25 lines
770 B
TypeScript
25 lines
770 B
TypeScript
// @vitest-environment jsdom
|
|
import { describe, expect, it } from "vitest";
|
|
|
|
import { getCurrentDocumentCspNonce } from "./documentCspNonce";
|
|
|
|
describe("document CSP nonce", () => {
|
|
it("reads the browser nonce property from a trusted document script", () => {
|
|
const script = document.createElement("script");
|
|
script.nonce = "aBcDeFgHiJkLmNoPqRsTuVwX";
|
|
document.head.appendChild(script);
|
|
|
|
expect(getCurrentDocumentCspNonce(document)).toBe(script.nonce);
|
|
script.remove();
|
|
});
|
|
|
|
it("ignores malformed nonce attributes", () => {
|
|
const script = document.createElement("script");
|
|
script.nonce = "spoofed";
|
|
document.head.appendChild(script);
|
|
|
|
expect(getCurrentDocumentCspNonce(document)).toBeUndefined();
|
|
script.remove();
|
|
});
|
|
});
|