67 lines
2.2 KiB
JavaScript
67 lines
2.2 KiB
JavaScript
import assert from 'node:assert/strict'
|
|
import test from 'node:test'
|
|
import {
|
|
createCspAllowlistCandidates,
|
|
isCspAllowlistOriginCandidate,
|
|
normalizeCspSourceDirective
|
|
} from '../lib/csp-policy-suggestions.js'
|
|
|
|
test('CSP 세부 지시어는 강제 정책 후보 지시어로 묶는다', () => {
|
|
assert.equal(normalizeCspSourceDirective('script-src-elem'), 'script-src')
|
|
assert.equal(normalizeCspSourceDirective('style-src-attr'), 'style-src')
|
|
assert.equal(normalizeCspSourceDirective('child-src'), 'frame-src')
|
|
assert.equal(normalizeCspSourceDirective('base-uri'), '')
|
|
})
|
|
|
|
test('CSP 허용 후보 origin은 http와 https origin만 사용한다', () => {
|
|
assert.equal(isCspAllowlistOriginCandidate('https://cdn.example.com'), true)
|
|
assert.equal(isCspAllowlistOriginCandidate('http://localhost:43080'), true)
|
|
assert.equal(isCspAllowlistOriginCandidate('inline'), false)
|
|
assert.equal(isCspAllowlistOriginCandidate('data:'), false)
|
|
assert.equal(isCspAllowlistOriginCandidate('https://cdn.example.com/path/file.js'), false)
|
|
})
|
|
|
|
test('CSP 허용 후보는 지시어와 origin별로 집계한다', () => {
|
|
const candidates = createCspAllowlistCandidates([
|
|
{
|
|
effectiveDirective: 'script-src-elem',
|
|
blockedOrigin: 'https://cdn.example.com',
|
|
violationCount: 2,
|
|
lastSeenAt: '2026-07-29T01:00:00.000Z'
|
|
},
|
|
{
|
|
effectiveDirective: 'script-src',
|
|
blockedOrigin: 'https://cdn.example.com',
|
|
violationCount: 3,
|
|
lastSeenAt: '2026-07-29T02:00:00.000Z'
|
|
},
|
|
{
|
|
effectiveDirective: 'img-src',
|
|
blockedOrigin: 'data:',
|
|
violationCount: 8,
|
|
lastSeenAt: '2026-07-29T03:00:00.000Z'
|
|
},
|
|
{
|
|
effectiveDirective: 'frame-src',
|
|
blockedOrigin: 'https://player.example.com',
|
|
violationCount: 1,
|
|
lastSeenAt: '2026-07-29T04:00:00.000Z'
|
|
}
|
|
])
|
|
|
|
assert.deepEqual(candidates, [
|
|
{
|
|
sourceDirective: 'script-src',
|
|
blockedOrigin: 'https://cdn.example.com',
|
|
violationCount: 5,
|
|
lastSeenAt: '2026-07-29T02:00:00.000Z'
|
|
},
|
|
{
|
|
sourceDirective: 'frame-src',
|
|
blockedOrigin: 'https://player.example.com',
|
|
violationCount: 1,
|
|
lastSeenAt: '2026-07-29T04:00:00.000Z'
|
|
}
|
|
])
|
|
})
|