john
2f7bc3b6e4
WeChat UA uses a relaxed inline CSP without 'self', which blocked /assets/page-data-client.js and broke public survey submissions. Co-authored-by: Cursor <cursoragent@cursor.com>
38 lines
1.7 KiB
JavaScript
38 lines
1.7 KiB
JavaScript
import test from 'node:test';
|
|
import assert from 'node:assert/strict';
|
|
import { publishedPageCsp } from './mindspace-published-page-csp.mjs';
|
|
|
|
const PAGE_DATA_HTML = `<!doctype html><html><head></head><body>
|
|
<script src="/assets/page-data-client.js"></script>
|
|
<script>var client = MindSpacePageData.createClient({ apiBase: '/api' });</script>
|
|
</body></html>`;
|
|
|
|
test('publishedPageCsp raw mode allows same-origin external scripts for page-data-client.js', () => {
|
|
const csp = publishedPageCsp(PAGE_DATA_HTML, { raw: true });
|
|
assert.match(csp, /script-src 'unsafe-inline' 'self'/);
|
|
});
|
|
|
|
test('publishedPageCsp raw mode keeps inline-only pages restricted', () => {
|
|
const html = '<!doctype html><html><body><script>console.log(1)</script></body></html>';
|
|
const csp = publishedPageCsp(html, { raw: true });
|
|
assert.match(csp, /script-src 'unsafe-inline'/);
|
|
assert.doesNotMatch(csp, /script-src 'unsafe-inline' 'self'/);
|
|
});
|
|
|
|
test('publishedPageCsp non-raw full html allows self when external scripts are present', () => {
|
|
const csp = publishedPageCsp(PAGE_DATA_HTML, { raw: false });
|
|
assert.match(csp, /script-src 'self'/);
|
|
});
|
|
|
|
test('publishedPageCsp wechatShare mode allows self when page-data-client.js is referenced', () => {
|
|
const csp = publishedPageCsp(PAGE_DATA_HTML, { wechatShare: true });
|
|
assert.match(csp, /script-src 'unsafe-inline' 'self' https:\/\/res\.wx\.qq\.com/);
|
|
});
|
|
|
|
test('publishedPageCsp wechatShare mode keeps inline-only pages without self', () => {
|
|
const html = '<!doctype html><html><body><script>console.log(1)</script></body></html>';
|
|
const csp = publishedPageCsp(html, { wechatShare: true });
|
|
assert.match(csp, /script-src 'unsafe-inline' https:\/\/res\.wx\.qq\.com/);
|
|
assert.doesNotMatch(csp, /script-src 'unsafe-inline' 'self'/);
|
|
});
|