diff options
author | Guillermo Iguaran <guilleiguaran@gmail.com> | 2019-07-08 10:20:45 -0500 |
---|---|---|
committer | GitHub <noreply@github.com> | 2019-07-08 10:20:45 -0500 |
commit | c00cd7b446aaeb8e2486142938238b26c48ed711 (patch) | |
tree | d33b5cb6ab8bf61f4f04ac5731c54a2336661461 /railties/test/application/content_security_policy_test.rb | |
parent | fe30211574648fa21bff958a3cf952fd0c20c3b1 (diff) | |
parent | 84ff4f6ea2a118b47160e3fe7ed29bff52c2a7a2 (diff) | |
download | rails-c00cd7b446aaeb8e2486142938238b26c48ed711.tar.gz rails-c00cd7b446aaeb8e2486142938238b26c48ed711.tar.bz2 rails-c00cd7b446aaeb8e2486142938238b26c48ed711.zip |
Merge branch 'master' into add_database_exist_method
Diffstat (limited to 'railties/test/application/content_security_policy_test.rb')
-rw-r--r-- | railties/test/application/content_security_policy_test.rb | 32 |
1 files changed, 32 insertions, 0 deletions
diff --git a/railties/test/application/content_security_policy_test.rb b/railties/test/application/content_security_policy_test.rb index 3338bcb47d..0bb6ee917a 100644 --- a/railties/test/application/content_security_policy_test.rb +++ b/railties/test/application/content_security_policy_test.rb @@ -119,6 +119,38 @@ module ApplicationTests assert_policy "default-src 'self' https:", report_only: true end + test "global content security policy nonce directives in an initializer" do + controller :pages, <<-RUBY + class PagesController < ApplicationController + def index + render html: "<h1>Welcome to Rails!</h1>" + end + end + RUBY + + app_file "config/initializers/content_security_policy.rb", <<-RUBY + Rails.application.config.content_security_policy do |p| + p.default_src :self, :https + p.script_src :self, :https + p.style_src :self, :https + end + + Rails.application.config.content_security_policy_nonce_generator = proc { "iyhD0Yc0W+c=" } + Rails.application.config.content_security_policy_nonce_directives = %w(script-src) + RUBY + + app_file "config/routes.rb", <<-RUBY + Rails.application.routes.draw do + root to: "pages#index" + end + RUBY + + app("development") + + get "/" + assert_policy "default-src 'self' https:; script-src 'self' https: 'nonce-iyhD0Yc0W+c='; style-src 'self' https:" + end + test "override content security policy in a controller" do controller :pages, <<-RUBY class PagesController < ApplicationController |