test: e2e tests for autoCsp #28701
test: e2e tests for autoCsp #28701
Conversation
| import { updateJsonFile, updateServerFileForWebpack, useSha } from '../../utils/project'; | ||
|
|
||
| const MULTI_HASH_CSP = | ||
| /script-src 'strict-dynamic' (?:'sha256-[^']+' )+https: 'unsafe-inline';object-src 'none';base-uri 'self';/; |
There was a problem hiding this comment.
At this level of abstraction I wouldn't assert on the policy this precisely, that's more of a unit test level assertion. Instead I'd just check:
- That a CSP policy was added (regex match for
<meta http-equiv="Content-Security-Policy"), don't care what the policy is. - That the browser did not error from that policy.
Optionally it might also be good to verify that the scripts actually executed (maybe just check that they printed to the console?). That way we know we aren't asserting too soon before the scripts have been checked, I think there's a low risk of a false positive there though, so probably not too important.
There was a problem hiding this comment.
I think verifying that there are no errors should cover the script execution cases but to ensure i think it would be good to check the console output for the added script logging (Inline Script...) cases as well.
dgp1130
added
action: review
| import { updateJsonFile, updateServerFileForWebpack, useSha } from '../../utils/project'; | ||
|
|
||
| const MULTI_HASH_CSP = | ||
| /script-src 'strict-dynamic' (?:'sha256-[^']+' )+https: 'unsafe-inline';object-src 'none';base-uri 'self';/; |
There was a problem hiding this comment.
I think verifying that there are no errors should cover the script execution cases but to ensure i think it would be good to check the console output for the added script logging (Inline Script...) cases as well.
alan-agius4
added
action: cleanup
PR Checklist
Please check to confirm your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
No e2e tests for #28663
Issue Number: N/A
What is the new behavior?
e2e tests for #28663
Does this PR introduce a breaking change?
Other information