Skip to content

Commit d59ec72

Browse files
JaredCEJaredCE
committed
updates owasp spec
1 parent 299cf11 commit d59ec72

File tree

1 file changed

+106
-99
lines changed

1 file changed

+106
-99
lines changed

‎test/unit/owasp.spec.js‎

Lines changed: 106 additions & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -1,113 +1,120 @@
1-
'use strict'
1+
"use strict";
22

3-
const expect = require('chai').expect
4-
const nock = require('nock')
3+
const expect = require("chai").expect;
4+
const nock = require("nock");
55

6-
const owasp = require('../../src/owasp')
6+
const owasp = require("../../src/owasp");
77

8-
const owaspJSON = require('../../json/owasp.json')
9-
const newOWASPJSON = require('../json/newOWASP.json')
8+
const owaspJSON = require("../../json/owasp.json");
9+
const newOWASPJSON = require("../json/newOWASP.json");
1010

1111
describe(`owasp`, function () {
12-
describe(`getLatest`, function () {
13-
it(`populates the defaults from the included OWASP release when the online version can not be reached`, async function() {
14-
nock('https://owasp.org')
15-
.get('/www-project-secure-headers/ci/headers_add.json')
16-
.reply(404, {})
17-
18-
await owasp.getLatest()
19-
.catch(err => {
20-
console.error(err)
21-
expect(err).to.be.undefined
22-
})
23-
24-
expect(owasp.DEFAULT_OWASP_HEADERS['Permissions-Policy']).to.have.property('schema')
25-
const permissionsPolicyDefault = owaspJSON.headers.filter(obj => obj.name === 'Permissions-Policy')
26-
expect(owasp.DEFAULT_OWASP_HEADERS['Permissions-Policy'].schema.default).to.be.equal(permissionsPolicyDefault[0].value)
27-
expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(13)
28-
});
29-
30-
it(`populates the defaults with information from a new OWASP release`, async function() {
31-
nock('https://owasp.org')
32-
.get('/www-project-secure-headers/ci/headers_add.json')
33-
.reply(200, newOWASPJSON)
34-
35-
await owasp.getLatest()
36-
.catch(err => {
37-
console.error(err)
38-
expect(err).to.be.undefined
39-
})
40-
41-
expect(owasp.DEFAULT_OWASP_HEADERS['Cross-Origin-Embedder-Policy']).to.have.property('schema')
42-
const newCrossOriginEmbedderPolicy = newOWASPJSON.headers.filter(obj => obj.name === 'Cross-Origin-Embedder-Policy')
43-
expect(owasp.DEFAULT_OWASP_HEADERS['Cross-Origin-Embedder-Policy'].schema.default).to.be.equal(newCrossOriginEmbedderPolicy[0].value)
44-
expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(13)
45-
});
46-
47-
it(`does not remove any defaults not contained in a new release`, async function() {
48-
const newOWASPJSONMissing = JSON.parse(JSON.stringify(newOWASPJSON))
49-
50-
const headers = newOWASPJSONMissing.headers.filter(obj => obj.name !== 'Pragma')
51-
newOWASPJSONMissing.headers = headers
52-
53-
nock('https://owasp.org')
54-
.get('/www-project-secure-headers/ci/headers_add.json')
55-
.reply(200, newOWASPJSONMissing)
56-
57-
await owasp.getLatest()
58-
.catch(err => {
59-
console.error(err)
60-
expect(err).to.be.undefined
61-
})
62-
63-
expect(owasp.DEFAULT_OWASP_HEADERS).to.have.property('Pragma')
64-
expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(13)
65-
});
66-
67-
it(`adds any properties contained in a new release`, async function() {
68-
const newOWASPJSONAdded = JSON.parse(JSON.stringify(newOWASPJSON))
69-
newOWASPJSONAdded.headers.push({name: 'x-added', value: 'true'})
70-
71-
nock('https://owasp.org')
72-
.get('/www-project-secure-headers/ci/headers_add.json')
73-
.reply(200, newOWASPJSONAdded)
74-
75-
await owasp.getLatest()
76-
.catch(err => {
77-
console.error(err)
78-
expect(err).to.be.undefined
79-
})
80-
81-
expect(owasp.DEFAULT_OWASP_HEADERS).to.have.property('x-added')
82-
expect(owasp.DEFAULT_OWASP_HEADERS['x-added']).to.have.property('schema')
83-
expect(owasp.DEFAULT_OWASP_HEADERS['x-added'].schema.default).to.be.equal('true')
84-
expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(14)
85-
});
12+
describe(`getLatest`, function () {
13+
it(`populates the defaults from the included OWASP release when the online version can not be reached`, async function () {
14+
nock("https://owasp.org")
15+
.get("/www-project-secure-headers/ci/headers_add.json")
16+
.reply(404, {});
17+
18+
await owasp.getLatest().catch((err) => {
19+
console.error(err);
20+
expect(err).to.be.undefined;
21+
});
22+
23+
expect(
24+
owasp.DEFAULT_OWASP_HEADERS["Permissions-Policy"]
25+
).to.have.property("schema");
26+
const permissionsPolicyDefault = owaspJSON.headers.filter(
27+
(obj) => obj.name === "Permissions-Policy"
28+
);
29+
expect(
30+
owasp.DEFAULT_OWASP_HEADERS["Permissions-Policy"].schema.default
31+
).to.be.equal(permissionsPolicyDefault[0].value);
32+
expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(12);
8633
});
8734

88-
describe(`getHeaders`, function () {
89-
it(`brings back default headers from a list`, function() {
90-
const headerOptions = {cacheControl: true, xFrameOptions: true}
91-
const headers = owasp.getHeaders(headerOptions)
35+
it(`populates the defaults with information from a new OWASP release`, async function () {
36+
nock("https://owasp.org")
37+
.get("/www-project-secure-headers/ci/headers_add.json")
38+
.reply(200, newOWASPJSON);
39+
40+
await owasp.getLatest().catch((err) => {
41+
console.error(err);
42+
expect(err).to.be.undefined;
43+
});
44+
45+
expect(
46+
owasp.DEFAULT_OWASP_HEADERS["Cross-Origin-Embedder-Policy"]
47+
).to.have.property("schema");
48+
const newCrossOriginEmbedderPolicy = newOWASPJSON.headers.filter(
49+
(obj) => obj.name === "Cross-Origin-Embedder-Policy"
50+
);
51+
expect(
52+
owasp.DEFAULT_OWASP_HEADERS["Cross-Origin-Embedder-Policy"].schema
53+
.default
54+
).to.be.equal(newCrossOriginEmbedderPolicy[0].value);
55+
expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(12);
56+
});
57+
58+
it(`adds any properties contained in a new release`, async function () {
59+
const newOWASPJSONAdded = JSON.parse(JSON.stringify(newOWASPJSON));
60+
newOWASPJSONAdded.headers.push({ name: "x-added", value: "true" });
61+
62+
nock("https://owasp.org")
63+
.get("/www-project-secure-headers/ci/headers_add.json")
64+
.reply(200, newOWASPJSONAdded);
65+
66+
await owasp.getLatest().catch((err) => {
67+
console.error(err);
68+
expect(err).to.be.undefined;
69+
});
70+
71+
expect(owasp.DEFAULT_OWASP_HEADERS).to.have.property("x-added");
72+
expect(owasp.DEFAULT_OWASP_HEADERS["x-added"]).to.have.property("schema");
73+
expect(owasp.DEFAULT_OWASP_HEADERS["x-added"].schema.default).to.be.equal(
74+
"true"
75+
);
76+
expect(Object.keys(owasp.DEFAULT_OWASP_HEADERS).length).to.be.equal(13);
77+
});
78+
});
79+
80+
describe(`getHeaders`, function () {
81+
it(`brings back default headers from a list`, function () {
82+
const headerOptions = { cacheControl: true, xFrameOptions: true };
83+
const headers = owasp.getHeaders(headerOptions);
84+
85+
expect(Object.keys(headers).length).to.be.equal(2);
86+
});
87+
88+
it(`brings back default headers from a list with new schema defaults when values are provided`, function () {
89+
const headerOptions = {
90+
referrerPolicy: {
91+
value: "true",
92+
},
93+
crossOriginOpenerPolicy: {
94+
value: "strict",
95+
},
96+
};
97+
98+
const headers = owasp.getHeaders(headerOptions);
9299

93-
expect(Object.keys(headers).length).to.be.equal(2)
94-
});
100+
expect(Object.keys(headers).length).to.be.equal(2);
101+
102+
expect(headers["Cross-Origin-Opener-Policy"].schema.default === "strict");
103+
});
95104

96-
it(`brings back default headers from a list with new schema defaults when values are provided`, function() {
97-
const headerOptions = {
98-
referrerPolicy: {
99-
value: 'true'
100-
},
101-
crossOriginOpenerPolicy: {
102-
value: 'strict'
103-
}
104-
}
105+
it(`handles pragma being deprecated`, function () {
106+
const headerOptions = {
107+
pragma: {
108+
value: "true",
109+
},
110+
};
105111

106-
const headers = owasp.getHeaders(headerOptions)
112+
const headers = owasp.getHeaders(headerOptions);
107113

108-
expect(Object.keys(headers).length).to.be.equal(2)
114+
expect(Object.keys(headers).length).to.be.equal(1);
109115

110-
expect(headers['Cross-Origin-Opener-Policy'].schema.default === 'strict')
111-
});
116+
expect(headers["Pragma"]).to.have.property("schema");
117+
expect(headers["Pragma"].schema).to.have.property("default", "true");
112118
});
119+
});
113120
});

0 commit comments

Comments
 (0)