Skip to content

[TEST · NE PAS FUSIONNER] Interdire les substitutions de base de document #28

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
iPoower wants to merge 1 commit into
base: test/fortress-final-acceptance-ios-offline-diagnostic-20261027
Choose a base branch
from
Draft

[TEST · NE PAS FUSIONNER] Interdire les substitutions de base de document #28

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@
<!-- CSP Phase 1 : aucune requête externe. Phase 2 ajoutera accounts.google.com, apis.google.com, www.googleapis.com ; Phase 4 *.supabase.co. -->
<meta
http-equiv="Content-Security-Policy"
content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; manifest-src 'self'; worker-src 'self'; object-src 'none'; base-uri 'self'; form-action 'none'"
content="default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; manifest-src 'self'; worker-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'"
/>
<meta name="referrer" content="strict-origin-when-cross-origin" />
<title>Control Vault</title>
Expand Down
2 changes: 1 addition & 1 deletion public/_headers
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# Toute modification de ce fichier est une modification de sécurité : revue humaine obligatoire.

/*
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; manifest-src 'self'; worker-src 'self'; object-src 'none'; base-uri 'self'; form-action 'none'; frame-ancestors 'none'
Content-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data: blob:; font-src 'self'; connect-src 'self'; manifest-src 'self'; worker-src 'self'; object-src 'none'; base-uri 'none'; form-action 'none'; frame-ancestors 'none'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Expand Down
4 changes: 3 additions & 1 deletion scripts/security-check.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,9 @@ export function checkCsp(csp: string, opts: { requireFrameAncestors: boolean }):
if (/'unsafe-inline'/.test(script)) problems.push("'unsafe-inline' interdit dans script-src");
if (/(^|\s)\*(\s|;|$)/.test(csp)) problems.push('joker * interdit');
if (!dir('object-src')?.includes("'none'")) problems.push("object-src 'none' requis");
if (!dir('base-uri')) problems.push('base-uri requis');
const base = dir('base-uri');
if (!base) problems.push('base-uri requis');
else if (base.split(/\s+/).join(' ') !== "base-uri 'none'") problems.push("base-uri 'none' requis");
if (opts.requireFrameAncestors && !dir('frame-ancestors')?.includes("'none'")) problems.push("frame-ancestors 'none' requis");
return problems;
}
Expand Down
6 changes: 6 additions & 0 deletions tests/unit/security-check.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -36,6 +36,12 @@ describe('détection de secrets', () => {
});

describe('CSP', () => {
it.each(["'self'", 'https://fixture.invalid', "'none' 'self'"])(
'refuse une base de document autorisée : %s', (base) => {
expect(checkCsp(`default-src 'self'; script-src 'self'; object-src 'none'; base-uri ${base}`,
{ requireFrameAncestors: false })).toContain("base-uri 'none' requis");
});

it('refuse unsafe-eval, unsafe-inline dans script-src et le joker', () => {
expect(checkCsp("default-src 'self'; script-src 'self' 'unsafe-eval'; object-src 'none'; base-uri 'self'", { requireFrameAncestors: false })).toContain("'unsafe-eval' interdit");
expect(checkCsp("default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none'; base-uri 'self'", { requireFrameAncestors: false })).toContain("'unsafe-inline' interdit dans script-src");
Expand Down
Loading