o
ø•;hI7 ã @ sb d dl mZ d dlZd dlZd dlmZmZmZmZ ddiZ dd„ Z
dd „ Z G d
d „ d ej ƒZ
dS ) é )Úabsolute_importN)Ú
ALLOW_FROMÚDENYÚ NONCE_LENGTHÚTalismanzwsgi.url_schemeÚhttpsc C ó dS ©Nz Hello, world© r
r
r
úO/var/www/html/venv/lib/python3.10/site-packages/flask_talisman/talisman_test.pyÚ hello_world s r c C s
t d¡S )Nz))ÚflaskZrender_template_stringr
r
r
r Ú
with_nonce s ÿr c @ sŒ e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd d
„ Zd d „ Zd
d„ Z dd„ Z
dd„ Z dd„ Z dd„ Z
dd„ Zdd„ Zdd „ Zd d „ Zd d „ Zd!S )"ÚTestTalismanExtensionc C sH t t¡| _t| jƒ| _| j ¡ | _| j d¡t ƒ | j d¡t
ƒ d S )Nú/ú /with_nonce) r
ÚFlaskÚ__name__Úappr ÚtalismanÚ test_clientÚclientÚrouter r )Úselfr
r
r ÚsetUp& s
zTestTalismanExtension.setUpc C sl | j jdtd}dddddœ}| ¡ D ]\}}| |j |¡|¡ q|j d¡}| d |¡ | d
|¡ d S ) Nr ©Zenviron_overridesÚ
SAMEORIGINz#max-age=31556926; includeSubDomainsZnosniffz strict-origin-when-cross-origin)úX-Frame-OptionsúStrict-Transport-SecurityúX-Content-Type-OptionszReferrer-PolicyúContent-Security-Policyúdefault-src 'self'zobject-src 'none')r ÚgetÚ
HTTPS_ENVIRONÚitemsÚ assertEqualÚheadersÚassertIn)r Úresponser& ÚkeyÚvalueÚcspr
r
r Ú testDefaults. s û z"TestTalismanExtension.testDefaultsc C sš | j jdddid}| |jd¡ | j d¡}| |jd¡ | |jd d¡¡ d | j_| j d¡}| |jd
¡ d | j_ | j d¡}| |jd¡ d S ) Nr úX-Forwarded-Protor ©r& éÈ é. ZLocationzhttps://Ti- F)
r r" r% Ú status_codeZ
assertTruer& Ú
startswithr Zforce_https_permanentÚ force_https©r r( r
r
r ÚtestForceSslOptionOptionsA s ÿ z/TestTalismanExtension.testForceSslOptionOptionsc C s8 d| j _| j d¡}| d|j¡ | |jd d¡ d S )NTr úX-XSS-Protectionz
1; mode=block)r Úx_xss_protectionr r" r' r& r% r4 r
r
r Ú testForceXSSProtectionOptionsW s z3TestTalismanExtension.testForceXSSProtectionOptionsc C sÊ d| j _| j d¡}| d|j¡ d| j _| jjdtd}| d|j¡ d| j _| jjdddid}| d|j¡ d| j _ | jjdtd}| d |jd ¡ d| j _
| jjdtd}| d
|jd ¡ d S ) NFr r r Tr- r r. ZincludeSubDomainsZpreload) r Z force_sslr r" Ú assertNotInr& Zstrict_transport_securityr# r' Z,strict_transport_security_include_subdomainsZ!strict_transport_security_preloadr4 r
r
r ÚtestHstsOptions_ s& ÿ
ÿz%TestTalismanExtension.testHstsOptionsc C s† t | j_| jjdtd}| |jd d¡ t| j_d| j_ | jjdtd}| |jd d¡ d | j_| jjdtd}|
d|j¡ d S )Nr r r r ú example.comzALLOW-FROM example.com) r r Z
frame_optionsr r" r# r% r& r Zframe_options_allow_fromr9 r4 r
r
r ÚtestFrameOptions s
ÿz&TestTalismanExtension.testFrameOptionsc C s† d| j jd< | jjdtd}|jd }| d|¡ | d|¡ | d|¡ d d
g| j jd< | jjdtd}|jd }| d |¡ | d |¡ d
| j _| jjdtd}| |jd d
¡ d| j _| jjdtd}| d|j¡ t
t ¡}t |d
d |
¡ jdtd}| d
|jd ¡ t
t ¡}t |dd |
¡ jdtd}| d|j¡ t
t ¡}t |dd |
¡ jdtd}| d|j¡ d S )NÚ*z image-srcr r r zdefault-src 'self';zobject-src 'none';z image-src *ú'self'r; r! z image-src 'self' example.comzdefault-src 'foo' spam.eggsF©Úcontent_security_policy)Zx_content_type_optionsr )r7 r6 )r r@ r r" r# r& r' r% r9 r
r r r r )r r( r+ r r
r
r Ú testContentSecurityPolicyOptionsŽ sH
þ
ÿ
þ
z6TestTalismanExtension.testContentSecurityPolicyOptionsc C s¦ d| j _d| j _| jjdtd}| d|j¡ | d|jd ¡ | d|j¡ d}d|i| j _ | jjdtd}| d|j¡ | ||jd ¡ | j
t t | j
dd d S )
NTzhttps://example.comr r z#Content-Security-Policy-Report-Onlyz
report-urir zhttps://report-uri.io/)Ú#content_security_policy_report_only)r rB Z"content_security_policy_report_urir r" r# r' r& r9 r@ Z assertRaisesÚ
ValueErrorr r )r r( Zoverride_report_urir
r
r Ú&testContentSecurityPolicyOptionsReport¿ s0 ÿþÿÿþ
ÿz z
script-srcr; z style-srcr r r z script-src 'self' 'nonce-{}'zstyle-src 'self'z style-src example.com 'nonce-{}'zstyle-src example.comzutf-8)r r@ Z content_security_policy_nonce_inr r r" r# r& r' Úformatr
ÚrequestZ csp_noncer9 ÚdataÚdecoder% Úlenr )r r r( r+ r
r
r Ú testContentSecurityPolicyNonceÜ s<
ÿ
þþ þþ
þ"æz4TestTalismanExtension.testContentSecurityPolicyNoncec C sT | j d¡| jd ddd„ ƒƒ}| jjdtd}| d|j¡ | |jd d¡ d S ) Nz/nocspr? c S r r r
r
r
r
r Únocspþ ó z2TestTalismanExtension.testDecorator..nocspr r r r ) r r r r r" r# r9 r& r% )r rK r( r
r
r Ú
testDecoratorý s
z#TestTalismanExtension.testDecoratorc C s> | j d¡| jdddd„ ƒƒ}| j d¡}| |jd¡ d S )Nz
/noforcehttpsF)r3 c S r r r
r
r
r
r Ú noforcehttps rL zCTestTalismanExtension.testDecoratorForceHttps..noforcehttpsr/ )r r r r r" r% r1 )r rN r( r
r
r ÚtestDecoratorForceHttps s
z-TestTalismanExtension.testDecoratorForceHttpsc C s< d| j _| jjdtd}| d|j¡ | |jd d¡ d S )NTr r zX-Download-OptionsZnoopen)r Zforce_file_saver r" r# r' r& r% r4 r
r
r ÚtestForceFileSave s z'TestTalismanExtension.testForceFileSavec C s@ | j d¡}| |jd¡ | j jdddid}| |jd¡ d S )Nz
/bad_endpointr0 r- r r. i” )r r" r% r1 r4 r
r
r ÚtestBadEndpoint s ÿz%TestTalismanExtension.testBadEndpointc C s¢ d| j jd< | jjdtd}|jd }| d|¡ d| j jd< | jjdtd}|jd }| d |¡ t t ¡}t
|d
d | ¡ jdtd}| d
|jd ¡ d S ) Nz'none'Ú geolocationr r zFeature-Policyzgeolocation 'none'z'self' example.comÚ
fullscreenz fullscreen 'self' example.comzvibrate 'none')Úfeature_policy) r rT r r" r# r& r' r
r r r r )r r( rT r r
r
r ÚtestFeaturePolicy s
z'TestTalismanExtension.testFeaturePolicyc C sö d| j jd< | jjdtd}|jd }| d|¡ | d|¡ d| j jd< d| j jd < | jjdtd}|jd }| d|¡ | d
|¡ i | j _| jjdtd}|j d¡}| d |¡ t t
¡}t |d d | ¡ jdtd}| d |jd ¡ d S )
Nz()rR r r zPermissions-Policyzbrowsing-topics=()zgeolocation=()z (self, "https://example.com")rS z8geolocation=(), fullscreen=(self, "https://example.com")zvibrate=(), geolocation=())Úpermissions_policy)
r rV r r" r# r& r' r% r
r r r r )r r( rV r r
r
r ÚtestPermissionsPolicy. s&
z+TestTalismanExtension.testPermissionsPolicyc C s® d| j jd< | jjdtd}|jd }| d|¡ d| j jd< d| j jd< | jjdtd}|jd }| d|¡ t t ¡}t
|dd | ¡ jdtd}| d|jd ¡ d S )
Nz?0zoversized-imagesr r zDocument-Policyzoversized-images=?0zdocument-writez&oversized-images=?0, document-write=?0)Údocument_policy) r rX r r" r# r& r' r
r r r r )r r( rX r r
r
r ÚtestDocumentPolicyH s
z(TestTalismanExtension.testDocumentPolicyN)r Ú
__module__Ú __qualname__r r, r5 r8 r: r< rA rD rJ rM rO rP rQ rU rW rY r
r
r
r r $ s" 1 !
r )Ú
__future__r Zunittestr
Zflask_talismanr r r r r# r r ZTestCaser r
r
r
r Ú s