diff --git a/test/fixtures/nonce/pages/with-inline-script.vue b/test/fixtures/nonce/pages/with-inline-script.vue deleted file mode 100644 index d529a399..00000000 --- a/test/fixtures/nonce/pages/with-inline-script.vue +++ /dev/null @@ -1,13 +0,0 @@ - - - diff --git a/test/nonce.test.ts b/test/nonce.test.ts index f4c50ee4..5b6f64e2 100644 --- a/test/nonce.test.ts +++ b/test/nonce.test.ts @@ -7,7 +7,7 @@ describe('[nuxt-security] Nonce', async () => { rootDir: fileURLToPath(new URL('./fixtures/nonce', import.meta.url)) }) - const expectedNonceElements = 7 // 1 from app.vue/useHead, 6 for nuxt + const expectedNonceElements = 8 // 1 from app.vue/useHead, 6 for nuxt, 1 for plugin vue export helper it('injects `nonce` attribute in response', async () => { const res = await fetch('/') @@ -64,15 +64,6 @@ describe('[nuxt-security] Nonce', async () => { expect(cspHeaderValue).toBe("base-uri 'self'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data:; object-src 'none'; script-src-attr 'self' 'strict-dynamic'; style-src 'self' ; upgrade-insecure-requests; script-src 'self' 'strict-dynamic'") }) - it('does not add nonce to literal strings', async () => { - const res = await fetch('/with-inline-script') - - const text = await res.text() - const untouchedLiteral = text.includes('var inlineLiteral = \'