3 use Wikimedia\TestingAccessWrapper
;
5 class ContentSecurityPolicyTest
extends MediaWikiTestCase
{
6 /** @var ContentSecurityPolicy */
9 protected function setUp() {
10 global $wgUploadDirectory;
11 $this->setMwGlobals( [
12 'wgAllowExternalImages' => false,
13 'wgAllowExternalImagesFrom' => [],
14 'wgAllowImageTag' => false,
15 'wgEnableImageWhitelist' => false,
16 'wgLoadScript' => false,
17 'wgExtensionAssetsPath' => false,
18 'wgStylePath' => false,
19 'wgResourceBasePath' => null,
20 'wgCrossSiteAJAXdomains' => [
21 'sister-site.somewhere.com',
25 'wgScriptPath' => '/w',
26 'wgForeignFileRepos' => [ [
27 'class' => ForeignAPIRepo
::class,
28 'name' => 'wikimediacommons',
29 'apibase' => 'https://commons.wikimedia.org/w/api.php',
30 'url' => 'https://upload.wikimedia.org/wikipedia/commons',
31 'thumbUrl' => 'https://upload.wikimedia.org/wikipedia/commons/thumb',
33 'transformVia404' => true,
34 'fetchDescription' => true,
35 'descriptionCacheExpiry' => 43200,
36 'apiThumbCacheExpiry' => 0,
37 'directory' => $wgUploadDirectory,
38 'backend' => 'wikimediacommons-backend',
41 // Note, there are some obscure globals which
42 // could affect the results which aren't included above.
44 $context = RequestContext
::getMain();
45 $resp = $context->getRequest()->response();
46 $conf = $context->getConfig();
47 $csp = new ContentSecurityPolicy( 'secret', $resp, $conf );
48 $this->csp
= TestingAccessWrapper
::newFromObject( $csp );
50 return parent
::setUp();
54 * @covers ContentSecurityPolicy::getAdditionalSelfUrls
56 public function testGetAdditionalSelfUrlsRespectsUrlSettings() {
57 $this->setMwGlobals( 'wgLoadScript', 'https://wgLoadScript.example.org/load.php' );
58 $this->setMwGlobals( 'wgExtensionAssetsPath',
59 'https://wgExtensionAssetsPath.example.org/assets/' );
60 $this->setMwGlobals( 'wgStylePath', 'https://wgStylePath.example.org/style/' );
61 $this->setMwGlobals( 'wgResourceBasePath', 'https://wgResourceBasePath.example.org/resources/' );
65 'https://upload.wikimedia.org',
66 'https://commons.wikimedia.org',
67 'https://wgLoadScript.example.org',
68 'https://wgExtensionAssetsPath.example.org',
69 'https://wgStylePath.example.org',
70 'https://wgResourceBasePath.example.org',
72 array_values( $this->csp
->getAdditionalSelfUrls() )
77 * @dataProvider providerFalsePositiveBrowser
78 * @covers ContentSecurityPolicy::falsePositiveBrowser
80 public function testFalsePositiveBrowser( $ua, $expected ) {
81 $actual = ContentSecurityPolicy
::falsePositiveBrowser( $ua );
82 $this->assertEquals( $expected, $actual, $ua );
85 public function providerFalsePositiveBrowser() {
86 // @codingStandardsIgnoreStart Generic.Files.LineLength
88 [ 'Mozilla/5.0 (X11; Linux i686; rv:41.0) Gecko/20100101 Firefox/41.0', true ],
89 [ 'Mozilla/5.0 (X11; U; Linux i686; en-ca) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+ Debian/squeeze (2.30.6-1) Epiphany/2.30.6', false ]
91 // @codingStandardsIgnoreEnd Generic.Files.LineLength
95 * @dataProvider providerMakeCSPDirectives
96 * @covers ContentSecurityPolicy::makeCSPDirectives
98 public function testMakeCSPDirectives(
103 $actualFull = $this->csp
->makeCSPDirectives( $policy, ContentSecurityPolicy
::FULL_MODE
);
104 $actualReport = $this->csp
->makeCSPDirectives(
105 $policy, ContentSecurityPolicy
::REPORT_ONLY_MODE
107 $policyJson = formatJson
::encode( $policy );
108 $this->assertEquals( $expectedFull, $actualFull, "full: " . $policyJson );
109 $this->assertEquals( $expectedReport, $actualReport, "report: " . $policyJson );
112 public function providerMakeCSPDirectives() {
113 // @codingStandardsIgnoreStart Generic.Files.LineLength
117 [ 'useNonces' => false ],
118 "script-src 'unsafe-eval' 'self' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
119 "script-src 'unsafe-eval' 'self' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
120 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'"
124 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
125 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
129 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
130 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
133 [ 'script-src' => [ 'http://example.com', 'http://something,else.com' ] ],
134 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
135 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
138 [ 'unsafeFallback' => false ],
139 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
140 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
143 [ 'unsafeFallback' => true ],
144 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
145 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
148 [ 'default-src' => false ],
149 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
150 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
153 [ 'default-src' => true ],
154 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
155 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
158 [ 'default-src' => [ 'https://foo.com', 'http://bar.com', 'baz.de' ] ],
159 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
160 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
163 [ 'includeCORS' => false ],
164 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
165 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
168 [ 'includeCORS' => false, 'default-src' => true ],
169 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
170 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
173 [ 'includeCORS' => true ],
174 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
175 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
178 [ 'report-uri' => false ],
179 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
180 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
183 [ 'report-uri' => true ],
184 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
185 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
188 [ 'report-uri' => 'https://example.com/index.php?foo;report=csp' ],
189 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
190 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
196 * @covers ContentSecurityPolicy::makeCSPDirectives
198 public function testMakeCSPDirectivesImage() {
199 global $wgAllowImageTag;
200 $origImg = wfSetVar( $wgAllowImageTag, true );
202 $actual = $this->csp
->makeCSPDirectives( true, ContentSecurityPolicy
::FULL_MODE
);
204 $wgAllowImageTag = $origImg;
206 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&";
207 $this->assertEquals( $expected, $actual );
211 * @covers ContentSecurityPolicy::makeCSPDirectives
213 public function testMakeCSPDirectivesReportUri() {
214 $actual = $this->csp
->makeCSPDirectives(
216 ContentSecurityPolicy
::REPORT_ONLY_MODE
218 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&";
219 $this->assertEquals( $expected, $actual );
220 // @codingStandardsIgnoreEnd Generic.Files.LineLength
224 * @covers ContentSecurityPolicy::getHeaderName
226 public function testGetHeaderName() {
228 $this->csp
->getHeaderName( ContentSecurityPolicy
::REPORT_ONLY_MODE
),
229 'Content-Security-Policy-Report-Only'
232 $this->csp
->getHeaderName( ContentSecurityPolicy
::FULL_MODE
),
233 'Content-Security-Policy'
238 * @covers ContentSecurityPolicy::getReportUri
240 public function testGetReportUri() {
241 $full = $this->csp
->getReportUri( ContentSecurityPolicy
::FULL_MODE
);
242 $fullExpected = '/w/api.php?action=cspreport&format=json&';
243 $this->assertEquals( $full, $fullExpected, 'normal report uri' );
245 $report = $this->csp
->getReportUri( ContentSecurityPolicy
::REPORT_ONLY_MODE
);
246 $reportExpected = $fullExpected . 'reportonly=1&';
247 $this->assertEquals( $report, $reportExpected, 'report only' );
249 global $wgScriptPath;
250 $origPath = wfSetVar( $wgScriptPath, '/tl;dr/a,%20wiki' );
251 $esc = $this->csp
->getReportUri( ContentSecurityPolicy
::FULL_MODE
);
252 $escExpected = '/tl%3Bdr/a%2C%20wiki/api.php?action=cspreport&format=json&';
253 $wgScriptPath = $origPath;
254 $this->assertEquals( $esc, $escExpected, 'test esc rules' );
258 * @dataProvider providerPrepareUrlForCSP
259 * @covers ContentSecurityPolicy::prepareUrlForCSP
261 public function testPrepareUrlForCSP( $url, $expected ) {
262 $actual = $this->csp
->prepareUrlForCSP( $url );
263 $this->assertEquals( $actual, $expected, $url );
266 public function providerPrepareUrlForCSP() {
269 [ $wgServer, false ],
270 [ 'https://example.com', 'https://example.com' ],
271 [ 'https://example.com:200', 'https://example.com:200' ],
272 [ 'http://example.com', 'http://example.com' ],
273 [ 'example.com', 'example.com' ],
274 [ '*.example.com', '*.example.com' ],
275 [ 'https://*.example.com', 'https://*.example.com' ],
276 [ '//example.com', 'example.com' ],
277 [ 'https://example.com/path', 'https://example.com' ],
278 [ 'https://example.com/path:', 'https://example.com' ],
279 [ 'https://example.com/Wikipedia:NPOV', 'https://example.com' ],
280 [ 'https://tl;dr.com', 'https://tl%3Bdr.com' ],
281 [ 'yes,no.com', 'yes%2Cno.com' ],
282 [ '/relative-url', false ],
283 [ '/relativeUrl:withColon', false ],
284 [ 'data:', 'data:' ],
285 [ 'blob:', 'blob:' ],
290 * @covers ContentSecurityPolicy::escapeUrlForCSP
292 public function testEscapeUrlForCSP() {
293 $escaped = $this->csp
->escapeUrlForCSP( ',;%2B' );
294 $this->assertEquals( $escaped, '%2C%3B%2B' );
298 * @dataProvider providerCSPIsEnabled
299 * @covers ContentSecurityPolicy::isNonceRequired
301 public function testCSPIsEnabled( $main, $reportOnly, $expected ) {
302 $this->setMwGlobals( 'wgCSPReportOnlyHeader', $reportOnly );
303 $this->setMwGlobals( 'wgCSPHeader', $main );
304 $res = ContentSecurityPolicy
::isNonceRequired( RequestContext
::getMain()->getConfig() );
305 $this->assertEquals( $res, $expected );
308 public function providerCSPIsEnabled() {
310 [ true, true, true ],
311 [ false, true, true ],
312 [ true, false, true ],
313 [ false, false, false ],
316 [ [ 'default-src' => [ 'foo.example.com' ] ], false, true ],
317 [ [ 'useNonces' => false ], [ 'useNonces' => false ], false ],
318 [ [ 'useNonces' => true ], [ 'useNonces' => false ], true ],
319 [ [ 'useNonces' => false ], [ 'useNonces' => true ], true ],