ynkmr/gitea
1
0
Fork 0
mirror of https://github.com/go-gitea/gitea.git synced 2026-09-06 13:03:24 +09:00
Code Issues Projects Releases Wiki Activity

enhance: move window.config to JSON, improve CSP format (#39236)

Browse Source 
Co-authored-by: wxiaoguang <wxiaoguang@gmail.com>
This commit is contained in:
silverwind
2026-09-05 08:50:43 +00:00
committed by GitHub
co-authored by wxiaoguang
parent efa69e7230
commit eb501f6b19
8 changed files with 72 additions and 50 deletions
Download Patch File Download Diff File Expand all files Collapse all files
services/context/context_test.go
+10
View File
@@ -7,6 +7,7 @@ import (
"net/http"
"net/http/httptest"
"net/url"
"strings"
"testing"
"gitea.dev/modules/reqctx"
@@ -64,3 +65,12 @@ func TestAppFullLink(t *testing.T) {
assert.Equal(t, "https://gitea.example.com/sub/user/repo", string(tmplCtx.AppFullLink("user/repo")))
assert.Equal(t, "https://gitea.example.com/sub/user/repo", string(tmplCtx.AppFullLink("/user/repo")))
}
func TestHeadMetaContentSecurityPolicy(t *testing.T) {
tmplCtx := NewTemplateContext(reqctx.NewRequestContextForTest(t), nil)
nonce := tmplCtx.CspScriptNonce()
assert.Equal(t, `<meta http-equiv="Content-Security-Policy" content="default-src * data: blob:;script-src * 'nonce-`+nonce+`';style-src * 'unsafe-inline';">`, string(tmplCtx.HeadMetaContentSecurityPolicy()))
assert.False(t, strings.ContainsAny(WebContentSecurityPolicy(nonce), `"<>&`))
defer test.MockVariableValue(&setting.Security.ContentSecurityPolicyGeneral, "unset")()
assert.Empty(t, tmplCtx.HeadMetaContentSecurityPolicy())
}