package web
import (
"strings"
"testing"
)
// The policy and the markup have to agree. Every page states its own
// address in a <base href>, so a policy of base-uri 'none' does not
// harden the page — it disables a fix that was written for a real bug
// and logs a violation on every load.
//
// The bug: a page opened as http://user:pw@host/ (how a LAN deployment
// behind basic auth gets opened) keeps those credentials in
// document.baseURI. fetch() refuses any URL carrying credentials, so
// every enhancement failed at once — the diff toggle, the unread poll,
// the diff sentinel — while the page itself looked perfectly fine.
func TestThePolicyPermitsThePageToStateItsOwnAddress(t *testing.T) {
h := cspHeader("TESTNONCE", nil)
if strings.Contains(h, "base-uri 'none'") {
t.Error("FAIL: base-uri 'none' blocks the <base> tag every page carries")
}
if !strings.Contains(h, "base-uri 'self'") {
t.Error("FAIL: base-uri is not restricted to this origin")
}
// The directive must still be PRESENT: without it entirely, an
// injected <base href="https://elsewhere/"> repoints every relative
// URL on the page, which is the attack it exists for.
if !strings.Contains(h, "base-uri") {
t.Error("FAIL: base-uri was dropped rather than narrowed")
}
}
// And the markup that depends on it is still there — a policy allowing
// a tag nothing emits would be the same disagreement facing the other
// way.
func TestEveryPageStillStatesItsOwnAddress(t *testing.T) {
if !strings.Contains(baseHTML, `<base href="{{.Origin}}{{.Path}}"`) {
t.Error("FAIL: the <base> tag is gone; base-uri 'self' now permits something nothing emits")
}
}