4 files changed, 285 insertions, 0 deletions
diff --git a/railties/test/application/content_security_policy_test.rb b/railties/test/application/content_security_policy_test.rb
new file mode 100644
index 0000000000..97f2957c33
--- /dev/null
+++ b/railties/test/application/content_security_policy_test.rb
@@ -0,0 +1,197 @@
+# frozen_string_literal: true
+
+require "isolation/abstract_unit"
+require "rack/test"
+
+module ApplicationTests
+  class ContentSecurityPolicyTest < ActiveSupport::TestCase
+    include ActiveSupport::Testing::Isolation
+    include Rack::Test::Methods
+
+    def setup
+      build_app
+    end
+
+    def teardown
+      teardown_app
+    end
+
+    test "default content security policy is empty" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_equal ";", last_response.headers["Content-Security-Policy"]
+    end
+
+    test "global content security policy in an initializer" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src 'self' https:;"
+    end
+
+    test "global report only content security policy in an initializer" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+
+        Rails.application.config.content_security_policy_report_only = true
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src 'self' https:;", report_only: true
+    end
+
+    test "override content security policy in a controller" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          content_security_policy do |p|
+            p.default_src "https://example.com"
+          end
+
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src https://example.com;"
+    end
+
+    test "override content security policy to report only in a controller" do
+      controller :pages, <<-RUBY
+        class PagesController < ApplicationController
+          content_security_policy_report_only
+
+          def index
+            render html: "<h1>Welcome to Rails!</h1>"
+          end
+        end
+      RUBY
+
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+          root to: "pages#index"
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src 'self' https:;", report_only: true
+    end
+
+    test "global content security policy added to rack app" do
+      app_file "config/initializers/content_security_policy.rb", <<-RUBY
+        Rails.application.config.content_security_policy do |p|
+          p.default_src :self, :https
+        end
+      RUBY
+
+      app_file "config/routes.rb", <<-RUBY
+        Rails.application.routes.draw do
+
+          app = ->(env) {
+            [200, { "Content-Type" => "text/html" }, ["<p>Hello, World!</p>"]]
+          }
+
+          root to: app
+        end
+      RUBY
+
+      app("development")
+
+      get "/"
+      assert_policy "default-src 'self' https:;"
+    end
+
+    private
+
+      def assert_policy(expected, report_only: false)
+        assert_equal 200, last_response.status
+
+        if report_only
+          expected_header = "Content-Security-Policy-Report-Only"
+          unexpected_header = "Content-Security-Policy"
+        else
+          expected_header = "Content-Security-Policy"
+          unexpected_header = "Content-Security-Policy-Report-Only"
+        end
+
+        assert_nil last_response.headers[unexpected_header]
+        assert_equal expected, last_response.headers[expected_header]
+      end
+  end
+end
diff --git a/railties/test/application/middleware_test.rb b/railties/test/application/middleware_test.rb
index 0a5a524692..470a5326c6 100644
--- a/railties/test/application/middleware_test.rb
+++ b/railties/test/application/middleware_test.rb
@@ -42,6 +42,7 @@ module ApplicationTests
         "ActionDispatch::Cookies",
         "ActionDispatch::Session::CookieStore",
         "ActionDispatch::Flash",
+        "ActionDispatch::ContentSecurityPolicy::Middleware",
         "Rack::Head",
         "Rack::ConditionalGet",
         "Rack::ETag"
diff --git a/railties/test/application/rake/dbs_test.rb b/railties/test/application/rake/dbs_test.rb
index 0235210fdd..2082e9fa9f 100644
--- a/railties/test/application/rake/dbs_test.rb
+++ b/railties/test/application/rake/dbs_test.rb
@@ -98,6 +98,20 @@ module ApplicationTests
         end
       end
 
+      test "db:create works when schema cache exists and database does not exist" do
+        use_postgresql
+
+        begin
+          rails %w(db:create db:migrate db:schema:cache:dump)
+
+          rails "db:drop"
+          rails "db:create"
+          assert_equal 0, $?.exitstatus
+        ensure
+          rails "db:drop" rescue nil
+        end
+      end
+
       test "db:drop failure because database does not exist" do
         output = rails("db:drop:_unsafe", "--trace")
         assert_match(/does not exist/, output)
diff --git a/railties/test/application/test_runner_test.rb b/railties/test/application/test_runner_test.rb
index e92a0466dd..a01325fdb8 100644
--- a/railties/test/application/test_runner_test.rb
+++ b/railties/test/application/test_runner_test.rb
@@ -569,6 +569,40 @@ module ApplicationTests
       assert_match "AccountTest#test_truth", output, "passing TEST= should run selected test"
     end
 
+    def test_running_with_ruby_gets_test_env_by_default
+      # Subshells inherit `ENV`, so we need to ensure `RAILS_ENV` is set to
+      # nil before we run the tests in the test app.
+      re, ENV["RAILS_ENV"] = ENV["RAILS_ENV"], nil
+
+      file = create_test_for_env("test")
+      results = Dir.chdir(app_path) {
+        `ruby -Ilib:test #{file}`.each_line.map { |line| JSON.parse line }
+      }
+      assert_equal 1, results.length
+      failures = results.first["failures"]
+      flunk(failures.first) unless failures.empty?
+
+    ensure
+      ENV["RAILS_ENV"] = re
+    end
+
+    def test_running_with_ruby_can_set_env_via_cmdline
+      # Subshells inherit `ENV`, so we need to ensure `RAILS_ENV` is set to
+      # nil before we run the tests in the test app.
+      re, ENV["RAILS_ENV"] = ENV["RAILS_ENV"], nil
+
+      file = create_test_for_env("development")
+      results = Dir.chdir(app_path) {
+        `RAILS_ENV=development ruby -Ilib:test #{file}`.each_line.map { |line| JSON.parse line }
+      }
+      assert_equal 1, results.length
+      failures = results.first["failures"]
+      flunk(failures.first) unless failures.empty?
+
+    ensure
+      ENV["RAILS_ENV"] = re
+    end
+
     def test_rake_passes_multiple_TESTOPTS_to_minitest
       create_test_file :models, "account"
       output = Dir.chdir(app_path) { `bin/rake test TESTOPTS='-v --seed=1234'` }
@@ -727,6 +761,45 @@ module ApplicationTests
         app_file "db/schema.rb", ""
       end
 
+      def create_test_for_env(env)
+        app_file "test/models/environment_test.rb", <<-RUBY
+          require 'test_helper'
+          class JSONReporter < Minitest::AbstractReporter
+            def record(result)
+              puts JSON.dump(klass: result.class.name,
+                             name: result.name,
+                             failures: result.failures,
+                             assertions: result.assertions,
+                             time: result.time)
+            end
+          end
+
+          def Minitest.plugin_json_reporter_init(opts)
+            Minitest.reporter.reporters.clear
+            Minitest.reporter.reporters << JSONReporter.new
+          end
+
+          Minitest.extensions << "rails"
+          Minitest.extensions << "json_reporter"
+
+          # Minitest uses RubyGems to find plugins, and since RubyGems
+          # doesn't know about the Rails installation we're pointing at,
+          # Minitest won't require the Rails minitest plugin when we run
+          # these integration tests.  So we have to manually require the
+          # Minitest plugin here.
+          require 'minitest/rails_plugin'
+
+          class EnvironmentTest < ActiveSupport::TestCase
+            def test_environment
+              test_db = ActiveRecord::Base.configurations[#{env.dump}]["database"]
+              db_file = ActiveRecord::Base.connection_config[:database]
+              assert_match(test_db, db_file)
+              assert_equal #{env.dump}, ENV["RAILS_ENV"]
+            end
+          end
+        RUBY
+      end
+
       def create_test_file(path = :unit, name = "test", pass: true)
         app_file "test/#{path}/#{name}_test.rb", <<-RUBY
           require 'test_helper'