tests/phpunit/includes/ContentSecurityPolicyTest.php

   1 <?php
   2
   3 use Wikimedia\TestingAccessWrapper;
   4
   5 class ContentSecurityPolicyTest extends MediaWikiTestCase {
   6         /** @var ContentSecurityPolicy */
   7         private $csp;
   8
   9         protected function setUp() {
  10                 global $wgUploadDirectory;
  11                 $this->setMwGlobals( [
  12                         'wgAllowExternalImages' => false,
  13                         'wgAllowExternalImagesFrom' => [],
  14                         'wgAllowImageTag' => false,
  15                         'wgEnableImageWhitelist' => false,
  16                         'wgLoadScript' => false,
  17                         'wgExtensionAssetsPath' => false,
  18                         'wgStylePath' => false,
  19                         'wgResourceBasePath' => null,
  20                         'wgCrossSiteAJAXdomains' => [
  21                                 'sister-site.somewhere.com',
  22                                 '*.wikipedia.org',
  23                                 '??.wikinews.org'
  24                         ],
  25                         'wgScriptPath' => '/w',
  26                         'wgForeignFileRepos' => [ [
  27                                 'class' => ForeignAPIRepo::class,
  28                                 'name' => 'wikimediacommons',
  29                                 'apibase' => 'https://commons.wikimedia.org/w/api.php',
  30                                 'url' => 'https://upload.wikimedia.org/wikipedia/commons',
  31                                 'thumbUrl' => 'https://upload.wikimedia.org/wikipedia/commons/thumb',
  32                                 'hashLevels' => 2,
  33                                 'transformVia404' => true,
  34                                 'fetchDescription' => true,
  35                                 'descriptionCacheExpiry' => 43200,
  36                                 'apiThumbCacheExpiry' => 0,
  37                                 'directory' => $wgUploadDirectory,
  38                                 'backend' => 'wikimediacommons-backend',
  39                         ] ],
  40                 ] );
  41                 // Note, there are some obscure globals which
  42                 // could affect the results which aren't included above.
  43
  44                 $context = RequestContext::getMain();
  45                 $resp = $context->getRequest()->response();
  46                 $conf = $context->getConfig();
  47                 $csp = new ContentSecurityPolicy( 'secret', $resp, $conf );
  48                 $this->csp = TestingAccessWrapper::newFromObject( $csp );
  49
  50                 return parent::setUp();
  51         }
  52
  53         /**
  54          * @covers ContentSecurityPolicy::getAdditionalSelfUrls
  55          */
  56         public function testGetAdditionalSelfUrlsRespectsUrlSettings() {
  57                 $this->setMwGlobals( 'wgLoadScript', 'https://wgLoadScript.example.org/load.php' );
  58                 $this->setMwGlobals( 'wgExtensionAssetsPath',
  59                         'https://wgExtensionAssetsPath.example.org/assets/' );
  60                 $this->setMwGlobals( 'wgStylePath', 'https://wgStylePath.example.org/style/' );
  61                 $this->setMwGlobals( 'wgResourceBasePath', 'https://wgResourceBasePath.example.org/resources/' );
  62
  63                 $this->assertEquals(
  64                         [
  65                                 'https://upload.wikimedia.org',
  66                                 'https://commons.wikimedia.org',
  67                                 'https://wgLoadScript.example.org',
  68                                 'https://wgExtensionAssetsPath.example.org',
  69                                 'https://wgStylePath.example.org',
  70                                 'https://wgResourceBasePath.example.org',
  71                         ],
  72                         array_values( $this->csp->getAdditionalSelfUrls() )
  73                 );
  74         }
  75
  76         /**
  77          * @dataProvider providerFalsePositiveBrowser
  78          * @covers ContentSecurityPolicy::falsePositiveBrowser
  79          */
  80         public function testFalsePositiveBrowser( $ua, $expected ) {
  81                 $actual = ContentSecurityPolicy::falsePositiveBrowser( $ua );
  82                 $this->assertEquals( $expected, $actual, $ua );
  83         }
  84
  85         public function providerFalsePositiveBrowser() {
  86                 // @codingStandardsIgnoreStart Generic.Files.LineLength
  87                 return [
  88                         [ 'Mozilla/5.0 (X11; Linux i686; rv:41.0) Gecko/20100101 Firefox/41.0', true ],
  89                         [ 'Mozilla/5.0 (X11; U; Linux i686; en-ca) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+ Debian/squeeze (2.30.6-1) Epiphany/2.30.6', false ]
  90                 ];
  91                 // @codingStandardsIgnoreEnd Generic.Files.LineLength
  92         }
  93
  94         /**
  95          * @dataProvider providerMakeCSPDirectives
  96          * @covers ContentSecurityPolicy::makeCSPDirectives
  97          */
  98         public function testMakeCSPDirectives(
  99                 $policy,
 100                 $expectedFull,
 101                 $expectedReport
 102         ) {
 103                 $actualFull = $this->csp->makeCSPDirectives( $policy, ContentSecurityPolicy::FULL_MODE );
 104                 $actualReport = $this->csp->makeCSPDirectives(
 105                         $policy, ContentSecurityPolicy::REPORT_ONLY_MODE
 106                 );
 107                 $policyJson = formatJson::encode( $policy );
 108                 $this->assertEquals( $expectedFull, $actualFull, "full: " . $policyJson );
 109                 $this->assertEquals( $expectedReport, $actualReport, "report: " . $policyJson );
 110         }
 111
 112         public function providerMakeCSPDirectives() {
 113                 // @codingStandardsIgnoreStart Generic.Files.LineLength
 114                 return [
 115                         [ false, '', '' ],
 116                         [
 117                                 [ 'useNonces' => false ],
 118                                 "script-src 'unsafe-eval' 'self' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 119                                 "script-src 'unsafe-eval' 'self' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 120                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'"
 121                         ],
 122                         [
 123                                 true,
 124                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 125                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 126                         ],
 127                         [
 128                                 [],
 129                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 130                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 131                          ],
 132                         [
 133                                 [ 'script-src' => [ 'http://example.com', 'http://something,else.com' ] ],
 134                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 135                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 136                         ],
 137                         [
 138                                 [ 'unsafeFallback' => false ],
 139                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 140                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 141                         ],
 142                         [
 143                                 [ 'unsafeFallback' => true ],
 144                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 145                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 146                         ],
 147                         [
 148                                 [ 'default-src' => false ],
 149                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 150                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 151                         ],
 152                         [
 153                                 [ 'default-src' => true ],
 154                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 155                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 156                         ],
 157                         [
 158                                 [ 'default-src' => [ 'https://foo.com', 'http://bar.com', 'baz.de' ] ],
 159                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 160                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 161                         ],
 162                         [
 163                                 [ 'includeCORS' => false ],
 164                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 165                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 166                         ],
 167                         [
 168                                 [ 'includeCORS' => false, 'default-src' => true ],
 169                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 170                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 171                         ],
 172                         [
 173                                 [ 'includeCORS' => true ],
 174                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 175                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 176                         ],
 177                         [
 178                                 [ 'report-uri' => false ],
 179                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 180                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 181                         ],
 182                         [
 183                                 [ 'report-uri' => true ],
 184                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 185                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 186                         ],
 187                         [
 188                                 [ 'report-uri' => 'https://example.com/index.php?foo;report=csp' ],
 189                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
 190                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
 191                         ],
 192                 ];
 193         }
 194
 195         /**
 196          * @covers ContentSecurityPolicy::makeCSPDirectives
 197          */
 198         public function testMakeCSPDirectivesImage() {
 199                 global $wgAllowImageTag;
 200                 $origImg = wfSetVar( $wgAllowImageTag, true );
 201
 202                 $actual = $this->csp->makeCSPDirectives( true, ContentSecurityPolicy::FULL_MODE );
 203
 204                 $wgAllowImageTag = $origImg;
 205
 206                 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&";
 207                 $this->assertEquals( $expected, $actual );
 208         }
 209
 210         /**
 211          * @covers ContentSecurityPolicy::makeCSPDirectives
 212          */
 213         public function testMakeCSPDirectivesReportUri() {
 214                 $actual = $this->csp->makeCSPDirectives(
 215                         true,
 216                         ContentSecurityPolicy::REPORT_ONLY_MODE
 217                 );
 218                 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&";
 219                 $this->assertEquals( $expected, $actual );
 220                 // @codingStandardsIgnoreEnd Generic.Files.LineLength
 221         }
 222
 223         /**
 224          * @covers ContentSecurityPolicy::getHeaderName
 225          */
 226         public function testGetHeaderName() {
 227                 $this->assertEquals(
 228                         $this->csp->getHeaderName( ContentSecurityPolicy::REPORT_ONLY_MODE ),
 229                         'Content-Security-Policy-Report-Only'
 230                 );
 231                 $this->assertEquals(
 232                         $this->csp->getHeaderName( ContentSecurityPolicy::FULL_MODE ),
 233                         'Content-Security-Policy'
 234                 );
 235         }
 236
 237         /**
 238          * @covers ContentSecurityPolicy::getReportUri
 239          */
 240         public function testGetReportUri() {
 241                 $full = $this->csp->getReportUri( ContentSecurityPolicy::FULL_MODE );
 242                 $fullExpected = '/w/api.php?action=cspreport&format=json&';
 243                 $this->assertEquals( $full, $fullExpected, 'normal report uri' );
 244
 245                 $report = $this->csp->getReportUri( ContentSecurityPolicy::REPORT_ONLY_MODE );
 246                 $reportExpected = $fullExpected . 'reportonly=1&';
 247                 $this->assertEquals( $report, $reportExpected, 'report only' );
 248
 249                 global $wgScriptPath;
 250                 $origPath = wfSetVar( $wgScriptPath, '/tl;dr/a,%20wiki' );
 251                 $esc = $this->csp->getReportUri( ContentSecurityPolicy::FULL_MODE );
 252                 $escExpected = '/tl%3Bdr/a%2C%20wiki/api.php?action=cspreport&format=json&';
 253                 $wgScriptPath = $origPath;
 254                 $this->assertEquals( $esc, $escExpected, 'test esc rules' );
 255         }
 256
 257         /**
 258          * @dataProvider providerPrepareUrlForCSP
 259          * @covers ContentSecurityPolicy::prepareUrlForCSP
 260          */
 261         public function testPrepareUrlForCSP( $url, $expected ) {
 262                 $actual = $this->csp->prepareUrlForCSP( $url );
 263                 $this->assertEquals( $actual, $expected, $url );
 264         }
 265
 266         public function providerPrepareUrlForCSP() {
 267                 global $wgServer;
 268                 return [
 269                         [ $wgServer, false ],
 270                         [ 'https://example.com', 'https://example.com' ],
 271                         [ 'https://example.com:200', 'https://example.com:200' ],
 272                         [ 'http://example.com', 'http://example.com' ],
 273                         [ 'example.com', 'example.com' ],
 274                         [ '*.example.com', '*.example.com' ],
 275                         [ 'https://*.example.com', 'https://*.example.com' ],
 276                         [ '//example.com', 'example.com' ],
 277                         [ 'https://example.com/path', 'https://example.com' ],
 278                         [ 'https://example.com/path:', 'https://example.com' ],
 279                         [ 'https://example.com/Wikipedia:NPOV', 'https://example.com' ],
 280                         [ 'https://tl;dr.com', 'https://tl%3Bdr.com' ],
 281                         [ 'yes,no.com', 'yes%2Cno.com' ],
 282                         [ '/relative-url', false ],
 283                         [ '/relativeUrl:withColon', false ],
 284                         [ 'data:', 'data:' ],
 285                         [ 'blob:', 'blob:' ],
 286                 ];
 287         }
 288
 289         /**
 290          * @covers ContentSecurityPolicy::escapeUrlForCSP
 291          */
 292         public function testEscapeUrlForCSP() {
 293                 $escaped = $this->csp->escapeUrlForCSP( ',;%2B' );
 294                 $this->assertEquals( $escaped, '%2C%3B%2B' );
 295         }
 296
 297         /**
 298          * @dataProvider providerCSPIsEnabled
 299          * @covers ContentSecurityPolicy::isNonceRequired
 300          */
 301         public function testCSPIsEnabled( $main, $reportOnly, $expected ) {
 302                 $this->setMwGlobals( 'wgCSPReportOnlyHeader', $reportOnly );
 303                 $this->setMwGlobals( 'wgCSPHeader', $main );
 304                 $res = ContentSecurityPolicy::isNonceRequired( RequestContext::getMain()->getConfig() );
 305                 $this->assertEquals( $res, $expected );
 306         }
 307
 308         public function providerCSPIsEnabled() {
 309                 return [
 310                         [ true, true, true ],
 311                         [ false, true, true ],
 312                         [ true, false, true ],
 313                         [ false, false, false ],
 314                         [ false, [], true ],
 315                         [ [], false, true ],
 316                         [ [ 'default-src' => [ 'foo.example.com' ] ], false, true ],
 317                         [ [ 'useNonces' => false ], [ 'useNonces' => false ], false ],
 318                         [ [ 'useNonces' => true ], [ 'useNonces' => false ], true ],
 319                         [ [ 'useNonces' => false ], [ 'useNonces' => true ], true ],
 320                 ];
 321         }
 322 }