Page not found. URL is expired
Home'); 176 | return; 177 | } 178 | 179 | } else { 180 | var j = JSON.parse(result); 181 | res.render('index', { title: title, userinput: j }); 182 | return; 183 | } 184 | }); 185 | 186 | } 187 | } catch (err) { 188 | // handle the error safely 189 | console.log(err); 190 | res.status(400).send('Bad Request'); 191 | } 192 | 193 | }); 194 | 195 | /* GET WebKit csp test page. */ 196 | router.get('/webkit-test/:id', function(req, res) { 197 | try { 198 | 199 | var filename = req.params.id; 200 | // a crude input filter 201 | if (pattern.test(filename)) { 202 | fs.readFile(path.join(__dirname, webkit_tests + '/' + filename), 'utf8', 203 | function (error, data) { 204 | if (error) { 205 | res.status(400).send('Bad Request'); 206 | return; 207 | } 208 | 209 | var input = { 'cspheader' : '', 'htmlcode' : data }; 210 | var key = randomstring.generate(keylen); 211 | cachestore.setex(key, expiry, JSON.stringify(input), redis.print); 212 | 213 | var csp_hdr2 = csp_hdr + ' frame-src http://' + req.socket.localAddress + ':' + req.socket.localPort + ';'; 214 | res.set('content-security-policy', csp_hdr2); 215 | res.render('test', { title: title, 216 | testid: key, 217 | hostport: req.socket.localPort, 218 | hostip: req.socket.localAddress }); 219 | 220 | }); 221 | } 222 | 223 | } catch (err) { 224 | // handle the error safely 225 | console.log(err); 226 | res.status(400).send('Bad Request'); 227 | } 228 | }); 229 | 230 | /* GET WebKit csp1.1 test page. */ 231 | router.get('/webkit-test2/:id', function(req, res) { 232 | try { 233 | 234 | var filename = req.params.id; 235 | // a crude input filter 236 | if (pattern.test(filename)) { 237 | fs.readFile(path.join(__dirname, webkit_tests2 + '/' + filename), 'utf8', 238 | function (error, data) { 239 | if (error) { 240 | res.status(400).send('Bad Request'); 241 | return; 242 | } 243 | 244 | var input = { 'cspheader' : '', 'htmlcode' : data }; 245 | var key = randomstring.generate(keylen); 246 | cachestore.setex(key, expiry, JSON.stringify(input), redis.print); 247 | 248 | var csp_hdr2 = csp_hdr + ' frame-src http://' + req.socket.localAddress + ':' + req.socket.localPort + ';'; 249 | res.set('content-security-policy', csp_hdr2); 250 | res.render('test', { title: title, 251 | testid: key, 252 | hostport: req.socket.localPort, 253 | hostip: req.socket.localAddress }); 254 | 255 | }); 256 | } 257 | 258 | } catch (err) { 259 | // handle the error safely 260 | console.log(err); 261 | res.status(400).send('Bad Request'); 262 | } 263 | }); 264 | 265 | /* GET test page. */ 266 | router.post('/test', function(req, res) { 267 | try { 268 | 269 | var key = randomstring.generate(keylen); 270 | cachestore.setex(key, expiry, JSON.stringify(req.body), redis.print); 271 | 272 | if (req.body.windowtop) { 273 | res.set('content-security-policy', csp_hdr); 274 | res.render('test-window', { title: title, 275 | testid: key, 276 | hostname: hostname, 277 | hostport: req.socket.localPort, 278 | hostip: req.socket.localAddress, 279 | sharelink: false, 280 | showlink: false, 281 | linkexpiry: 0 }); 282 | } else { 283 | var csp_hdr2 = csp_hdr + ' frame-src http://' + req.socket.localAddress + ':' + req.socket.localPort + ';'; 284 | res.set('content-security-policy', csp_hdr2); 285 | res.render('test', { title: title, 286 | testid: key, 287 | hostport: req.socket.localPort, 288 | hostip: req.socket.localAddress }); 289 | } 290 | 291 | } catch (err) { 292 | // handle the error safely 293 | console.log(err); 294 | res.status(400).send('Bad Request'); 295 | } 296 | }); 297 | 298 | /* GET test-share page. */ 299 | router.get('/test-share/:id', function(req, res) { 300 | try { 301 | 302 | var key = req.params.id; 303 | var ts = req.query.ts; 304 | var current = new Date().getTime(); 305 | if ((ts === undefined) || (!ts) || isNaN(ts) || (ts < current)) { 306 | ts = current; // sorry i cant help :( 307 | } 308 | 309 | // checking the existence is good enough 310 | var showlink = true; 311 | if (req.query.sl === undefined) { 312 | showlink = false; 313 | } 314 | 315 | cachestore.exists(key, function (err, result) { 316 | if (err || !result) { 317 | console.log(key + ' : key not found'); 318 | res.status(400).send('Page not found. URL is expired
Home'); 319 | return; 320 | } else { 321 | // extend the expiry 322 | cachestore.expire(key, linkexpiry_ms); 323 | var lets = parseInt(ts); 324 | lets += parseInt(linkexpiry_ms); 325 | var sessionkey = key + '-' + randomstring.generate(7); 326 | res.set('content-security-policy', csp_hdr); 327 | res.render('test-window', { title: title, 328 | testid: sessionkey, 329 | hostname: hostname, 330 | hostport: req.socket.localPort, 331 | hostip: req.socket.localAddress, 332 | sharelink: true, 333 | showlink: showlink, 334 | linkexpiry: lets }); 335 | } 336 | }); 337 | 338 | } catch (err) { 339 | // handle the error safely 340 | console.log(err); 341 | res.status(400).send('Bad Request'); 342 | } 343 | }); 344 | 345 | /* GET test/id page. */ 346 | router.get('/test/:id', function(req, res) { 347 | try { 348 | 349 | // Yes, this is not a strong security assertion. Ideally tests should be 350 | // handled in a separate vhost. Also the recommendation is to host this 351 | // app in a separate domain 352 | if (req.hostname != req.socket.localAddress) { 353 | res.status(400).send('Page not found
Home'); 354 | return; 355 | } 356 | 357 | var sessionkey = req.params.id; 358 | var reporturi = '; report-uri /report/' + sessionkey; 359 | var key = sessionkey.slice(0, keylen); 360 | 361 | cachestore.get(key, function (err, result) { 362 | if (err || !result) { 363 | console.log(key + ' : key not found'); 364 | res.status(400).send('Page not found. URL is expired
Home'); 365 | return; 366 | } else { 367 | var j = JSON.parse(result); 368 | 369 | // cspheader can be empty 370 | if (j.cspheader) { 371 | if (j.hasOwnProperty('reportonly')) { 372 | res.set('content-security-policy-report-only', (j.cspheader).concat(reporturi)); 373 | res.set('X-Content-Security-Policy-Report-Only', (j.cspheader).concat(reporturi)); 374 | res.set('X-WebKit-CSP-Report-Only', (j.cspheader).concat(reporturi)); 375 | } else { 376 | res.set('content-security-policy', (j.cspheader).concat(reporturi)); 377 | res.set('X-Content-Security-Policy', (j.cspheader).concat(reporturi)); 378 | res.set('X-WebKit-CSP', (j.cspheader).concat(reporturi)); 379 | } 380 | } 381 | 382 | // to deal with CSP meta tag in the HTML file 383 | // eg: 384 | var code = j.htmlcode.replace(/\$CSP_REPORT_URI/g, '/report/' + sessionkey); 385 | res.send(code); 386 | //res.send(j.htmlcode); 387 | } 388 | }); 389 | 390 | } catch (err) { 391 | // handle the error safely 392 | console.log(err); 393 | res.status(400).send('Bad Request'); 394 | } 395 | }); 396 | 397 | /* POST report/id page. */ 398 | router.post('/report/:id', function(req, res) { 399 | try { 400 | 401 | var id = ('report_').concat(req.params.id); 402 | cachestore.rpush(id, JSON.stringify(req.body), redis.print); 403 | cachestore.expire(id, expiry); 404 | res.status(204).end(); 405 | 406 | } catch (err) { 407 | // handle the error safely 408 | console.log(err); 409 | res.status(400).send('Bad Request'); 410 | } 411 | }); 412 | 413 | /* GET report/id page. */ 414 | router.get('/report/:id', function(req, res) { 415 | try { 416 | var id = ('report_').concat(req.params.id); 417 | 418 | cachestore.lrange(id, 0, -1, function(err, records){ 419 | var len = records === null ? 0 : records.length; 420 | console.log('REDIS RECORDS LEN: ' + len); 421 | if (len > 0) { 422 | /*for (var i=0; i<%= message %>
2 | <% if (error.hasOwnProperty('status')) { %> 3 |<%= error.status %>
4 | <% } %> 5 | <% if (error.hasOwnProperty('stack')) { %> 6 |<%= error.stack %>7 | <% } %> 8 | -------------------------------------------------------------------------------- /views/index.ejs: -------------------------------------------------------------------------------- 1 | 2 | 3 | <% include partials/template/head.ejs %> 4 | 5 | 6 | <% include partials/template/header.ejs %> 7 |
8 |
48 |
49 |
50 |
51 |
52 |
--------------------------------------------------------------------------------
/views/partials/template/footer.ejs:
--------------------------------------------------------------------------------
1 |
4 |
--------------------------------------------------------------------------------
/views/partials/template/head.ejs:
--------------------------------------------------------------------------------
1 |
15 |
16 |
17 |
28 |
29 |
30 |
31 |
32 |
33 | | 19 | | document-uri | 20 |referrer | 21 |violated-directive | 22 |blocked-uri | 23 |
|---|
29 |
30 |
31 | <%= testid %>
34 |
35 |
36 |
37 |
38 |
--------------------------------------------------------------------------------
/views/test-window.ejs:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
9 |
10 |
15 |
16 | 11 | CSP Tester 12 | View violations 13 |
14 |17 |
18 |
25 | <% } else { %> 26 | View test code
27 | <% } %> 28 | This shareable link expires on: <%= linkexpiry %>
29 | <% } else { %> 30 |
31 |
32 |
33 | <% var ts = new Date().getTime(); %>
34 |
35 | <% } %>
36 | http://<%= hostip %>:<%= hostport %>/report2/<%= testid %>
38 | http://<%= hostip %>:<%= hostport %>/test/<%= testid %>
39 |
40 |
41 |
42 |
43 |
44 |
--------------------------------------------------------------------------------
/views/test.ejs:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | <% include partials/template/head.ejs %>
5 |
6 |
7 |
8 |
9 |
10 |
11 |
12 | <% include partials/template/header.ejs %>
13 |
14 |
15 |
38 |
39 |
16 |
17 |
18 |
19 |
20 |
21 |
22 |
33 |
34 |
35 |
36 |
37 | | 24 | | document-uri | 25 |referrer | 26 |violated-directive | 27 |blocked-uri | 28 |
|---|
34 |
35 | <%= testid %>
40 |
41 |
42 |
43 |
--------------------------------------------------------------------------------
/views/webkit-tests.ejs:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 | <% include partials/template/head.ejs %>
5 |
6 |
7 |
8 | <% include partials/template/header.ejs %>
9 |
10 |
12 | <% if (csp11 === true) { %>
13 |
14 | <% } else { %>
15 |
16 | <% } %>
17 |
18 |
19 | <% for(var i=0; i < tests.length; i++) { %>
20 |
34 |
35 |
36 |
37 |
38 |
39 |
--------------------------------------------------------------------------------
/webkit-tests/1.1/base-uri-allow.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | | <%= i+1 %> | 22 |<%= tests[i] %> | 23 |View | 24 | <% if (csp11 === true) { %> 25 |Run | 26 | <% } else { %> 27 |Run | 28 | <% } %> 29 | 30 |
35 |
Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed.
20 | 21 | 22 | -------------------------------------------------------------------------------- /webkit-tests/1.1/form-action-src-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 12 | 13 | 14 | 18 | 19 |Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed.
20 | 21 | 22 | -------------------------------------------------------------------------------- /webkit-tests/1.1/form-action-src-default-ignored.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 12 | 13 | 14 | 18 | 19 |Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed.
20 | 21 | 22 | -------------------------------------------------------------------------------- /webkit-tests/1.1/form-action-src-get-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 12 | 13 | 14 | 18 | 19 |Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed.
20 | 21 | 22 | -------------------------------------------------------------------------------- /webkit-tests/1.1/form-action-src-get-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 12 | 13 | 14 | 18 | 19 |Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed.
20 | 21 | 22 | -------------------------------------------------------------------------------- /webkit-tests/1.1/form-action-src-javascript-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 13 | 14 | 15 | 19 | 20 |Tests that blocking form actions works correctly. If this test passes, you will see a console error, and will not see a JavaScript alert.
21 | 22 | 23 | 24 | -------------------------------------------------------------------------------- /webkit-tests/1.1/form-action-src-redirect-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 13 | 14 | 15 | 19 | 20 |Tests that blocking form redirect works correctly. If this test passes, you will see a console error, and will not see a page indicating a form was POSTed.
21 | 22 | 23 | -------------------------------------------------------------------------------- /webkit-tests/1.1/frame-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /webkit-tests/1.1/frame-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /webkit-tests/1.1/frame-redirect-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /webkit-tests/1.1/meta-outside-head.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 8 | 9 | 10 |This test checks that Content Security Policy delivered via a meta element is not enforced if the element is outside the document's head.
11 | 12 | 15 | 16 | 17 | 18 | -------------------------------------------------------------------------------- /webkit-tests/1.1/plugintypes-notype-url.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | Given a `plugin-types` directive, plugins have to declare a type explicitly. 8 | No declared type, no load. This test passes if there's a console message 9 | above. 10 | 12 | 13 | 14 | -------------------------------------------------------------------------------- /webkit-tests/1.1/plugintypes-nourl-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | This test passes if there isn't a console message saying the plugin was blocked. 8 | 9 | 10 | 11 | -------------------------------------------------------------------------------- /webkit-tests/1.1/scripthash-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 10 | 13 | 16 | 19 | 20 | 21 |22 | This tests the effect of a valid script-hash value. It passes if no 23 | console warning is visible, and the alert() is executed. 24 |
25 | 26 | 27 | -------------------------------------------------------------------------------- /webkit-tests/1.1/scripthash-basic-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 10 | 13 | 15 | 16 | 17 | 18 | 19 |20 | This tests the effect of a valid script-hash value, with one valid 21 | script and several invalid ones. It passes if one alert is executed 22 | and four console warings are visible. 23 |
24 | 25 | 26 | -------------------------------------------------------------------------------- /webkit-tests/1.1/scripthash-ignore-unsafeinline.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 10 | 13 | 14 | 15 |16 | This tests that a valid hash value disables inline JavaScript, even if 'unsafe-inline' is present. 17 |
18 | 19 | 20 | -------------------------------------------------------------------------------- /webkit-tests/1.1/scripthash-unicode-normalization.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 10 | 15 | 19 | 23 | 24 | 25 |26 | This tests Unicode normalization. While appearing the same, the 27 | strings in the scripts are different Unicode points, but through 28 | normalization, should be the same when the hash is taken. 29 |
30 | 31 | 32 | -------------------------------------------------------------------------------- /webkit-tests/1.1/scriptnonce-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 9 | 12 | 15 | 16 | 17 |18 | This tests the effect of a valid script-nonce value. It passes if 19 | no console warning is visible and the alerts are executed. 20 |
21 | 22 | 23 | -------------------------------------------------------------------------------- /webkit-tests/1.1/scriptnonce-and-scripthash.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 10 | 13 | 16 | 19 | 22 | 23 | 24 |25 | This tests the combined use of script hash and script nonce. It 26 | passes if two console warnings are visible and the three alerts show 27 | PASS. 28 |
29 | 30 | 31 | -------------------------------------------------------------------------------- /webkit-tests/1.1/scriptnonce-basic-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 10 | 13 | 16 | 19 | 22 | 23 | 24 |25 | This tests the effect of a valid script-nonce value. It passes if 26 | three console warnings are visible, and the two PASS alerts are 27 | executed. 28 |
29 | 30 | 31 | -------------------------------------------------------------------------------- /webkit-tests/1.1/scriptnonce-ignore-unsafeinline.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 9 | 12 | 15 | 18 | 19 | 20 |21 | This tests that a valid nonce disables inline JavaScript, even if 'unsafe-inline' is present. 22 |
23 | 24 | 25 | -------------------------------------------------------------------------------- /webkit-tests/1.1/stylehash-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 |This tests the result of a valid style hash. It passes if this text is green, and a "PASS" alert for p1 is fired.
8 |This tests the result of a valid style hash. It passes if this text is green, and a "PASS" alert for p2 is fired.
9 |This tests the result of a valid style hash. It passes if this text is green, and a "PASS" alert for p3 is fired.
10 |This tests the result of a valid style hash. It passes if this text is green, and a "PASS" alert for p4 is fired.
11 | 12 | 13 | 14 | 15 | 43 | 44 | 45 | -------------------------------------------------------------------------------- /webkit-tests/1.1/stylehash-basic-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 |12 | This tests the effect of a valid style-hash value, with one valid 13 | style and several invalid ones. It passes if the valid style is applied 14 | and three console warnings are visible. 15 |
16 | 26 | 27 | 28 | -------------------------------------------------------------------------------- /webkit-tests/1.1/stylenonce-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 11 | 16 | 21 | 22 | 23 |This text should be green.
24 |This text should also be green.
25 | 32 | 33 | 34 | -------------------------------------------------------------------------------- /webkit-tests/1.1/stylenonce-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 10 | 11 | 12 |This text should be black.
13 | 16 | 17 | 18 | -------------------------------------------------------------------------------- /webkit-tests/blob-urls-match-self.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 |8 | blob: URLs are same-origin with the page in which they were created, 9 | and should therefore match the 'self' source in CSP directives. 10 |
11 | 12 | 23 | 24 | 25 | -------------------------------------------------------------------------------- /webkit-tests/combine-multiple-policies.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | This test checks that we enforce all the supplied policies. This test passes 10 | if it doesn't alert fail and if the style doesn't apply. 11 | 14 | 19 | 20 | 21 | -------------------------------------------------------------------------------- /webkit-tests/csptest.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 |Hello, world!
14 | 15 |
16 |
17 |
18 |
19 |
--------------------------------------------------------------------------------
/webkit-tests/default-src-inline-allowed.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
6 |
7 |
8 |
11 |
12 |
13 |
14 |
--------------------------------------------------------------------------------
/webkit-tests/duplicate-directive.html:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 |
8 |
9 |
10 | 11 | This tests the effect of duplicated directives. It passes if a 12 | console warning is visible, and the alert() is executed. 13 |
14 | 15 | 16 | -------------------------------------------------------------------------------- /webkit-tests/eval-allowed-in-report-only-mode.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 10 | 11 | 12 | -------------------------------------------------------------------------------- /webkit-tests/eval-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 12 | 15 | 16 | 17 | 18 | -------------------------------------------------------------------------------- /webkit-tests/eval-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 12 | 15 | 16 | 17 | 18 | -------------------------------------------------------------------------------- /webkit-tests/eval-scripts-setInterval-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 |8 | 21 |22 | 23 | 24 | 25 | -------------------------------------------------------------------------------- /webkit-tests/eval-scripts-setInterval-blocked.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 |
8 | 21 |22 | 23 | 24 | 25 | -------------------------------------------------------------------------------- /webkit-tests/eval-scripts-setTimeout-allowed.html: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | 6 | 7 |
8 | 20 |21 | 22 | 23 |