+ * {@code InfrastructureIT} asserts this over HTTP, which is the real proof — + * but its Swagger case is guarded by an {@code Assumptions.assumeFalse} and is + * skipped whenever the profile does not serve Swagger UI, which is every + * integration run today. So the half of the boundary that says "do not widen + * this one" was asserted nowhere that executes. + *
+ * Reading the configuration directly costs no container and no assumption, so + * both halves hold on every build. + * + * @since 6.3.0 + */ +@DisplayName("CSP policy") +class CspPolicyTest { + + private static final String DEFAULT_HEADER = "quarkus.http.filter.csp-default.header.\"Content-Security-Policy\""; + private static final String SWAGGER_HEADER = "quarkus.http.filter.csp-swagger.header.\"Content-Security-Policy\""; + + private static final String GITHUB_API = "https://api.github.com"; + + /** + * Read from the source tree rather than the classpath: {@code + * src/test/resources/application.properties} shadows the main file for tests + * and defines no CSP at all, so a classpath lookup finds nothing. The file + * below is the artefact these assertions exist to protect. + */ + private static Properties applicationProperties() throws Exception { + var path = Path.of(System.getProperty("basedir", ".")) + .resolve("src/main/resources/application.properties"); + assertTrue(Files.isRegularFile(path), "Expected the application config at " + path); + + var properties = new Properties(); + // Properties.load joins the trailing-backslash continuations the CSP + // headers are written across. + try (Reader in = Files.newBufferedReader(path)) { + properties.load(in); + } + return properties; + } + + /** Isolates one directive, so a source in a neighbouring one cannot match. */ + private static String directive(String csp, String name) { + for (var part : csp.split(";")) { + var trimmed = part.trim(); + var tokens = trimmed.split("\\s+", 2); + if (tokens.length > 0 && tokens[0].equals(name)) { + return trimmed; + } + } + return ""; + } + + /** + * Whether a directive lists exactly this source. + *
+ * Sources are whitespace-delimited, and equality is the only safe test on the + * permissive side: {@code contains} would also accept + * {@code https://api.github.com.evil}, a different host entirely that permits + * nothing we want. The prohibitive assertions below stay substring checks on + * purpose — there, matching more broadly is the stricter reading. + */ + private static boolean allows(String directive, String source) { + for (var token : directive.trim().split("\\s+")) { + if (token.equals(source)) { + return true; + } + } + return false; + } + + @Test + @DisplayName("the application policy may reach the GitHub API") + void applicationConnectSrcAllowsGitHubApi() throws Exception { + var csp = applicationProperties().getProperty(DEFAULT_HEADER); + assertNotNull(csp, DEFAULT_HEADER + " must be configured"); + + var connectSrc = directive(csp, "connect-src"); + assertTrue(allows(connectSrc, GITHUB_API), + "The Manager's update check reads api.github.com from the browser; without this " + + "source the browser refuses it before it leaves the page: " + connectSrc); + } + + @Test + @DisplayName("the Swagger UI policy does not") + void swaggerConnectSrcDoesNotAllowGitHubApi() throws Exception { + var csp = applicationProperties().getProperty(SWAGGER_HEADER); + assertNotNull(csp, SWAGGER_HEADER + " must be configured"); + + var connectSrc = directive(csp, "connect-src"); + assertFalse(connectSrc.contains("api.github.com"), + "Swagger UI never calls GitHub, so widening its connect-src is pure surface: " + + connectSrc); + } + + @Test + @DisplayName("neither policy relaxes anything else to reach it") + void theExceptionIsScopedToConnectSrc() throws Exception { + var properties = applicationProperties(); + + for (var key : new String[]{DEFAULT_HEADER, SWAGGER_HEADER}) { + var csp = properties.getProperty(key); + assertNotNull(csp, key + " must be configured"); + // A source pasted into default-src would grant it to every fetch + // directive that falls back, which is the opposite of a narrow + // exception. + assertFalse(directive(csp, "default-src").contains("api.github.com"), + key + " must keep the GitHub source out of default-src: " + csp); + assertFalse(directive(csp, "script-src").contains("api.github.com"), + key + " must not allow scripts from GitHub: " + csp); + } + } +} diff --git a/src/test/java/ai/labs/eddi/integration/InfrastructureIT.java b/src/test/java/ai/labs/eddi/integration/InfrastructureIT.java index aa92aab72..e797eb6e6 100644 --- a/src/test/java/ai/labs/eddi/integration/InfrastructureIT.java +++ b/src/test/java/ai/labs/eddi/integration/InfrastructureIT.java @@ -112,6 +112,12 @@ void swaggerUiCspHeader() { "Swagger UI CSP must allow 'unsafe-inline' for inline scripts: " + csp); Assertions.assertTrue(csp.contains("'unsafe-eval'"), "Swagger UI CSP must allow 'unsafe-eval' for JSON schema rendering: " + csp); + // The GitHub exception belongs to the application policy alone. Swagger UI + // never calls GitHub, and the two headers sit in one properties block edited + // by hand — so a copy-paste that widens this one has to fail here. + var swaggerConnectSrc = extractDirective(csp, "connect-src"); + Assertions.assertFalse(swaggerConnectSrc.contains("api.github.com"), + "Swagger UI connect-src must NOT carry the GitHub exception: " + swaggerConnectSrc); } @Test @@ -130,6 +136,13 @@ void apiPathCspHeader() { var scriptSrc = extractDirective(csp, "script-src"); Assertions.assertFalse(scriptSrc.contains("'unsafe-inline'"), "Non-Swagger script-src must NOT allow 'unsafe-inline': " + scriptSrc); + // The Manager's update check reads api.github.com from the browser. Without + // this source the browser refuses the request before it leaves the page, and + // the rejection is indistinguishable from an unreachable host — so tightening + // this back kills the feature quietly rather than loudly. + var connectSrc = extractDirective(csp, "connect-src"); + Assertions.assertTrue(allowsSource(connectSrc, "https://api.github.com"), + "Non-Swagger connect-src must allow the Manager's release check: " + connectSrc); } /** @@ -147,6 +160,22 @@ private static String extractDirective(String csp, String directive) { return ""; } + /** + * Whether a CSP directive lists exactly this source. Sources are + * whitespace-delimited, and equality is the only safe test on the permissive + * side: a substring match would also accept https://api.github.com.evil, which + * is a different host permitting nothing we want. The prohibitive assertions + * stay substring checks, where matching more broadly is stricter. + */ + private static boolean allowsSource(String directive, String source) { + for (var token : directive.trim().split("\\s+")) { + if (token.equals(source)) { + return true; + } + } + return false; + } + // ==================== Coordinator Admin ==================== @Test