kotovalexarian-likes-github/rails--rails
1
0
Fork 0
mirror of https://github.com/rails/rails.git synced 2022-11-09 12:12:34 -05:00
Code Releases Activity

Merge pull request #36703 from y-yagi/script-src-xxx_and_style-src-xxx

Browse source 
Add support for script-src-attr / elem and style-src-attr / elem directives
This commit is contained in:
y-yagi 2019-07-19 07:21:07 +09:00 committed by GitHub
commit 027085a597
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 28 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
actionpack/lib/action_dispatch/http/content_security_policy.rb
View file

@ -137,7 +137,11 @@ module ActionDispatch #:nodoc:
object_src: "object-src",
prefetch_src: "prefetch-src",
script_src: "script-src",
script_src_attr: "script-src-attr",
script_src_elem: "script-src-elem",
style_src: "style-src",
style_src_attr: "style-src-attr",
style_src_elem: "style-src-elem",
worker_src: "worker-src"
}.freeze

24
actionpack/test/dispatch/content_security_policy_test.rb
View file

@ -128,12 +128,36 @@ class ContentSecurityPolicyTest < ActiveSupport::TestCase
@policy.script_src false
assert_no_match %r{script-src}, @policy.build
@policy.script_src_attr :self
assert_match %r{script-src-attr 'self'}, @policy.build
@policy.script_src_attr false
assert_no_match %r{script-src-attr}, @policy.build
@policy.script_src_elem :self
assert_match %r{script-src-elem 'self'}, @policy.build
@policy.script_src_elem false
assert_no_match %r{script-src-elem}, @policy.build
@policy.style_src :self
assert_match %r{style-src 'self'}, @policy.build
@policy.style_src false
assert_no_match %r{style-src}, @policy.build
@policy.style_src_attr :self
assert_match %r{style-src-attr 'self'}, @policy.build
@policy.style_src_attr false
assert_no_match %r{style-src-attr}, @policy.build
@policy.style_src_elem :self
assert_match %r{style-src-elem 'self'}, @policy.build
@policy.style_src_elem false
assert_no_match %r{style-src-elem}, @policy.build
@policy.worker_src :self
assert_match %r{worker-src 'self'}, @policy.build