prosody
0b01f40df0f9
spec/net_http_server_spec.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Annotate

spec/net_http_server_spec.lua @ 13854:0b01f40df0f9 13.0

mod_http_file_share: Add media-src 'self' to Content-Security-Policy header This allows certain media files to be loaded when navigated to directly in a web browser. Note that in some browsers (Chrome), the media gets transformed internally into a HTML page with some basic styles, but these are blocked due to our default-src policy of 'none' Although this could be unblocked with style-src unsafe-inline, it is not our plan to fix this, because this would have negative security implications. The reason for our CSP is to prevent the file share service from being used to host malicious HTML/CSS/JS. Yes, CSS can be malicious. Our file share service is for uploading and downloading files, it is not a substitute for website/content hosting.
author Matthew Wild <mwild1@gmail.com>
date Fri, 18 Apr 2025 12:25:06 +0100
parent 8687:ee01578c67cb
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
8413
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
1 describe("net.http.server", function ()
8687
ee01578c67cb net.http.server: Prevent loading of net.server in tests (breaks unrelated tests for some reason)
Kim Alvefur <zash@zash.se>
parents: 8413
diff changeset
2 package.loaded["net.server"] = {}
8413
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
3 local server = require "net.http.server";
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
4 describe("events", function ()
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
5 it("should work with util.helpers", function ()
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
6 -- See #1044
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
7 server.add_handler("GET host/foo/*", function () end, 0);
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
8 server.add_handler("GET host/foo/bar", function () end, 0);
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
9 local helpers = require "util.helpers";
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
10 assert.is.string(helpers.show_events(server._events));
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
11 end);
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
12 end);
9a234e25b35b spec/net.http.server: Add test for #1044
Kim Alvefur <zash@zash.se>
parents:
diff changeset
13 end);