Skip to content

Commit

Permalink
Fixing lint error
Browse files Browse the repository at this point in the history
  • Loading branch information
jkribeiro committed Jun 27, 2023
1 parent ecf7d00 commit 36663ec
Show file tree
Hide file tree
Showing 4 changed files with 33 additions and 9 deletions.
2 changes: 2 additions & 0 deletions .eslintrc.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
env:
browser: true
es2021: true
"jest/globals": true
extends:
- standard
- prettier
Expand All @@ -9,6 +10,7 @@ parserOptions:
sourceType: module
plugins:
- prettier
- jest
rules:
prettier/prettier:
- error
8 changes: 6 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
[![Testing](https://github.com/EdisonLabs/content-security-policy-merger/actions/workflows/testing.yml/badge.svg)](https://github.com/EdisonLabs/content-security-policy-merger/actions/workflows/testing.yml)

# Content Security Policy merger

Merge two Content-Security-Policy strings together.
Expand All @@ -7,9 +9,11 @@ Usage:
```javascript
import { merge } from 'content-security-policy-merger'

const cspA = "default-src 'self' *.example.com example.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.youtube.com; frame-src 'self' players.brightcove.net; img-src 'blob' 'self'; style-src 'unsafe-inline' https:"
const cspA =
"default-src 'self' *.example.com example.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.youtube.com; frame-src 'self' players.brightcove.net; img-src 'blob' 'self'; style-src 'unsafe-inline' https:"

const cspB = "default-src 'self' *.mysite.com mysite.com; script-src 'self' www.google-analytics.com; frame-src 'self' example.com; manifest-src 'self'; style-src 'unsafe-inline'"
const cspB =
"default-src 'self' *.mysite.com mysite.com; script-src 'self' www.google-analytics.com; frame-src 'self' example.com; manifest-src 'self'; style-src 'unsafe-inline'"

merge(cspA, cspB)

Expand Down
1 change: 1 addition & 0 deletions package.json
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,7 @@
"eslint-config-prettier": "^8.8.0",
"eslint-plugin-import": "^2.26.0",
"eslint-plugin-prettier": "^4.0.0",
"eslint-plugin-jest": "^27.2.2",
"prettier": "^2",
"jest": "^29.5.0"
}
Expand Down
31 changes: 24 additions & 7 deletions test/index.test.js
Original file line number Diff line number Diff line change
@@ -1,9 +1,20 @@
import { merge } from './dist/index'
import parse from 'content-security-policy-parser'

const cspA = "default-src 'self' *.example.com example.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.youtube.com; frame-src 'self' players.brightcove.net; img-src 'blob' 'self'; style-src 'unsafe-inline' https:"
const cspB = "default-src 'self' *.mysite.com mysite.com; script-src 'self' www.google-analytics.com; frame-src 'self' example.com; manifest-src 'self'; style-src 'unsafe-inline'"
const cspMerged = "default-src 'self' *.example.com *.mysite.com example.com mysite.com; script-src 'self' 'unsafe-eval' 'unsafe-inline' www.google-analytics.com www.youtube.com; frame-src 'self' example.com players.brightcove.net; img-src 'blob' 'self'; style-src 'unsafe-inline' https:; manifest-src 'self'"
const cspA =
"default-src 'self' *.example.com example.com; " +
"script-src 'self' 'unsafe-eval' 'unsafe-inline' www.youtube.com; " +
"frame-src 'self' players.brightcove.net; img-src 'blob' 'self'; " +
"style-src 'unsafe-inline' https:"
const cspB =
"default-src 'self' *.mysite.com mysite.com; " +
"script-src 'self' www.google-analytics.com; frame-src 'self' example.com; " +
"manifest-src 'self'; style-src 'unsafe-inline'"
const cspMerged =
"default-src 'self' *.example.com *.mysite.com example.com mysite.com; " +
"script-src 'self' 'unsafe-eval' 'unsafe-inline' www.google-analytics.com " +
"www.youtube.com; frame-src 'self' example.com players.brightcove.net; " +
"img-src 'blob' 'self'; style-src 'unsafe-inline' https:; manifest-src 'self'"

test('merge directives when CSP (A) is empty & (B) is string', async () => {
expect(merge('', cspB)).toBe(cspB)
Expand Down Expand Up @@ -32,21 +43,27 @@ test('merge directives when CSP (A) is object & (B) is object', async () => {
})

test('merge directives when CSP (A) and (B) have duplicated directives', async () => {
expect(merge("default-src 'self'", "default-src 'self'")).toBe("default-src 'self'")
expect(merge("default-src 'self'", "default-src 'self'")).toBe(
"default-src 'self'",
)
})

test('merge directives when CSP (A) has directives not present in (B)', async () => {
expect(merge("frame-src 'self'", "default-src 'self'")).toBe("frame-src 'self'; default-src 'self'")
expect(merge("frame-src 'self'", "default-src 'self'")).toBe(
"frame-src 'self'; default-src 'self'",
)
})

test('merge directives when CSP (A) has NOT directives present in (B)', async () => {
expect(merge("default-src 'self'", "frame-src 'self'")).toBe("default-src 'self'; frame-src 'self'")
expect(merge("default-src 'self'", "frame-src 'self'")).toBe(
"default-src 'self'; frame-src 'self'",
)
})

test('merged directives is not ending with comma', async () => {
const csp = merge(cspA, cspB)
expect(csp).toBe(cspMerged)

const lastChar = csp.slice(-1);
const lastChar = csp.slice(-1)
expect(lastChar).not.toBe(';')
})

0 comments on commit 36663ec

Please sign in to comment.