tests/phpunit/includes/ContentSecurityPolicyTest.php

   1 <?php
   2
   3 use Wikimedia\TestingAccessWrapper;
   4
   5 class ContentSecurityPolicyTest extends MediaWikiTestCase {
   6         /** @var ContentSecurityPolicy */
   7         private $csp;
   8
   9         protected function setUp() {
  10                 global $wgUploadDirectory;
  11                 $this->setMwGlobals( [
  12                         'wgAllowExternalImages' => false,
  13                         'wgAllowExternalImagesFrom' => [],
  14                         'wgAllowImageTag' => false,
  15                         'wgEnableImageWhitelist' => false,
  16                         'wgCrossSiteAJAXdomains' => [
  17                                 'sister-site.somewhere.com',
  18                                 '*.wikipedia.org',
  19                                 '??.wikinews.org'
  20                         ],
  21                         'wgScriptPath' => '/w',
  22                         'wgForeignFileRepos' => [ [
  23                                 'class' => ForeignAPIRepo::class,
  24                                 'name' => 'wikimediacommons',
  25                                 'apibase' => 'https://commons.wikimedia.org/w/api.php',
  26                                 'url' => 'https://upload.wikimedia.org/wikipedia/commons',
  27                                 'thumbUrl' => 'https://upload.wikimedia.org/wikipedia/commons/thumb',
  28                                 'hashLevels' => 2,
  29                                 'transformVia404' => true,
  30                                 'fetchDescription' => true,
  31                                 'descriptionCacheExpiry' => 43200,
  32                                 'apiThumbCacheExpiry' => 0,
  33                                 'directory' => $wgUploadDirectory,
  34                                 'backend' => 'wikimediacommons-backend',
  35                         ] ],
  36                 ] );
  37                 // Note, there are some obscure globals which
  38                 // could affect the results which aren't included above.
  39
  40                 RepoGroup::destroySingleton();
  41                 $context = RequestContext::getMain();
  42                 $resp = $context->getRequest()->response();
  43                 $conf = $context->getConfig();
  44                 $csp = new ContentSecurityPolicy( 'secret', $resp, $conf );
  45                 $this->csp = TestingAccessWrapper::newFromObject( $csp );
  46
  47                 return parent::setUp();
  48         }
  49
  50         /**
  51          * @dataProvider providerFalsePositiveBrowser
  52          * @covers ContentSecurityPolicy::falsePositiveBrowser
  53          */
  54         public function testFalsePositiveBrowser( $ua, $expected ) {
  55                 $actual = ContentSecurityPolicy::falsePositiveBrowser( $ua );
  56                 $this->assertEquals( $expected, $actual, $ua );
  57         }
  58
  59         public function providerFalsePositiveBrowser() {
  60                 // @codingStandardsIgnoreStart Generic.Files.LineLength
  61                 return [
  62                         [ 'Mozilla/5.0 (X11; Linux i686; rv:41.0) Gecko/20100101 Firefox/41.0', true ],
  63                         [ 'Mozilla/5.0 (X11; U; Linux i686; en-ca) AppleWebKit/531.2+ (KHTML, like Gecko) Version/5.0 Safari/531.2+ Debian/squeeze (2.30.6-1) Epiphany/2.30.6', false ]
  64                 ];
  65                 // @codingStandardsIgnoreEnd Generic.Files.LineLength
  66         }
  67
  68         /**
  69          * @dataProvider providerMakeCSPDirectives
  70          * @covers ContentSecurityPolicy::makeCSPDirectives
  71          */
  72         public function testMakeCSPDirectives(
  73                 $policy,
  74                 $expectedFull,
  75                 $expectedReport,
  76                 $expectedRestricted
  77         ) {
  78                 $actualFull = $this->csp->makeCSPDirectives( $policy, ContentSecurityPolicy::FULL_MODE );
  79                 $actualReport = $this->csp->makeCSPDirectives(
  80                         $policy, ContentSecurityPolicy::REPORT_ONLY_MODE
  81                 );
  82                 $actualRestricted = $this->csp->makeCSPDirectives(
  83                         $policy, ContentSecurityPolicy::FULL_MODE_RESTRICTED
  84                 );
  85                 $policyJson = formatJson::encode( $policy );
  86                 $this->assertEquals( $expectedFull, $actualFull, "full: " . $policyJson );
  87                 $this->assertEquals( $expectedReport, $actualReport, "report: " . $policyJson );
  88                 $this->assertEquals( $expectedRestricted, $actualRestricted, "restricted: " . $policyJson );
  89         }
  90
  91         public function providerMakeCSPDirectives() {
  92                 // @codingStandardsIgnoreStart Generic.Files.LineLength
  93                 return [
  94                         [ false, '', '', '' ],
  95                         [
  96                                 true,
  97                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
  98                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
  99                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 100                         ],
 101                         [
 102                                 [],
 103                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 104                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 105                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 106                          ],
 107                         [
 108                                 [ 'script-src' => [ 'http://example.com', 'http://something,else.com' ] ],
 109                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 110                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' http://example.com http://something%2Celse.com 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 111                                 "script-src 'unsafe-eval' 'self' http://example.com http://something%2Celse.com sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 112                         ],
 113                         [
 114                                 [ 'unsafeFallback' => false ],
 115                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 116                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 117                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 118                         ],
 119                         [
 120                                 [ 'unsafeFallback' => true ],
 121                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 122                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 123                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 124                         ],
 125                         [
 126                                 [ 'default-src' => false ],
 127                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 128                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 129                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 130                         ],
 131                         [
 132                                 [ 'default-src' => true ],
 133                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 134                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 135                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'",
 136                         ],
 137                         [
 138                                 [ 'default-src' => [ 'https://foo.com', 'http://bar.com', 'baz.de' ] ],
 139                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 140                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 141                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org https://foo.com http://bar.com baz.de sister-site.somewhere.com *.wikipedia.org 'unsafe-inline'",
 142                         ],
 143                         [
 144                                 [ 'includeCORS' => false ],
 145                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 146                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 147                                 "script-src 'unsafe-eval' 'self'; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 148                         ],
 149                         [
 150                                 [ 'includeCORS' => false, 'default-src' => true ],
 151                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 152                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 153                                 "script-src 'unsafe-eval' 'self'; default-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org; style-src 'self' data: blob: https://upload.wikimedia.org https://commons.wikimedia.org 'unsafe-inline'",
 154                         ],
 155                         [
 156                                 [ 'includeCORS' => true ],
 157                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 158                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 159                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 160                         ],
 161                         [
 162                                 [ 'report-uri' => false ],
 163                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 164                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 165                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 166                         ],
 167                         [
 168                                 [ 'report-uri' => true ],
 169                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&",
 170                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&",
 171                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 172                         ],
 173                         [
 174                                 [ 'report-uri' => 'https://example.com/index.php?foo;report=csp' ],
 175                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
 176                                 "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri https://example.com/index.php?foo%3Breport=csp",
 177                                 "script-src 'unsafe-eval' 'self' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'",
 178                         ],
 179                 ];
 180         }
 181
 182         /**
 183          * @covers ContentSecurityPolicy::makeCSPDirectives
 184          */
 185         public function testMakeCSPDirectivesImage() {
 186                 global $wgAllowImageTag;
 187                 $origImg = wfSetVar( $wgAllowImageTag, true );
 188
 189                 $actual = $this->csp->makeCSPDirectives( true, ContentSecurityPolicy::FULL_MODE );
 190
 191                 $wgAllowImageTag = $origImg;
 192
 193                 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&";
 194                 $this->assertEquals( $expected, $actual );
 195         }
 196
 197         /**
 198          * @covers ContentSecurityPolicy::makeCSPDirectives
 199          */
 200         public function testMakeCSPDirectivesReportUri() {
 201                 $actual = $this->csp->makeCSPDirectives(
 202                         true,
 203                         ContentSecurityPolicy::REPORT_ONLY_MODE
 204                 );
 205                 $expected = "script-src 'unsafe-eval' 'self' 'nonce-secret' 'unsafe-inline' sister-site.somewhere.com *.wikipedia.org; default-src * data: blob:; style-src * data: blob: 'unsafe-inline'; report-uri /w/api.php?action=cspreport&format=json&reportonly=1&";
 206                 $this->assertEquals( $expected, $actual );
 207                 // @codingStandardsIgnoreEnd Generic.Files.LineLength
 208         }
 209
 210         /**
 211          * @covers ContentSecurityPolicy::getHeaderName
 212          */
 213         public function testGetHeaderName() {
 214                 $this->assertEquals(
 215                         $this->csp->getHeaderName( ContentSecurityPolicy::REPORT_ONLY_MODE ),
 216                         'Content-Security-Policy-Report-Only'
 217                 );
 218                 $this->assertEquals(
 219                         $this->csp->getHeaderName( ContentSecurityPolicy::FULL_MODE ),
 220                         'Content-Security-Policy'
 221                 );
 222         }
 223
 224         /**
 225          * @covers ContentSecurityPolicy::getReportUri
 226          */
 227         public function testGetReportUri() {
 228                 $full = $this->csp->getReportUri( ContentSecurityPolicy::FULL_MODE );
 229                 $fullExpected = '/w/api.php?action=cspreport&format=json&';
 230                 $this->assertEquals( $full, $fullExpected, 'normal report uri' );
 231
 232                 $report = $this->csp->getReportUri( ContentSecurityPolicy::REPORT_ONLY_MODE );
 233                 $reportExpected = $fullExpected . 'reportonly=1&';
 234                 $this->assertEquals( $report, $reportExpected, 'report only' );
 235
 236                 global $wgScriptPath;
 237                 $origPath = wfSetVar( $wgScriptPath, '/tl;dr/a,%20wiki' );
 238                 $esc = $this->csp->getReportUri( ContentSecurityPolicy::FULL_MODE );
 239                 $escExpected = '/tl%3Bdr/a%2C%20wiki/api.php?action=cspreport&format=json&';
 240                 $wgScriptPath = $origPath;
 241                 $this->assertEquals( $esc, $escExpected, 'test esc rules' );
 242         }
 243
 244         /**
 245          * @dataProvider providerPrepareUrlForCSP
 246          * @covers ContentSecurityPolicy::prepareUrlForCSP
 247          */
 248         public function testPrepareUrlForCSP( $url, $expected ) {
 249                 $actual = $this->csp->prepareUrlForCSP( $url );
 250                 $this->assertEquals( $actual, $expected, $url );
 251         }
 252
 253         public function providerPrepareUrlForCSP() {
 254                 global $wgServer;
 255                 return [
 256                         [ $wgServer, false ],
 257                         [ 'https://example.com', 'https://example.com' ],
 258                         [ 'https://example.com:200', 'https://example.com:200' ],
 259                         [ 'http://example.com', 'http://example.com' ],
 260                         [ 'example.com', 'example.com' ],
 261                         [ '*.example.com', '*.example.com' ],
 262                         [ 'https://*.example.com', 'https://*.example.com' ],
 263                         [ '//example.com', 'example.com' ],
 264                         [ 'https://example.com/path', 'https://example.com' ],
 265                         [ 'https://example.com/path:', 'https://example.com' ],
 266                         [ 'https://example.com/Wikipedia:NPOV', 'https://example.com' ],
 267                         [ 'https://tl;dr.com', 'https://tl%3Bdr.com' ],
 268                         [ 'yes,no.com', 'yes%2Cno.com' ],
 269                         [ '/relative-url', false ],
 270                         [ '/relativeUrl:withColon', false ],
 271                         [ 'data:', 'data:' ],
 272                         [ 'blob:', 'blob:' ],
 273                 ];
 274         }
 275
 276         /**
 277          * @covers ContentSecurityPolicy::escapeUrlForCSP
 278          */
 279         public function testEscapeUrlForCSP() {
 280                 $escaped = $this->csp->escapeUrlForCSP( ',;%2B' );
 281                 $this->assertEquals( $escaped, '%2C%3B%2B' );
 282         }
 283
 284         /**
 285          * @dataProvider providerCSPIsEnabled
 286          * @covers ContentSecurityPolicy::isEnabled
 287          */
 288         public function testCSPIsEnabled( $main, $reportOnly, $expected ) {
 289                 global $wgCSPReportOnlyHeader, $wgCSPHeader;
 290                 global $wgCSPHeader;
 291                 $oldReport = wfSetVar( $wgCSPReportOnlyHeader, $reportOnly );
 292                 $oldMain = wfSetVar( $wgCSPHeader, $main );
 293                 $res = ContentSecurityPolicy::isEnabled( RequestContext::getMain()->getConfig() );
 294                 wfSetVar( $wgCSPReportOnlyHeader, $oldReport );
 295                 wfSetVar( $wgCSPHeader, $oldMain );
 296                 $this->assertEquals( $res, $expected );
 297         }
 298
 299         public function providerCSPIsEnabled() {
 300                 return [
 301                         [ true, true, true ],
 302                         [ false, true, true ],
 303                         [ true, false, true ],
 304                         [ false, false, false ],
 305                         [ false, [], true ],
 306                         [ [], false, true ],
 307                         [ [ 'default-src' => [ 'foo.example.com' ] ], false, true ],
 308                 ];
 309         }
 310 }