48 lines
1.6 KiB
C#
48 lines
1.6 KiB
C#
using System.Linq;
|
|
using Paca.Browser.Extensions;
|
|
using Xunit;
|
|
|
|
namespace Paca.Tests.Browser;
|
|
|
|
public class ChromeExtensionCspValidatorTests
|
|
{
|
|
[Fact]
|
|
public void ValidateManifestCsp_Allows_Safe_Self_Policy()
|
|
{
|
|
var safeCsp = "script-src 'self'; object-src 'self';";
|
|
var result = ExtensionCspValidator.Validate(safeCsp, manifestVersion: 3);
|
|
|
|
Assert.True(result.IsValid);
|
|
Assert.Empty(result.Violations);
|
|
Assert.Equal("script-src 'self'; object-src 'self';", result.NormalizedCsp);
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateManifestCsp_Rejects_UnsafeEval_In_ManifestV3()
|
|
{
|
|
var evalCsp = "script-src 'self' 'unsafe-eval'; object-src 'self';";
|
|
var result = ExtensionCspValidator.Validate(evalCsp, manifestVersion: 3);
|
|
|
|
Assert.False(result.IsValid);
|
|
Assert.Contains(result.Violations, v => v.Contains("'unsafe-eval'"));
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateManifestCsp_Rejects_Remote_Script_Sources_In_ManifestV3()
|
|
{
|
|
var remoteCsp = "script-src 'self' https://cdn.jsdelivr.net; object-src 'none';";
|
|
var result = ExtensionCspValidator.Validate(remoteCsp, manifestVersion: 3);
|
|
|
|
Assert.False(result.IsValid);
|
|
Assert.Contains(result.Violations, v => v.Contains("remote script"));
|
|
}
|
|
|
|
[Fact]
|
|
public void ValidateManifestCsp_Provides_Default_When_Null_Or_Empty()
|
|
{
|
|
var result = ExtensionCspValidator.Validate(null, manifestVersion: 3);
|
|
|
|
Assert.True(result.IsValid);
|
|
Assert.Equal(ExtensionCspValidator.DefaultManifestV3Csp, result.NormalizedCsp);
|
|
}
|
|
}
|