42 lines
1.3 KiB
TypeScript
42 lines
1.3 KiB
TypeScript
import { describe, expect, it } from "vitest";
|
|
import { buildCsp, inspectHeaders } from "../../src/network/http";
|
|
import { lookupMime } from "../../src/network/mime";
|
|
|
|
describe("HTTP helpers", () => {
|
|
it("parses duplicates and reports missing security headers", () => {
|
|
const result = inspectHeaders(
|
|
"Content-Type: text/html\nSet-Cookie: a=1\nSet-Cookie: b=2",
|
|
);
|
|
expect(result.duplicates).toContain("set-cookie");
|
|
expect(result.findings).toContain(
|
|
"No Content-Security-Policy header is present.",
|
|
);
|
|
});
|
|
|
|
it("rejects folded headers", () => {
|
|
expect(() => inspectHeaders("X-Test: one\n two")).toThrow(/folded/u);
|
|
});
|
|
|
|
it("builds a restrictive CSP and makes dangerous sources visible", () => {
|
|
const result = buildCsp({
|
|
defaultSrc: "'self'",
|
|
scriptSrc: "'self' 'unsafe-eval'",
|
|
styleSrc: "'self'",
|
|
imgSrc: "'self' data:",
|
|
connectSrc: "'self'",
|
|
workerSrc: "'self' blob:",
|
|
});
|
|
expect(result.policy).toContain("object-src 'none'");
|
|
expect(result.warnings.join(" ")).toMatch(/unsafe-eval/u);
|
|
});
|
|
});
|
|
|
|
describe("MIME lookup", () => {
|
|
it("finds types by extension or media type", () => {
|
|
expect(lookupMime(".wasm")).toEqual([
|
|
{ extension: "wasm", mime: "application/wasm" },
|
|
]);
|
|
expect(lookupMime("epub")[0]?.mime).toBe("application/epub+zip");
|
|
});
|
|
});
|