def test_coerce_blocked_uri_if_missing(self):
result = Csp.to_python(
dict(
document_uri='http://example.com',
effective_directive='script-src',
))
assert result.blocked_uri == 'self'
def interface(self):
return Csp.to_python(
dict(
document_uri='http://example.com',
violated_directive='style-src cdn.example.com',
blocked_uri='http://example.com/lol.css',
effective_directive='style-src',
))
def test_coerce_blocked_uri_if_missing(self):
result = Csp.to_python(
dict(
document_uri='http://example.com',
effective_directive='script-src',
)
)
assert result.blocked_uri == 'self'
def test_get_message(self):
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='img-src',
blocked_uri='http://google.com/foo',
))
assert result.get_message() == "Blocked 'image' from 'google.com'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='style-src',
blocked_uri='',
))
assert result.get_message() == "Blocked inline 'style'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='',
violated_directive="script-src 'unsafe-inline'",
))
assert result.get_message() == "Blocked unsafe inline 'script'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='',
violated_directive="script-src 'unsafe-eval'",
))
assert result.get_message() == "Blocked unsafe eval() 'script'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='',
violated_directive="script-src example.com",
))
assert result.get_message(
) == "Blocked unsafe (eval() or inline) 'script'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='data:text/plain;base64,SGVsbG8sIFdvcmxkIQ%3D%3D',
))
assert result.get_message() == "Blocked 'script' from 'data:'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='data',
))
assert result.get_message() == "Blocked 'script' from 'data:'"
def test_get_hash(self):
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='',
)
)
assert result.get_hash() == ['script-src', "'self'"]
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='self',
)
)
assert result.get_hash() == ['script-src', "'self'"]
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='http://example.com/lol.js',
)
)
assert result.get_hash() == ['script-src', 'example.com']
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='img-src',
blocked_uri='data:foo',
)
)
assert result.get_hash() == ['img-src', 'data:']
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='img-src',
blocked_uri='ftp://example.com/foo',
)
)
assert result.get_hash() == ['img-src', 'ftp://example.com']
def interface(self):
return Csp.to_python(
dict(
document_uri='http://example.com',
violated_directive='style-src cdn.example.com',
blocked_uri='http://example.com/lol.css',
effective_directive='style-src',
)
)
def test_get_tags_stripe(self):
result = Csp.to_python(
dict(
blocked_uri='https://api.stripe.com/v1/tokens?card[number]=xxx',
effective_directive='script-src',
))
assert result.get_tags() == [
('effective-directive', 'script-src'),
('blocked-uri', 'https://api.stripe.com/v1/tokens'),
]
def test_get_tags_stripe(self):
result = Csp.to_python(
dict(
blocked_uri='https://api.stripe.com/v1/tokens?card[number]=xxx',
effective_directive='script-src',
)
)
assert result.get_tags() == [
('effective-directive', 'script-src'),
('blocked-uri', 'https://api.stripe.com/v1/tokens'),
]
def get_metadata(self):
from sentry.interfaces.security import Csp
# TODO(dcramer): pull get message into here to avoid instantiation
# or ensure that these get interfaces passed instead of raw data
csp = Csp.to_python(self.data['csp'])
return {
'directive': csp.effective_directive,
'uri': csp._normalized_blocked_uri,
'message': csp.get_message(),
}
def get_metadata(self, data):
from sentry.interfaces.security import Csp
# TODO(dcramer): pull get message into here to avoid instantiation
# or ensure that these get interfaces passed instead of raw data
csp = Csp.to_python(data['csp'])
return {
'directive': csp.effective_directive,
'uri': csp.normalized_blocked_uri,
'message': csp.get_message(),
}
def test_compute_hashes(self):
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='',
))
assert result.compute_hashes() == [['script-src', "'self'"]]
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='self',
))
assert result.compute_hashes() == [['script-src', "'self'"]]
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='http://example.com/lol.js',
))
assert result.compute_hashes() == [['script-src', 'example.com']]
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='img-src',
blocked_uri='data:foo',
))
assert result.compute_hashes() == [['img-src', 'data:']]
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='img-src',
blocked_uri='ftp://example.com/foo',
))
assert result.compute_hashes() == [['img-src', 'ftp://example.com']]
def test_get_culprit(self):
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src http://cdn.example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == 'style-src http://cdn.example.com'
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src cdn.example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == 'style-src cdn.example.com'
result = Csp.to_python(
dict(
document_uri='https://example.com/foo',
violated_directive='style-src cdn.example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == 'style-src cdn.example.com'
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src https://cdn.example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == 'style-src https://cdn.example.com'
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src http://example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == "style-src 'self'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src http://example2.com example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == "style-src http://example2.com 'self'"
def test_get_culprit(self):
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src http://cdn.example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == 'style-src http://cdn.example.com'
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src cdn.example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == 'style-src cdn.example.com'
result = Csp.to_python(
dict(
document_uri='https://example.com/foo',
violated_directive='style-src cdn.example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == 'style-src cdn.example.com'
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src https://cdn.example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == 'style-src https://cdn.example.com'
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src http://example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == "style-src 'self'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
violated_directive='style-src http://example2.com example.com',
effective_directive='style-src',
)
)
assert result.get_culprit() == "style-src http://example2.com 'self'"
def test_real_report(make_csp_snapshot):
raw_report = {
"csp-report": {
"document-uri": "https://sentry.io/sentry/csp/issues/88513416/",
"referrer": "https://sentry.io/sentry/sentry/releases/7329107476ff14cfa19cf013acd8ce47781bb93a/",
"violated-directive": "script-src",
"effective-directive": "script-src",
"original-policy": "default-src *; script-src 'make_csp_snapshot' 'unsafe-eval' 'unsafe-inline' e90d271df3e973c7.global.ssl.fastly.net cdn.ravenjs.com assets.zendesk.com ajax.googleapis.com ssl.google-analytics.com www.googleadservices.com analytics.twitter.com platform.twitter.com *.pingdom.net js.stripe.com api.stripe.com statuspage-production.s3.amazonaws.com s3.amazonaws.com *.google.com www.gstatic.com aui-cdn.atlassian.com *.atlassian.net *.jira.com *.zopim.com; font-src * data:; connect-src * wss://*.zopim.com; style-src 'make_csp_snapshot' 'unsafe-inline' e90d271df3e973c7.global.ssl.fastly.net s3.amazonaws.com aui-cdn.atlassian.com fonts.googleapis.com; img-src * data: blob:; report-uri https://sentry.io/api/54785/csp-report/?sentry_key=f724a8a027db45f5b21507e7142ff78e&sentry_release=39662eb9734f68e56b7f202260bb706be2f4cee7",
"disposition": "enforce",
"blocked-uri": "http://baddomain.com/test.js?_=1515535030116",
"line-number": 24,
"column-number": 66270,
"source-file": "https://e90d271df3e973c7.global.ssl.fastly.net/_static/f0c7c026a4b2a3d2b287ae2d012c9924/sentry/dist/vendor.js",
"status-code": 0,
"script-sample": ""
}
}
interface = Csp.from_raw(raw_report)
make_csp_snapshot(interface.to_json())
def test_real_report(self):
raw_report = {
"csp-report": {
"document-uri": "https://sentry.io/sentry/csp/issues/88513416/",
"referrer": "https://sentry.io/sentry/sentry/releases/7329107476ff14cfa19cf013acd8ce47781bb93a/",
"violated-directive": "script-src",
"effective-directive": "script-src",
"original-policy": "default-src *; script-src 'self' 'unsafe-eval' 'unsafe-inline' e90d271df3e973c7.global.ssl.fastly.net cdn.ravenjs.com assets.zendesk.com ajax.googleapis.com ssl.google-analytics.com www.googleadservices.com analytics.twitter.com platform.twitter.com *.pingdom.net js.stripe.com api.stripe.com statuspage-production.s3.amazonaws.com s3.amazonaws.com *.google.com www.gstatic.com aui-cdn.atlassian.com www.hipchat.com *.atlassian.net *.jira.com *.zopim.com; font-src * data:; connect-src * wss://*.zopim.com; style-src 'self' 'unsafe-inline' e90d271df3e973c7.global.ssl.fastly.net s3.amazonaws.com aui-cdn.atlassian.com www.hipchat.com fonts.googleapis.com; img-src * data: blob:; report-uri https://sentry.io/api/54785/csp-report/?sentry_key=f724a8a027db45f5b21507e7142ff78e&sentry_release=39662eb9734f68e56b7f202260bb706be2f4cee7",
"disposition": "enforce",
"blocked-uri": "http://baddomain.com/test.js?_=1515535030116",
"line-number": 24,
"column-number": 66270,
"source-file": "https://e90d271df3e973c7.global.ssl.fastly.net/_static/f0c7c026a4b2a3d2b287ae2d012c9924/sentry/dist/vendor.js",
"status-code": 0,
"script-sample": ""
}
}
interface = Csp.from_raw(raw_report)
assert interface.effective_directive == 'script-src'
def test_invalid_csp_report(report):
with pytest.raises(InterfaceValidationError):
Csp.to_python(report)
def test_get_message(self):
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='img-src',
blocked_uri='http://google.com/foo',
)
)
assert result.get_message() == "Blocked 'image' from 'google.com'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='style-src',
blocked_uri='',
)
)
assert result.get_message() == "Blocked inline 'style'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='',
violated_directive="script-src 'unsafe-inline'",
)
)
assert result.get_message() == "Blocked unsafe inline 'script'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='',
violated_directive="script-src 'unsafe-eval'",
)
)
assert result.get_message() == "Blocked unsafe eval() 'script'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='',
violated_directive="script-src example.com",
)
)
assert result.get_message() == "Blocked unsafe (eval() or inline) 'script'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='data:text/plain;base64,SGVsbG8sIFdvcmxkIQ%3D%3D',
)
)
assert result.get_message() == "Blocked 'script' from 'data:'"
result = Csp.to_python(
dict(
document_uri='http://example.com/foo',
effective_directive='script-src',
blocked_uri='data',
)
)
assert result.get_message() == "Blocked 'script' from 'data:'"
def test_blocked_csp_report(report):
assert Csp.to_python(report).should_filter() is True
def test_valid_csp_report(report):
assert Csp.to_python(report).should_filter() is False
