John O'Keefe
fb95b6d400
script-src now allow-lists the guard by sha256 of its rendered bytes (middleware.ScriptHashThemeFlashGuard) instead of 'unsafe-inline' — the guard is the app's only inline <script>. security_headers_test.go renders templates.ThemeFlashGuard() and fails with the replacement hash if the script text ever drifts. Executing anti-XSS strict CSP surfaced three latent violations the eval-removal sweep couldn't see (hash mode is stricter than eval mode, because inline event handler ATTRIBUTES now count against script-src): 1. admin_archived / admin_library: 15 native onclick=/onsubmit= handlers (modal open/close, folder-browser picker, purge button) converted to Alpine @click/@submit component methods — openCreateLibraryModal, hideModal, pickBrowsePath added to the admin component; purgeArchivedItems promoted from its window global into the component and the (window as any) exposure removed. 2. dashboard/docs: onclick handlers converted — dashboard's event.stopPropagation() → @click.stop; docs' sidebar/search closers → closeDocsSidebar/closeSearchResults component methods. 3. 8 onerror= image-fallback attributes (cover placeholders app-wide + audiobook cover hide) replaced by data-fallback attributes handled by one delegated capture-phase listener in web/src/image_fallback.ts — works for htmx-swapped content without re-binding. Verified: theme guard applies a saved theme on public pages under the hash CSP; 14-page authenticated sweep clean; admin pages clean under the promoted admin; admin-library modal open/close bindings exercised; readers render error-free; go build/vet/middleware-test, tsc, vp check/test (146), build:ts all green.
52 lines
1.8 KiB
Go
52 lines
1.8 KiB
Go
package middleware_test
|
|
|
|
import (
|
|
"context"
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"regexp"
|
|
"strings"
|
|
"testing"
|
|
|
|
"bookhoard/internal/middleware"
|
|
"bookhoard/templates"
|
|
)
|
|
|
|
// TestThemeFlashGuardHashMatchesCSP pins the CSP script hash to the theme
|
|
// flash guard's rendered bytes: the guard is the app's ONLY inline script,
|
|
// and script-src allow-lists it by content hash. If the guard's script text
|
|
// is ever edited, this test fails and prints the replacement hash — copy it
|
|
// into middleware.ScriptHashThemeFlashGuard.
|
|
func TestThemeFlashGuardHashMatchesCSP(t *testing.T) {
|
|
var sb strings.Builder
|
|
if err := templates.ThemeFlashGuard().Render(context.Background(), &sb); err != nil {
|
|
t.Fatalf("render ThemeFlashGuard: %v", err)
|
|
}
|
|
rendered := sb.String()
|
|
|
|
m := regexp.MustCompile(`(?s)<script>(.*?)</script>`).FindStringSubmatch(rendered)
|
|
if m == nil {
|
|
t.Fatalf("rendered guard contains no <script> element:\n%s", rendered)
|
|
}
|
|
digest := sha256.Sum256([]byte(m[1]))
|
|
computed := "sha256-" + base64.StdEncoding.EncodeToString(digest[:])
|
|
if !strings.Contains(middleware.ScriptHashThemeFlashGuard, computed) {
|
|
t.Errorf(`
|
|
theme flash guard script hash drifted.
|
|
|
|
CSP constant contains: %s
|
|
rendered script hashes to: %s
|
|
|
|
Recompute: sha256 over the bytes between <script> and </script> of
|
|
templates/theme_flash_guard.templ, base64-encoded, then update
|
|
middleware.ScriptHashThemeFlashGuard and the CSP header string.`,
|
|
middleware.ScriptHashThemeFlashGuard, computed)
|
|
}
|
|
|
|
// The strict allow-list only holds the guard: no 'unsafe-inline' may
|
|
// sneak back into script-src (style-src keeps it for htmx/Alpine).
|
|
if strings.Contains(middleware.ScriptHashThemeFlashGuard, "unsafe-inline") {
|
|
t.Error("script-src must not re-introduce 'unsafe-inline' alongside the hash")
|
|
}
|
|
}
|