webapp/bookstack
1
0
Fork 0
mirror of https://github.com/BookStackApp/BookStack.git synced 2025-08-09 10:22:51 +03:00
Code Activity

CSP: Updated handling of drawio URL to consider port

Browse Source 
Previously if a custom port was used in the DRAWIO option it would not
be considered in the CSP handling, which would block loading.

Added test to cover.
For #5107
This commit is contained in:
Dan Brown
2024-07-14 16:06:18 +01:00
parent 767699a066
commit 897bb338f9
2 changed files with 33 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tests/SecurityHeaderTest.php
View File

@@ -139,6 +139,18 @@ class SecurityHeaderTest extends TestCase
$this->assertEquals('frame-src \'self\' https://example.com https://diagrams.example.com', $scriptHeader);
}
public function test_frame_src_csp_header_drawio_host_includes_port_if_existing()
{
config()->set([
'app.iframe_sources' => 'https://example.com',
'services.drawio' => 'https://diagrams.example.com:8080/testing?cat=dog',
]);
$resp = $this->get('/');
$scriptHeader = $this->getCspHeader($resp, 'frame-src');
$this->assertEquals('frame-src \'self\' https://example.com https://diagrams.example.com:8080', $scriptHeader);
}
public function test_cache_control_headers_are_set_on_responses()
{
// Public access