mirrors/django
1
0
Fork 0
mirror of https://github.com/django/django.git synced 2025-07-19 03:05:32 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Fixed #29406 -- Added support for Referrer-Policy header.

Browse source 
Thanks to James Bennett for the initial implementation.
This commit is contained in:
Nick Pope 2019-03-21 21:33:41 +00:00 • committed by Carlton Gibson
parent 1edbb6c194
commit 406dba04e1
10 changed files with 256 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

43
tests/check_framework/test_security.py
View file

@ -502,3 +502,46 @@ class CheckAllowedHostsTest(SimpleTestCase):
@override_settings(ALLOWED_HOSTS=['.example.com'])
def test_allowed_hosts_set(self):
self.assertEqual(self.func(None), [])
class CheckReferrerPolicyTest(SimpleTestCase):
@property
def func(self):
from django.core.checks.security.base import check_referrer_policy
return check_referrer_policy
@override_settings(
MIDDLEWARE=['django.middleware.security.SecurityMiddleware'],
SECURE_REFERRER_POLICY=None,
)
def test_no_referrer_policy(self):
self.assertEqual(self.func(None), [base.W022])
@override_settings(MIDDLEWARE=[], SECURE_REFERRER_POLICY=None)
def test_no_referrer_policy_no_middleware(self):
"""
Don't warn if SECURE_REFERRER_POLICY is None and SecurityMiddleware
isn't in MIDDLEWARE.
"""
self.assertEqual(self.func(None), [])
@override_settings(MIDDLEWARE=['django.middleware.security.SecurityMiddleware'])
def test_with_referrer_policy(self):
tests = (
'strict-origin',
'strict-origin,origin',
'strict-origin, origin',
['strict-origin', 'origin'],
('strict-origin', 'origin'),
)
for value in tests:
with self.subTest(value=value), override_settings(SECURE_REFERRER_POLICY=value):
self.assertEqual(self.func(None), [])
@override_settings(
MIDDLEWARE=['django.middleware.security.SecurityMiddleware'],
SECURE_REFERRER_POLICY='invalid-value',
)
def test_with_invalid_referrer_policy(self):
self.assertEqual(self.func(None), [base.E023])