headers.test.ts

apps/worker/test/headers.test.ts

1. /**
2. * The CSP must permit every data: URI kind the page actually embeds.
3. *
4. * The brand fonts are embedded as data: URIs. Without a font-src, `default-src
5. * 'none'` blocks them for everyone, and nobody with the fonts installed locally
6. * can see it, because the browser resolves the family name from the OS and
7. * renders the intended face anyway. A blocked embed masked by a local install is
8. * invisible on exactly the machines that build and review the page, so this is
9. * pinned by a test rather than by eyeballing.
10. */
12. import { describe, expect, it } from 'vitest'
13. import { MESSAGE_PAGE_HEADERS, PAGE_HEADERS } from '../src/index.js'
15. describe('page CSP vs what the page embeds', () => {
16. const csp = PAGE_HEADERS['content-security-policy']
18. it('permits data: fonts, because the brand fonts are data: URIs', () => {
19. expect(csp).toContain('font-src data:')
20. })
22. it('permits data: images, which the surfaces use for inline SVG', () => {
23. expect(csp).toContain('img-src data:')
24. })
26. it('still defaults closed for everything unlisted', () => {
27. expect(csp).toContain("default-src 'none'")
28. })
29. })
31. /**
32. * The reply feature needs no CSP directive, and that is a design decision worth
33. * pinning rather than a happy accident.
34. *
35. * A modal submitting with fetch() would need `connect-src 'self'`. The compose
36. * window is a native <dialog> around a plain form POST instead, so the page
37. * still cannot open a connection to anywhere, including back to itself. If a future change adds one, this test should be
38. * changed deliberately, with the reason written down.
39. */
40. describe('the compose window needs no new CSP directive', () => {
41. it('has no connect-src at all: the page cannot open a connection anywhere', () => {
42. expect(PAGE_HEADERS['content-security-policy']).not.toContain('connect-src')
43. expect(MESSAGE_PAGE_HEADERS['content-security-policy']).not.toContain('connect-src')
44. })
46. it('permits a same-origin frame on the message page and nowhere wider', () => {
47. // The message frame and the signature preview both live here.
48. expect(MESSAGE_PAGE_HEADERS['content-security-policy']).toContain("frame-src 'self'")
49. expect(MESSAGE_PAGE_HEADERS['content-security-policy']).not.toMatch(/frame-src[^;]*\*/)
50. })
52. it('still permits a same-origin form POST and nothing wider', () => {
53. // Reply, mark-read, filter and signatures are all plain form POSTs.
54. expect(PAGE_HEADERS['content-security-policy']).toContain("form-action 'self'")
55. })
57. it('the board page itself still cannot grow a frame', () => {
58. expect(PAGE_HEADERS['content-security-policy']).not.toContain('frame-src')
59. })
60. })