From 96013cd576ec51a41a7fe06a28225a3e43ca8496 Mon Sep 17 00:00:00 2001
From: Matt Jankowski <matt@jankowski.online>
Date: Wed, 13 Mar 2024 04:22:32 -0400
Subject: [PATCH] Reduce `RSpec/ExampleLength` in CSP request spec (#29104)
---
spec/requests/content_security_policy_spec.rb | 49 ++++++++++++-------
1 file changed, 31 insertions(+), 18 deletions(-)
diff --git a/spec/requests/content_security_policy_spec.rb b/spec/requests/content_security_policy_spec.rb
index d4cc40bce5d..d4447dca4be 100644
--- a/spec/requests/content_security_policy_spec.rb
+++ b/spec/requests/content_security_policy_spec.rb
@@ -3,25 +3,38 @@
require 'rails_helper'
describe 'Content-Security-Policy' do
- it 'sets the expected CSP headers' do
- allow(SecureRandom).to receive(:base64).with(16).and_return('ZbA+JmE7+bK8F5qvADZHuQ==')
+ before { allow(SecureRandom).to receive(:base64).with(16).and_return('ZbA+JmE7+bK8F5qvADZHuQ==') }
+ it 'sets the expected CSP headers' do
get '/'
- expect(response.headers['Content-Security-Policy'].split(';').map(&:strip)).to contain_exactly(
- "base-uri 'none'",
- "default-src 'none'",
- "frame-ancestors 'none'",
- "font-src 'self' https://cb6e6126.ngrok.io",
- "img-src 'self' data: blob: https://cb6e6126.ngrok.io",
- "style-src 'self' https://cb6e6126.ngrok.io 'nonce-ZbA+JmE7+bK8F5qvADZHuQ=='",
- "media-src 'self' data: https://cb6e6126.ngrok.io",
- "frame-src 'self' https:",
- "manifest-src 'self' https://cb6e6126.ngrok.io",
- "form-action 'self'",
- "child-src 'self' blob: https://cb6e6126.ngrok.io",
- "worker-src 'self' blob: https://cb6e6126.ngrok.io",
- "connect-src 'self' data: blob: https://cb6e6126.ngrok.io ws://cb6e6126.ngrok.io:4000",
- "script-src 'self' https://cb6e6126.ngrok.io 'wasm-unsafe-eval'"
- )
+
+ expect(response_csp_headers)
+ .to match_array(expected_csp_headers)
+ end
+
+ def response_csp_headers
+ response
+ .headers['Content-Security-Policy']
+ .split(';')
+ .map(&:strip)
+ end
+
+ def expected_csp_headers
+ <<~CSP.split("\n").map(&:strip)
+ base-uri 'none'
+ child-src 'self' blob: https://cb6e6126.ngrok.io
+ connect-src 'self' data: blob: https://cb6e6126.ngrok.io ws://cb6e6126.ngrok.io:4000
+ default-src 'none'
+ font-src 'self' https://cb6e6126.ngrok.io
+ form-action 'self'
+ frame-ancestors 'none'
+ frame-src 'self' https:
+ img-src 'self' data: blob: https://cb6e6126.ngrok.io
+ manifest-src 'self' https://cb6e6126.ngrok.io
+ media-src 'self' data: https://cb6e6126.ngrok.io
+ script-src 'self' https://cb6e6126.ngrok.io 'wasm-unsafe-eval'
+ style-src 'self' https://cb6e6126.ngrok.io 'nonce-ZbA+JmE7+bK8F5qvADZHuQ=='
+ worker-src 'self' blob: https://cb6e6126.ngrok.io
+ CSP
end
end