3 use Wikimedia\TestingAccessWrapper
;
5 class ContentSecurityPolicyTest
extends MediaWikiTestCase
{
6 /** @var ContentSecurityPolicy */
9 protected function setUp() {
10 global $wgUploadDirectory;
11 $this->setMwGlobals( [
12 'wgAllowExternalImages' => false,
13 'wgAllowExternalImagesFrom' => [],
14 'wgAllowImageTag' => false,
15 'wgEnableImageWhitelist' => false,
16 'wgCrossSiteAJAXdomains' => [
17 'sister-site.somewhere.com',
21 'wgScriptPath' => '/w',
22 'wgForeignFileRepos' => [ [
23 'class' => ForeignAPIRepo
::class,
24 'name' => 'wikimediacommons',
25 'apibase' => 'https://commons.wikimedia.org/w/api.php',
26 'url' => 'https://upload.wikimedia.org/wikipedia/commons',
27 'thumbUrl' => 'https://upload.wikimedia.org/wikipedia/commons/thumb',
29 'transformVia404' => true,
30 'fetchDescription' => true,
31 'descriptionCacheExpiry' => 43200,
32 'apiThumbCacheExpiry' => 0,
33 'directory' => $wgUploadDirectory,
34 'backend' => 'wikimediacommons-backend',
37 // Note, there are some obscure globals which
38 // could affect the results which aren't included above.
40 RepoGroup
::destroySingleton();
41 $context = RequestContext
::getMain();
42 $resp = $context->getRequest()->response();
43 $conf = $context->getConfig();
44 $csp = new ContentSecurityPolicy( 'secret', $resp, $conf );
45 $this->csp
= TestingAccessWrapper
::newFromObject( $csp );
47 return parent
::setUp();
51 * @dataProvider providerFalsePositiveBrowser
52 * @covers ContentSecurityPolicy::falsePositiveBrowser
54 public function testFalsePositiveBrowser( $ua, $expected ) {
55 $actual = ContentSecurityPolicy
::falsePositiveBrowser( $ua );
56 $this->assertEquals( $expected, $actual, $ua );
59 public function providerFalsePositiveBrowser() {
60 // @codingStandardsIgnoreStart Generic.Files.LineLength
62 [ 'Mozilla/5.0 (X11; Linux i686; rv:41.0) Gecko/20100101 Firefox/41.0', true ],
63 [ 'Mozilla/5.0 (X11; U; Linux i686; en-ca) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+ Debian/squeeze (2.30.6-1) Epiphany/2.30.6', false ]
65 // @codingStandardsIgnoreEnd Generic.Files.LineLength
69 * @dataProvider providerMakeCSPDirectives
70 * @covers ContentSecurityPolicy::makeCSPDirectives
72 public function testMakeCSPDirectives(
78 $actualFull = $this->csp
->makeCSPDirectives( $policy, ContentSecurityPolicy
::FULL_MODE
);
79 $actualReport = $this->csp
->makeCSPDirectives(
80 $policy, ContentSecurityPolicy
::REPORT_ONLY_MODE
82 $actualRestricted = $this->csp
->makeCSPDirectives(
83 $policy, ContentSecurityPolicy
::FULL_MODE_RESTRICTED
85 $policyJson = formatJson
::encode( $policy );
86 $this->assertEquals( $expectedFull, $actualFull, "full: " . $policyJson );
87 $this->assertEquals( $expectedReport, $actualReport, "report: " . $policyJson );
88 $this->assertEquals( $expectedRestricted, $actualRestricted, "restricted: " . $policyJson );
91 public function providerMakeCSPDirectives() {
92 // @codingStandardsIgnoreStart Generic.Files.LineLength
94 [ false, '', '', '' ],
96 [ 'useNonces' => false ],
97 "script-src 'unsafe-eval' 'self' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
98 "script-src 'unsafe-eval' 'self' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
99 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'"
103 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
104 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
105 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
109 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
110 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
111 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
114 [ 'script-src' => [ 'http://example.com', 'http://something,else.com' ] ],
115 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
116 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
117 "script-src 'unsafe-eval' 'self' http://example.com http://something%2Celse.com sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
120 [ 'unsafeFallback' => false ],
121 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
122 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
123 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
126 [ 'unsafeFallback' => true ],
127 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
128 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
129 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
132 [ 'default-src' => false ],
133 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
134 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
135 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
138 [ 'default-src' => true ],
139 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
140 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
141 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'",
144 [ 'default-src' => [ 'https://foo.com', 'http://bar.com', 'baz.de' ] ],
145 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
146 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
147 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'",
150 [ 'includeCORS' => false ],
151 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
152 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
153 "script-src 'unsafe-eval' 'self'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
156 [ 'includeCORS' => false, 'default-src' => true ],
157 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
158 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
159 "script-src 'unsafe-eval' 'self'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'",
162 [ 'includeCORS' => true ],
163 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
164 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
165 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
168 [ 'report-uri' => false ],
169 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
170 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
171 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
174 [ 'report-uri' => true ],
175 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
176 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
177 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
180 [ 'report-uri' => 'https://example.com/index.php?foo;report=csp' ],
181 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
182 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
183 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
189 * @covers ContentSecurityPolicy::makeCSPDirectives
191 public function testMakeCSPDirectivesImage() {
192 global $wgAllowImageTag;
193 $origImg = wfSetVar( $wgAllowImageTag, true );
195 $actual = $this->csp
->makeCSPDirectives( true, ContentSecurityPolicy
::FULL_MODE
);
197 $wgAllowImageTag = $origImg;
199 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&";
200 $this->assertEquals( $expected, $actual );
204 * @covers ContentSecurityPolicy::makeCSPDirectives
206 public function testMakeCSPDirectivesReportUri() {
207 $actual = $this->csp
->makeCSPDirectives(
209 ContentSecurityPolicy
::REPORT_ONLY_MODE
211 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&";
212 $this->assertEquals( $expected, $actual );
213 // @codingStandardsIgnoreEnd Generic.Files.LineLength
217 * @covers ContentSecurityPolicy::getHeaderName
219 public function testGetHeaderName() {
221 $this->csp
->getHeaderName( ContentSecurityPolicy
::REPORT_ONLY_MODE
),
222 'Content-Security-Policy-Report-Only'
225 $this->csp
->getHeaderName( ContentSecurityPolicy
::FULL_MODE
),
226 'Content-Security-Policy'
231 * @covers ContentSecurityPolicy::getReportUri
233 public function testGetReportUri() {
234 $full = $this->csp
->getReportUri( ContentSecurityPolicy
::FULL_MODE
);
235 $fullExpected = '/w/api.php?action=cspreport&format=json&';
236 $this->assertEquals( $full, $fullExpected, 'normal report uri' );
238 $report = $this->csp
->getReportUri( ContentSecurityPolicy
::REPORT_ONLY_MODE
);
239 $reportExpected = $fullExpected . 'reportonly=1&';
240 $this->assertEquals( $report, $reportExpected, 'report only' );
242 global $wgScriptPath;
243 $origPath = wfSetVar( $wgScriptPath, '/tl;dr/a,%20wiki' );
244 $esc = $this->csp
->getReportUri( ContentSecurityPolicy
::FULL_MODE
);
245 $escExpected = '/tl%3Bdr/a%2C%20wiki/api.php?action=cspreport&format=json&';
246 $wgScriptPath = $origPath;
247 $this->assertEquals( $esc, $escExpected, 'test esc rules' );
251 * @dataProvider providerPrepareUrlForCSP
252 * @covers ContentSecurityPolicy::prepareUrlForCSP
254 public function testPrepareUrlForCSP( $url, $expected ) {
255 $actual = $this->csp
->prepareUrlForCSP( $url );
256 $this->assertEquals( $actual, $expected, $url );
259 public function providerPrepareUrlForCSP() {
262 [ $wgServer, false ],
263 [ 'https://example.com', 'https://example.com' ],
264 [ 'https://example.com:200', 'https://example.com:200' ],
265 [ 'http://example.com', 'http://example.com' ],
266 [ 'example.com', 'example.com' ],
267 [ '*.example.com', '*.example.com' ],
268 [ 'https://*.example.com', 'https://*.example.com' ],
269 [ '//example.com', 'example.com' ],
270 [ 'https://example.com/path', 'https://example.com' ],
271 [ 'https://example.com/path:', 'https://example.com' ],
272 [ 'https://example.com/Wikipedia:NPOV', 'https://example.com' ],
273 [ 'https://tl;dr.com', 'https://tl%3Bdr.com' ],
274 [ 'yes,no.com', 'yes%2Cno.com' ],
275 [ '/relative-url', false ],
276 [ '/relativeUrl:withColon', false ],
277 [ 'data:', 'data:' ],
278 [ 'blob:', 'blob:' ],
283 * @covers ContentSecurityPolicy::escapeUrlForCSP
285 public function testEscapeUrlForCSP() {
286 $escaped = $this->csp
->escapeUrlForCSP( ',;%2B' );
287 $this->assertEquals( $escaped, '%2C%3B%2B' );
291 * @dataProvider providerCSPIsEnabled
292 * @covers ContentSecurityPolicy::isNonceRequired
294 public function testCSPIsEnabled( $main, $reportOnly, $expected ) {
295 global $wgCSPReportOnlyHeader, $wgCSPHeader;
297 $oldReport = wfSetVar( $wgCSPReportOnlyHeader, $reportOnly );
298 $oldMain = wfSetVar( $wgCSPHeader, $main );
299 $res = ContentSecurityPolicy
::isNonceRequired( RequestContext
::getMain()->getConfig() );
300 wfSetVar( $wgCSPReportOnlyHeader, $oldReport );
301 wfSetVar( $wgCSPHeader, $oldMain );
302 $this->assertEquals( $res, $expected );
305 public function providerCSPIsEnabled() {
307 [ true, true, true ],
308 [ false, true, true ],
309 [ true, false, true ],
310 [ false, false, false ],
313 [ [ 'default-src' => [ 'foo.example.com' ] ], false, true ],
314 [ [ 'useNonces' => false ], [ 'useNonces' => false ], false ],
315 [ [ 'useNonces' => true ], [ 'useNonces' => false ], true ],
316 [ [ 'useNonces' => false ], [ 'useNonces' => true ], true ],