOURCES. If we customize ALLOWED_IFRAME_SOURCES in our .env, the test fails. Comparable Environment Variables are defined in the phpunit.xml, but unfortunately not ALLOWED_IFRAME_SOURCES I will provide a Pull-Request for phpunit.xml soon. ### Steps to Reproduce 1. Add a line like `ALLOWED_IFRAME_SOURCES="https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com https://*.google.com"` to your `.env`-file 2. Execute `vendor/bin/phpunit --filter test_frame_src_csp_header_set` 3. The test fails ``` Failed asserting that two strings are equal. --- Expected +++ Actual @@ @@ -'frame-src 'self' https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com' +'frame-src 'self' https://*.draw.io https://*.youtube.com https://*.youtube-nocookie.com https://*.vimeo.com https://*.google.com' ``` ### Expected Behaviour The test should pass. The tests should not rely on the ALLOWED_IFRAME_SOURCES-value set in `.env`. Instead, `phpunit.xml` should define the value of this env-var. ### Screenshots or Additional Context _No response_ ### Browser Details CLI / PHPUnit ### Exact BookStack Version v24.03-dev
OVERLORD added the 🐛 Bug label 2026-02-05 09:18:50 +03:00
OVERLORD commented 2026-02-05 09:18:53 +03:00
Author
Owner
Copy Link

@ssddanbrown commented on GitHub (Jul 14, 2024):

Closed with merge of #5069, thanks again @mueller-contria!

@ssddanbrown commented on GitHub (Jul 14, 2024): Closed with merge of #5069, thanks again @mueller-contria!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
🎨 Design
📖 Docs Update
🐛 Bug
🐛 Bug
:cat2:🐈 Possible duplicate
💿 Database
☕ Open to discussion
💻 Front-End
🐕 Support
🚪 Authentication
🌍 Translations
🔌 API Task
🏭 Back-End
⛲ Upstream
🔨 Feature Request
🛠️ Enhancement
🛠️ Enhancement
🛠️ Enhancement
❤️ Happy feedback
🔒 Security
🔍 Pending Validation
💆 UX
📝 WYSIWYG Editor
🌔 Out of scope
🔩 API Request
:octocat: Admin/Meta
🖌️ View Customization
❓ Question
🚀 Priority
🛡️ Blocked
🚚 Export System
♿ A11y
🔧 Maintenance
> Markdown Editor
pull-request
Mirrored from GitHub Pull Request
No Label 🐛 Bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/BookStack#4825
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?