csp.test.js — astro Source File

Source Code

import assert from 'node:assert/strict';
import { describe, it } from 'node:test';
import * as cheerio from 'cheerio';
import testAdapter from './test-adapter.js';
import { loadFixture } from './test-utils.js';

describe('CSP', () => {
	let app;
	/**
	 * @type {import('../dist/core/build/types.js').SSGManifest}
	 */
	let manifest;
	/** @type {import('./test-utils.js').Fixture} */
	let fixture;

	it('should contain the meta style hashes when CSS is imported from Astro component', async () => {
		fixture = await loadFixture({
			root: './fixtures/csp/',
			outDir: './dist/csp-style-hashes',
			adapter: testAdapter({
				setManifest(_manifest) {
					manifest = _manifest;
				},
			}),
		});
		await fixture.build();
		app = await fixture.loadTestAdapterApp();
		if (manifest) {
			const request = new Request('http://example.com/index.html');
			const response = await app.render(request);
			const $ = cheerio.load(await response.text());

			const meta = $('meta[http-equiv="Content-Security-Policy"]');
			for (const hash of manifest.csp.styleHashes) {
				assert.ok(meta.attr('content').includes(hash), `Should have a CSP meta tag for ${hash}`);
			}
		} else {
			assert.fail('Should have the manifest');
		}
	});

	it('should contain the meta script hashes when using client island', async () => {
		fixture = await loadFixture({
			root: './fixtures/csp/',
			outDir: './dist/csp-script-hashes',
			adapter: testAdapter({
				setManifest(_manifest) {
					manifest = _manifest;
				},
			}),
		});
		await fixture.build();
		app = await fixture.loadTestAdapterApp();
		if (manifest) {
			const request = new Request('http://example.com/index.html');
			const response = await app.render(request);
			const html = await response.text();
			const $ = cheerio.load(html);

			const meta = $('meta[http-equiv="Content-Security-Policy"]');
// ... (369 more lines)