Skip to content

Commit 06ce988

Browse files
djbedjbe
committed
Add tests for CSP
1 parent e8c11bb commit 06ce988

File tree

30 files changed

+384
-0
lines changed

30 files changed

+384
-0
lines changed

‎tests/nuxt-base/final/csp/env.properties‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
NGINX_CSP_CHILD_SRC="https://children.environment.com data:"
2+
NGINX_CSP_CONNECT_SRC="https://connection.environment.com data:"
3+
NGINX_CSP_FONT_SRC="https://fonts.environment.com data:"
4+
NGINX_CSP_FORM_ACTION="https://forms.environment.com data:"
5+
NGINX_CSP_FRAME_ANCESTORS="https://frames-anc.environment.com"
6+
NGINX_CSP_FRAME_SRC="https://frames.environment.com data:"
7+
NGINX_CSP_IMG_SRC="https://imgs.environment.com data:"
8+
NGINX_CSP_MANIFEST_SRC="https://manifests.environment.com data:"
9+
NGINX_CSP_MEDIA_SRC="https://media.environment.com data:"
10+
NGINX_CSP_OBJECT_SRC="https://objects.environment.com data:"
11+
NGINX_CSP_REQUIRE_TRUSTED_TYPES_FOR=""
12+
NGINX_CSP_SCRIPT_SRC="https://scripts.environment.com data: 'unsafe-inline'"
13+
NGINX_CSP_STYLE_SRC="https://styles.environment.com data: 'unsafe-inline'"
14+
NGINX_CSP_TRUSTED_TYPES="environment-foo env-bar"
15+
NGINX_CSP_WORKER_SRC="https://workers.environment.com data:"
16+
17+
NGINX_CSP_MODE=report-only
18+
NGINX_CSP_REPORT_URI=https://sentry.appwi.se/api/347/security/?sentry_key=foo123
19+
NGINX_FRAME_OPTIONS=sameorigin

‎tests/nuxt-base/final/csp/extra-files/csp.properties‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
CHILD_SRC="https://children.embedded.com 'self'"
2+
CONNECT_SRC="https://connection.embedded.com 'self'"
3+
FONT_SRC="https://fonts.embedded.com 'self'"
4+
FORM_ACTION="https://forms.embedded.com 'self'"
5+
FRAME_ANCESTORS="https://frames-anc.embedded.com"
6+
FRAME_SRC="https://frames.embedded.com 'self'"
7+
IMG_SRC="https://imgs.embedded.com 'self'"
8+
MANIFEST_SRC="https://manifests.embedded.com 'self'"
9+
MEDIA_SRC="https://media.embedded.com 'self'"
10+
OBJECT_SRC="https://objects.embedded.com 'self'"
11+
REQUIRE_TRUSTED_TYPES_FOR="'script'"
12+
SCRIPT_SRC="https://scripts.embedded.com 'self' 'unsafe-inline'"
13+
STYLE_SRC="https://styles.embedded.com 'self' 'unsafe-inline'"
14+
TRUSTED_TYPES="embedded-foo 'allow-duplicates'"
15+
WORKER_SRC="https://workers.embedded.com 'self'"

‎tests/nuxt-base/final/csp/goss.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
http:
3+
check envs and secrets:
4+
headers:
5+
- >-
6+
Content-Security-Policy-Report-Only:
7+
default-src 'self';
8+
child-src https://children.embedded.com 'self' https://children.environment.com data:;
9+
connect-src https://connection.embedded.com 'self' https://connection.environment.com data:;
10+
font-src https://fonts.embedded.com 'self' https://fonts.environment.com data:;
11+
form-action https://forms.embedded.com 'self' https://forms.environment.com data:;
12+
frame-ancestors https://frames-anc.embedded.com https://frames-anc.environment.com;
13+
frame-src https://frames.embedded.com 'self' https://frames.environment.com data:;
14+
img-src https://imgs.embedded.com 'self' https://imgs.environment.com data:;
15+
manifest-src https://manifests.embedded.com 'self' https://manifests.environment.com data:;
16+
media-src https://media.embedded.com 'self' https://media.environment.com data:;
17+
object-src https://objects.embedded.com 'self' https://objects.environment.com data:;
18+
require-trusted-types-for 'script';
19+
script-src https://scripts.embedded.com 'self' 'unsafe-inline' https://scripts.environment.com data: 'unsafe-inline';
20+
style-src https://styles.embedded.com 'self' 'unsafe-inline' https://styles.environment.com data: 'unsafe-inline';
21+
trusted-types embedded-foo 'allow-duplicates' environment-foo env-bar;
22+
worker-src https://workers.embedded.com 'self' https://workers.environment.com data:;
23+
report-uri https://sentry.appwi.se/api/347/security/?sentry_key=foo123;
24+
- 'X-Frame-Options: sameorigin'
25+
status: 200
26+
url: http://localhost:8080/

‎tests/nuxt-base/final/csp/goss_wait.yaml‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
---
2+
command:
3+
node monitor:
4+
exec: 's6-svstat -u /run/service/node-memory-monitor'
5+
exit-status: 0
6+
stdout:
7+
- 'true'
8+
port:
9+
tcp:8080:
10+
listening: true
11+
ip:
12+
- 0.0.0.0
13+
process:
14+
nginx:
15+
running: true
16+
node:
17+
running: true

‎tests/nuxt-base/final/csp/run_overrides‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
CUSTOM_ARGUMENTS=(
2+
--mount "type=bind,ro,source=$PWD/extra-files/csp.properties,target=/etc/csp-generator/default"
3+
)

‎tests/nuxt-base/final/default/goss.yaml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,12 +5,14 @@ http:
55
body:
66
- 'Hey from index.mjs'
77
headers:
8+
- 'Content-Security-Policy: default-src ''self'';'
89
- 'Cross-Origin-Opener-Policy: same-origin'
910
- 'Cross-Origin-Resource-Policy: same-origin'
1011
- 'Permissions-Policy: interest-cohort=()'
1112
- 'Referrer-Policy: same-origin'
1213
- 'Strict-Transport-Security'
1314
- 'X-Content-Type-Options: nosniff'
15+
- 'X-Frame-Options: deny'
1416
- 'X-Permitted-Cross-Domain-Policies: none'
1517
- 'X-Robots-Tag: none'
1618
status: 200

‎tests/payload-base/final/csp/env.properties‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
NGINX_CSP_CHILD_SRC="https://children.environment.com data:"
2+
NGINX_CSP_CONNECT_SRC="https://connection.environment.com data:"
3+
NGINX_CSP_FONT_SRC="https://fonts.environment.com data:"
4+
NGINX_CSP_FORM_ACTION="https://forms.environment.com data:"
5+
NGINX_CSP_FRAME_ANCESTORS="https://frames-anc.environment.com"
6+
NGINX_CSP_FRAME_SRC="https://frames.environment.com data:"
7+
NGINX_CSP_IMG_SRC="https://imgs.environment.com data:"
8+
NGINX_CSP_MANIFEST_SRC="https://manifests.environment.com data:"
9+
NGINX_CSP_MEDIA_SRC="https://media.environment.com data:"
10+
NGINX_CSP_OBJECT_SRC="https://objects.environment.com data:"
11+
NGINX_CSP_REQUIRE_TRUSTED_TYPES_FOR=""
12+
NGINX_CSP_SCRIPT_SRC="https://scripts.environment.com data: 'unsafe-inline'"
13+
NGINX_CSP_STYLE_SRC="https://styles.environment.com data: 'unsafe-inline'"
14+
NGINX_CSP_TRUSTED_TYPES="environment-foo env-bar"
15+
NGINX_CSP_WORKER_SRC="https://workers.environment.com data:"
16+
17+
NGINX_CSP_MODE=report-only
18+
NGINX_CSP_REPORT_URI=https://sentry.appwi.se/api/347/security/?sentry_key=foo123
19+
NGINX_FRAME_OPTIONS=sameorigin

‎tests/payload-base/final/csp/extra-files/csp.properties‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
CHILD_SRC="https://children.embedded.com 'self'"
2+
CONNECT_SRC="https://connection.embedded.com 'self'"
3+
FONT_SRC="https://fonts.embedded.com 'self'"
4+
FORM_ACTION="https://forms.embedded.com 'self'"
5+
FRAME_ANCESTORS="https://frames-anc.embedded.com"
6+
FRAME_SRC="https://frames.embedded.com 'self'"
7+
IMG_SRC="https://imgs.embedded.com 'self'"
8+
MANIFEST_SRC="https://manifests.embedded.com 'self'"
9+
MEDIA_SRC="https://media.embedded.com 'self'"
10+
OBJECT_SRC="https://objects.embedded.com 'self'"
11+
REQUIRE_TRUSTED_TYPES_FOR="'script'"
12+
SCRIPT_SRC="https://scripts.embedded.com 'self' 'unsafe-inline'"
13+
STYLE_SRC="https://styles.embedded.com 'self' 'unsafe-inline'"
14+
TRUSTED_TYPES="embedded-foo 'allow-duplicates'"
15+
WORKER_SRC="https://workers.embedded.com 'self'"

‎tests/payload-base/final/csp/goss.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
---
2+
http:
3+
check envs and secrets:
4+
headers:
5+
- >-
6+
Content-Security-Policy-Report-Only:
7+
default-src 'self';
8+
child-src https://children.embedded.com 'self' https://children.environment.com data:;
9+
connect-src https://connection.embedded.com 'self' https://connection.environment.com data:;
10+
font-src https://fonts.embedded.com 'self' https://fonts.environment.com data:;
11+
form-action https://forms.embedded.com 'self' https://forms.environment.com data:;
12+
frame-ancestors https://frames-anc.embedded.com https://frames-anc.environment.com;
13+
frame-src https://frames.embedded.com 'self' https://frames.environment.com data:;
14+
img-src https://imgs.embedded.com 'self' https://imgs.environment.com data:;
15+
manifest-src https://manifests.embedded.com 'self' https://manifests.environment.com data:;
16+
media-src https://media.embedded.com 'self' https://media.environment.com data:;
17+
object-src https://objects.embedded.com 'self' https://objects.environment.com data:;
18+
require-trusted-types-for 'script';
19+
script-src https://scripts.embedded.com 'self' 'unsafe-inline' https://scripts.environment.com data: 'unsafe-inline';
20+
style-src https://styles.embedded.com 'self' 'unsafe-inline' https://styles.environment.com data: 'unsafe-inline';
21+
trusted-types embedded-foo 'allow-duplicates' environment-foo env-bar;
22+
worker-src https://workers.embedded.com 'self' https://workers.environment.com data:;
23+
report-uri https://sentry.appwi.se/api/347/security/?sentry_key=foo123;
24+
- 'X-Frame-Options: sameorigin'
25+
status: 200
26+
url: http://localhost:8080/

‎tests/payload-base/final/csp/goss_wait.yaml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
---
2+
port:
3+
tcp:8080:
4+
listening: true
5+
ip:
6+
- 0.0.0.0
7+
process:
8+
nginx:
9+
running: true
10+
node:
11+
running: true

0 commit comments

Comments
 (0)