3 use Wikimedia\TestingAccessWrapper
;
5 class ContentSecurityPolicyTest
extends MediaWikiTestCase
{
6 /** @var ContentSecurityPolicy */
9 protected function setUp() {
10 global $wgUploadDirectory;
11 $this->setMwGlobals( [
12 'wgAllowExternalImages' => false,
13 'wgAllowExternalImagesFrom' => [],
14 'wgAllowImageTag' => false,
15 'wgEnableImageWhitelist' => false,
16 'wgLoadScript' => false,
17 'wgExtensionAssetsPath' => false,
18 'wgStylePath' => false,
19 'wgResourceBasePath' => null,
20 'wgCrossSiteAJAXdomains' => [
21 'sister-site.somewhere.com',
25 'wgScriptPath' => '/w',
26 'wgForeignFileRepos' => [ [
27 'class' => ForeignAPIRepo
::class,
28 'name' => 'wikimediacommons',
29 'apibase' => 'https://commons.wikimedia.org/w/api.php',
30 'url' => 'https://upload.wikimedia.org/wikipedia/commons',
31 'thumbUrl' => 'https://upload.wikimedia.org/wikipedia/commons/thumb',
33 'transformVia404' => true,
34 'fetchDescription' => true,
35 'descriptionCacheExpiry' => 43200,
36 'apiThumbCacheExpiry' => 0,
37 'directory' => $wgUploadDirectory,
38 'backend' => 'wikimediacommons-backend',
41 // Note, there are some obscure globals which
42 // could affect the results which aren't included above.
44 $this->overrideMwServices();
45 $context = RequestContext
::getMain();
46 $resp = $context->getRequest()->response();
47 $conf = $context->getConfig();
48 $csp = new ContentSecurityPolicy( 'secret', $resp, $conf );
49 $this->csp
= TestingAccessWrapper
::newFromObject( $csp );
51 return parent
::setUp();
55 * @covers ContentSecurityPolicy::getAdditionalSelfUrls
57 public function testGetAdditionalSelfUrlsRespectsUrlSettings() {
58 $this->setMwGlobals( 'wgLoadScript', 'https://wgLoadScript.example.org/load.php' );
59 $this->setMwGlobals( 'wgExtensionAssetsPath',
60 'https://wgExtensionAssetsPath.example.org/assets/' );
61 $this->setMwGlobals( 'wgStylePath', 'https://wgStylePath.example.org/style/' );
62 $this->setMwGlobals( 'wgResourceBasePath', 'https://wgResourceBasePath.example.org/resources/' );
66 'https://upload.wikimedia.org',
67 'https://commons.wikimedia.org',
68 'https://wgLoadScript.example.org',
69 'https://wgExtensionAssetsPath.example.org',
70 'https://wgStylePath.example.org',
71 'https://wgResourceBasePath.example.org',
73 array_values( $this->csp
->getAdditionalSelfUrls() )
78 * @dataProvider providerFalsePositiveBrowser
79 * @covers ContentSecurityPolicy::falsePositiveBrowser
81 public function testFalsePositiveBrowser( $ua, $expected ) {
82 $actual = ContentSecurityPolicy
::falsePositiveBrowser( $ua );
83 $this->assertEquals( $expected, $actual, $ua );
86 public function providerFalsePositiveBrowser() {
87 // @codingStandardsIgnoreStart Generic.Files.LineLength
89 [ 'Mozilla/5.0 (X11; Linux i686; rv:41.0) Gecko/20100101 Firefox/41.0', true ],
90 [ 'Mozilla/5.0 (X11; U; Linux i686; en-ca) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+ Debian/squeeze (2.30.6-1) Epiphany/2.30.6', false ]
92 // @codingStandardsIgnoreEnd Generic.Files.LineLength
96 * @dataProvider providerMakeCSPDirectives
97 * @covers ContentSecurityPolicy::makeCSPDirectives
99 public function testMakeCSPDirectives(
104 $actualFull = $this->csp
->makeCSPDirectives( $policy, ContentSecurityPolicy
::FULL_MODE
);
105 $actualReport = $this->csp
->makeCSPDirectives(
106 $policy, ContentSecurityPolicy
::REPORT_ONLY_MODE
108 $policyJson = formatJson
::encode( $policy );
109 $this->assertEquals( $expectedFull, $actualFull, "full: " . $policyJson );
110 $this->assertEquals( $expectedReport, $actualReport, "report: " . $policyJson );
113 public function providerMakeCSPDirectives() {
114 // @codingStandardsIgnoreStart Generic.Files.LineLength
118 [ 'useNonces' => false ],
119 "script-src 'unsafe-eval' 'self' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
120 "script-src 'unsafe-eval' 'self' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
121 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'"
125 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
126 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
130 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
131 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
134 [ 'script-src' => [ 'http://example.com', 'http://something,else.com' ] ],
135 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
136 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
139 [ 'unsafeFallback' => false ],
140 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
141 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
144 [ 'unsafeFallback' => true ],
145 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
146 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
149 [ 'default-src' => false ],
150 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
151 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
154 [ 'default-src' => true ],
155 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
156 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
159 [ 'default-src' => [ 'https://foo.com', 'http://bar.com', 'baz.de' ] ],
160 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
161 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
164 [ 'includeCORS' => false ],
165 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
166 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
169 [ 'includeCORS' => false, 'default-src' => true ],
170 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
171 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
174 [ 'includeCORS' => true ],
175 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
176 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
179 [ 'report-uri' => false ],
180 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
181 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
184 [ 'report-uri' => true ],
185 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
186 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
189 [ 'report-uri' => 'https://example.com/index.php?foo;report=csp' ],
190 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
191 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
197 * @covers ContentSecurityPolicy::makeCSPDirectives
199 public function testMakeCSPDirectivesImage() {
200 global $wgAllowImageTag;
201 $origImg = wfSetVar( $wgAllowImageTag, true );
203 $actual = $this->csp
->makeCSPDirectives( true, ContentSecurityPolicy
::FULL_MODE
);
205 $wgAllowImageTag = $origImg;
207 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&";
208 $this->assertEquals( $expected, $actual );
212 * @covers ContentSecurityPolicy::makeCSPDirectives
214 public function testMakeCSPDirectivesReportUri() {
215 $actual = $this->csp
->makeCSPDirectives(
217 ContentSecurityPolicy
::REPORT_ONLY_MODE
219 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&";
220 $this->assertEquals( $expected, $actual );
221 // @codingStandardsIgnoreEnd Generic.Files.LineLength
225 * @covers ContentSecurityPolicy::getHeaderName
227 public function testGetHeaderName() {
229 $this->csp
->getHeaderName( ContentSecurityPolicy
::REPORT_ONLY_MODE
),
230 'Content-Security-Policy-Report-Only'
233 $this->csp
->getHeaderName( ContentSecurityPolicy
::FULL_MODE
),
234 'Content-Security-Policy'
239 * @covers ContentSecurityPolicy::getReportUri
241 public function testGetReportUri() {
242 $full = $this->csp
->getReportUri( ContentSecurityPolicy
::FULL_MODE
);
243 $fullExpected = '/w/api.php?action=cspreport&format=json&';
244 $this->assertEquals( $full, $fullExpected, 'normal report uri' );
246 $report = $this->csp
->getReportUri( ContentSecurityPolicy
::REPORT_ONLY_MODE
);
247 $reportExpected = $fullExpected . 'reportonly=1&';
248 $this->assertEquals( $report, $reportExpected, 'report only' );
250 global $wgScriptPath;
251 $origPath = wfSetVar( $wgScriptPath, '/tl;dr/a,%20wiki' );
252 $esc = $this->csp
->getReportUri( ContentSecurityPolicy
::FULL_MODE
);
253 $escExpected = '/tl%3Bdr/a%2C%20wiki/api.php?action=cspreport&format=json&';
254 $wgScriptPath = $origPath;
255 $this->assertEquals( $esc, $escExpected, 'test esc rules' );
259 * @dataProvider providerPrepareUrlForCSP
260 * @covers ContentSecurityPolicy::prepareUrlForCSP
262 public function testPrepareUrlForCSP( $url, $expected ) {
263 $actual = $this->csp
->prepareUrlForCSP( $url );
264 $this->assertEquals( $actual, $expected, $url );
267 public function providerPrepareUrlForCSP() {
270 [ $wgServer, false ],
271 [ 'https://example.com', 'https://example.com' ],
272 [ 'https://example.com:200', 'https://example.com:200' ],
273 [ 'http://example.com', 'http://example.com' ],
274 [ 'example.com', 'example.com' ],
275 [ '*.example.com', '*.example.com' ],
276 [ 'https://*.example.com', 'https://*.example.com' ],
277 [ '//example.com', 'example.com' ],
278 [ 'https://example.com/path', 'https://example.com' ],
279 [ 'https://example.com/path:', 'https://example.com' ],
280 [ 'https://example.com/Wikipedia:NPOV', 'https://example.com' ],
281 [ 'https://tl;dr.com', 'https://tl%3Bdr.com' ],
282 [ 'yes,no.com', 'yes%2Cno.com' ],
283 [ '/relative-url', false ],
284 [ '/relativeUrl:withColon', false ],
285 [ 'data:', 'data:' ],
286 [ 'blob:', 'blob:' ],
291 * @covers ContentSecurityPolicy::escapeUrlForCSP
293 public function testEscapeUrlForCSP() {
294 $escaped = $this->csp
->escapeUrlForCSP( ',;%2B' );
295 $this->assertEquals( $escaped, '%2C%3B%2B' );
299 * @dataProvider providerCSPIsEnabled
300 * @covers ContentSecurityPolicy::isNonceRequired
302 public function testCSPIsEnabled( $main, $reportOnly, $expected ) {
303 $this->setMwGlobals( 'wgCSPReportOnlyHeader', $reportOnly );
304 $this->setMwGlobals( 'wgCSPHeader', $main );
305 $res = ContentSecurityPolicy
::isNonceRequired( RequestContext
::getMain()->getConfig() );
306 $this->assertEquals( $res, $expected );
309 public function providerCSPIsEnabled() {
311 [ true, true, true ],
312 [ false, true, true ],
313 [ true, false, true ],
314 [ false, false, false ],
317 [ [ 'default-src' => [ 'foo.example.com' ] ], false, true ],
318 [ [ 'useNonces' => false ], [ 'useNonces' => false ], false ],
319 [ [ 'useNonces' => true ], [ 'useNonces' => false ], true ],
320 [ [ 'useNonces' => false ], [ 'useNonces' => true ], true ],