22 lines
834 B
TypeScript
22 lines
834 B
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { buildContentSecurityPolicy, createCspNonce } from "./csp";
|
|
|
|
describe("csp", () => {
|
|
it("creates a non-empty base64 nonce", () => {
|
|
const nonce = createCspNonce();
|
|
expect(nonce.length).toBeGreaterThan(8);
|
|
expect(nonce).toMatch(/^[A-Za-z0-9+/=]+$/);
|
|
});
|
|
|
|
it("uses a script nonce and omits script unsafe-inline", () => {
|
|
const csp = buildContentSecurityPolicy("testNonce123");
|
|
expect(csp).toContain("script-src");
|
|
expect(csp).toContain("'nonce-testNonce123'");
|
|
expect(csp).not.toMatch(/script-src[^;]*'unsafe-inline'/);
|
|
expect(csp).toContain("style-src 'self' 'unsafe-inline'");
|
|
expect(csp).toContain("style-src-attr 'unsafe-inline'");
|
|
expect(csp).toContain("https://challenges.cloudflare.com");
|
|
expect(csp).toContain("https://cdn.jsdelivr.net");
|
|
});
|
|
});
|