diff options
author | GitLab Bot <gitlab-bot@gitlab.com> | 2022-08-18 11:17:02 +0300 |
---|---|---|
committer | GitLab Bot <gitlab-bot@gitlab.com> | 2022-08-18 11:17:02 +0300 |
commit | b39512ed755239198a9c294b6a45e65c05900235 (patch) | |
tree | d234a3efade1de67c46b9e5a38ce813627726aa7 /spec/requests/api/api_spec.rb | |
parent | d31474cf3b17ece37939d20082b07f6657cc79a9 (diff) |
Add latest changes from gitlab-org/gitlab@15-3-stable-eev15.3.0-rc42
Diffstat (limited to 'spec/requests/api/api_spec.rb')
-rw-r--r-- | spec/requests/api/api_spec.rb | 50 |
1 files changed, 50 insertions, 0 deletions
diff --git a/spec/requests/api/api_spec.rb b/spec/requests/api/api_spec.rb index b6cb790bb71..260f7cbc226 100644 --- a/spec/requests/api/api_spec.rb +++ b/spec/requests/api/api_spec.rb @@ -262,4 +262,54 @@ RSpec.describe API::API do end end end + + describe 'content security policy header' do + let_it_be(:user) { create(:user) } + + let(:csp) { nil } + let(:report_only) { false } + + subject { get api("/users/#{user.id}", user) } + + before do + allow(Rails.application.config).to receive(:content_security_policy).and_return(csp) + allow(Rails.application.config).to receive(:content_security_policy_report_only).and_return(report_only) + end + + context 'when CSP is not configured globally' do + it 'does not set the CSP header' do + subject + + expect(response).to have_gitlab_http_status(:ok) + expect(response.headers['Content-Security-Policy']).to be_nil + end + end + + context 'when CSP is configured globally' do + let(:csp) do + ActionDispatch::ContentSecurityPolicy.new do |p| + p.default_src :self + end + end + + it 'sets a stricter CSP header' do + subject + + expect(response).to have_gitlab_http_status(:ok) + expect(response.headers['Content-Security-Policy']).to eq("default-src 'none'") + end + + context 'when report_only is true' do + let(:report_only) { true } + + it 'does not set any CSP header' do + subject + + expect(response).to have_gitlab_http_status(:ok) + expect(response.headers['Content-Security-Policy']).to be_nil + expect(response.headers['Content-Security-Policy-Report-Only']).to be_nil + end + end + end + end end |