David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Merge #4048 into stage-mj

Browse source
This commit is contained in:
nesquena-hermes 2026-06-12 20:14:42 +00:00
commit ffa9f533ef
3 changed files with 11 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
api/helpers.py
View file

@ -53,7 +53,7 @@ def safe_resolve(root: Path, requested: str) -> Path:
_CSP_CONNECT_BASE = (
"'self' http://127.0.0.1:* http://localhost:* "
"'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost "
"ws://127.0.0.1:* ws://localhost:*"
)
_CSP_EXTRA_CONNECT_RE = _re.compile(

4
tests/test_issue1909_csp_enforcement.py
View file

@ -50,7 +50,7 @@ def test_security_helper_sends_enforcing_csp_with_hardening_directives(monkeypat
assert "object-src 'none'" in policy
assert "frame-ancestors 'none'" in policy
assert "media-src 'self' data: blob:" in policy
assert "connect-src 'self' http://127.0.0.1:* http://localhost:* ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net" in policy
assert "connect-src 'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net" in policy
def test_enforcing_csp_honors_valid_extra_connect_origins(monkeypatch):
@ -64,7 +64,7 @@ def test_enforcing_csp_honors_valid_extra_connect_origins(monkeypatch):
policy = headers["Content-Security-Policy"]
assert (
"connect-src 'self' http://127.0.0.1:* http://localhost:* "
"ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net "
"http://ipc.localhost ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net "
"https://metrics.example.com wss://events.example.com:443; "
) in policy

13
tests/test_issue2901_csp_connect_extra.py
View file

@ -9,11 +9,13 @@ def test_csp_connect_src_default_header_unchanged(monkeypatch):
monkeypatch.delenv("HERMES_WEBUI_CSP_CONNECT_EXTRA", raising=False)
policy = Handler.csp_report_only_policy()
assert (
expected = (
"connect-src 'self' http://127.0.0.1:* http://localhost:* "
"ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net; "
) in policy
"http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
"https://cdn.jsdelivr.net; "
)
assert expected in policy
def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
@ -28,7 +30,8 @@ def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
assert (
"connect-src 'self' http://127.0.0.1:* http://localhost:* "
"ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net "
"http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
"https://cdn.jsdelivr.net "
"https://metrics.example.com wss://events.example.com:443; "
) in policy