Skip to content
Snippets Groups Projects
Commit 41c55fa9db03 authored by Georges Racinet's avatar Georges Racinet
Browse files

wsgi: testing CSP

since this wsgi server is meant for service the wire protocol
of repos over HTTP only, the utility is a bit dubious, but let's
honour it anyway.

Normally, `hgweb_mod` should do it as well, but I couldn't get it
to see a different config value (seems to be unsettable by
.hg/hgrc)
parent eced69b9ce96
No related branches found
No related tags found
No related merge requests found
......@@ -53,3 +53,13 @@
app.get('/group/proj.hg', params=dict(cmd='heads'), status=500)
finally:
hgweb_mod.hgweb.run_wsgi = orig
def test_content_security_policy(tmpdir):
# we don't need a repo for this test
hgs = make_hgserve(tmpdir)
app = webtest.TestApp(hgs)
csp = "default-src *; script-src https://assets.heptapod.example;"
hgs.ui.setconfig('web', 'csp', csp)
resp = app.get('/', status=404)
assert resp.headers['Content-Security-Policy'] == csp
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment