1414 */
1515package org .htmlunit .csp ;
1616
17- import org .htmlunit .csp .directive .RequireTrustedTypesForDirective ;
18- import org .htmlunit .csp .directive .TrustedTypesDirective ;
19- import org .junit .jupiter .api .Test ;
20-
21- import java .util .ArrayList ;
22-
2317import static org .junit .jupiter .api .Assertions .assertEquals ;
2418import static org .junit .jupiter .api .Assertions .assertFalse ;
2519import static org .junit .jupiter .api .Assertions .assertTrue ;
2620
21+ import java .util .ArrayList ;
22+
23+ import org .htmlunit .csp .directive .RequireTrustedTypesForDirective ;
24+ import org .htmlunit .csp .directive .TrustedTypesDirective ;
25+ import org .junit .jupiter .api .Test ;
26+
2727/**
2828 * @author Michael Smith
2929 */
@@ -62,8 +62,7 @@ public void testTrustedTypesBasic() {
6262 assertTrue (p .allowsWildcardPolicyNames ());
6363 assertEquals (0 , tt .getPolicyNames_ ().size ());
6464 assertEquals (1 , observedErrors .size ());
65- assertEquals (Policy .Severity .Warning , observedErrors .get (0 ).severity_ ());
66- assertTrue (observedErrors .get (0 ).message_ ().contains ("Wildcard policy names" ));
65+ assertTrue (observedErrors .get (0 ).toString ().startsWith ("(Warning) Wildcard policy names (*) permit any policy name, which may reduce security" ));
6766
6867 // Allow duplicates
6968 p = Policy .parseSerializedCSP ("trusted-types myPolicy 'allow-duplicates'" , ThrowIfPolicyError );
@@ -80,10 +79,8 @@ public void testTrustedTypesBasic() {
8079 assertTrue (p .allowsWildcardPolicyNames ());
8180 assertTrue (tt .allowDuplicates ());
8281 assertEquals (2 , observedErrors .size ());
83- assertEquals (Policy .Severity .Warning , observedErrors .get (0 ).severity_ ());
84- assertTrue (observedErrors .get (0 ).message_ ().contains ("Wildcard policy names" ));
85- assertEquals (Policy .Severity .Warning , observedErrors .get (1 ).severity_ ());
86- assertTrue (observedErrors .get (1 ).message_ ().contains ("redundant when wildcard" ));
82+ assertTrue (observedErrors .get (0 ).toString ().startsWith ("(Warning) Wildcard policy names (*) permit any policy name, which may reduce security" ));
83+ assertTrue (observedErrors .get (1 ).toString ().startsWith ("(Warning) 'allow-duplicates' is redundant when wildcard (*) is present" ));
8784
8885 // None keyword
8986 p = Policy .parseSerializedCSP ("trusted-types 'none'" , ThrowIfPolicyError );
@@ -146,115 +143,156 @@ public void testTrustedTypesCaseInsensitiveKeywords() {
146143 p = Policy .parseSerializedCSP ("trusted-types 'ALLOW-DUPLICATES'" , consumer );
147144 assertTrue (p .trustedTypes ().get ().allowDuplicates ());
148145 assertEquals (1 , observedErrors .size ());
149- assertEquals (Policy .Severity .Warning , observedErrors .get (0 ).severity_ ());
150- assertTrue (observedErrors .get (0 ).message_ ().contains ("has no effect without policy names" ));
146+ assertTrue (observedErrors .get (0 ).toString ().startsWith ("(Warning) 'allow-duplicates' has no effect without policy names or wildcard" ));
151147
152148 p = Policy .parseSerializedCSP ("TRUSTED-TYPES myPolicy" , ThrowIfPolicyError );
153149 assertTrue (p .trustedTypes ().isPresent ());
154150 });
155151 }
156152
157153 @ Test
158- public void testTrustedTypesErrors () {
159- // 'none' combined with other values
154+ public void testTrustedTypesErrorsNoneCombined () {
160155 roundTrips (
161156 "trusted-types 'none' myPolicy" ,
162157 e (Policy .Severity .Error , "'none' must not be combined with any other trusted-types expression" , 0 , -1 )
163158 );
159+ }
164160
161+ @ Test
162+ public void testTrustedTypesErrorsNoneStar () {
165163 roundTrips (
166164 "trusted-types 'none' *" ,
165+ e (Policy .Severity .Warning , "Wildcard policy names (*) permit any policy name, which may reduce security" , 0 , 1 ),
167166 e (Policy .Severity .Error , "'none' must not be combined with any other trusted-types expression" , 0 , -1 )
168167 );
168+ }
169169
170+ @ Test
171+ public void testTrustedTypesErrorsNoneTwoOthers () {
170172 roundTrips (
171173 "trusted-types 'none' 'allow-duplicates'" ,
172- e (Policy .Severity .Error , "'none' must not be combined with any other trusted-types expression" , 0 , -1 )
174+ e (Policy .Severity .Error , "'none' must not be combined with any other trusted-types expression" , 0 , -1 ),
175+ e (Policy .Severity .Warning , "'allow-duplicates' has no effect without policy names or wildcard" , 0 , -1 )
173176 );
177+ }
174178
175- // Invalid keyword
179+ @ Test
180+ public void testTrustedTypesErrorsInvalidKeyword () {
176181 roundTrips (
177182 "trusted-types 'invalid-keyword'" ,
178183 e (Policy .Severity .Error , "Unrecognized trusted-types keyword 'invalid-keyword'" , 0 , 0 )
179184 );
185+ }
180186
181- // Invalid policy name
187+ @ Test
188+ public void testTrustedTypesErrorsInvalidPolicyName () {
182189 roundTrips (
183190 "trusted-types policy!name" ,
184191 e (Policy .Severity .Error , "Invalid trusted-types policy name policy!name" , 0 , 0 )
185192 );
193+ }
186194
187- // Duplicate policy name
195+ @ Test
196+ public void testTrustedTypesErrorsDuplicatePolicyName () {
188197 roundTrips (
189198 "trusted-types myPolicy myPolicy" ,
190199 e (Policy .Severity .Warning , "Duplicate policy name myPolicy" , 0 , 1 )
191200 );
201+ }
192202
203+ @ Test
204+ public void testTrustedTypesErrorsDifferentCasePolicyNotDuplicates () {
193205 // Different case policy names are NOT duplicates (case-sensitive per browser behavior)
194206 roundTrips (
195207 "trusted-types myPolicy MYPOLICY"
196208 );
209+ }
197210
198- // Duplicate keyword
211+ @ Test
212+ public void testTrustedTypesErrorsDuplicateKeywords () {
199213 roundTrips (
200214 "trusted-types 'allow-duplicates' 'allow-duplicates'" ,
201- e (Policy .Severity .Warning , "Duplicate keyword 'allow-duplicates'" , 0 , 1 )
215+ e (Policy .Severity .Warning , "Duplicate keyword 'allow-duplicates'" , 0 , 1 ),
216+ e (Policy .Severity .Warning , "'allow-duplicates' has no effect without policy names or wildcard" , 0 , -1 )
202217 );
218+ }
203219
204- // Duplicate wildcard
220+ @ Test
221+ public void testTrustedTypesErrorsDuplicateWildcard () {
205222 roundTrips (
206223 "trusted-types * *" ,
207224 e (Policy .Severity .Warning , "Wildcard policy names (*) permit any policy name, which may reduce security" , 0 , 0 ),
208225 e (Policy .Severity .Warning , "Duplicate wildcard *" , 0 , 1 )
209226 );
227+ }
210228
229+ @ Test
230+ public void testTrustedTypesErrorsPolicyNameWithWildcard () {
211231 // Policy name with wildcard (wildcard makes policy names redundant)
212232 roundTrips (
213233 "trusted-types myPolicy *" ,
214234 e (Policy .Severity .Warning , "Wildcard policy names (*) permit any policy name, which may reduce security" , 0 , 1 ),
215235 e (Policy .Severity .Warning , "Wildcard (*) permits any policy name, making specific policy names redundant" , 0 , -1 )
216236 );
237+ }
217238
218- // Multiple policy names with wildcard
239+ @ Test
240+ public void testTrustedTypesErrorsMultiplePlolicyNamesWithWildcard () {
219241 roundTrips (
220242 "trusted-types one two *" ,
221243 e (Policy .Severity .Warning , "Wildcard policy names (*) permit any policy name, which may reduce security" , 0 , 2 ),
222244 e (Policy .Severity .Warning , "Wildcard (*) permits any policy name, making specific policy names redundant" , 0 , -1 )
223245 );
246+ }
224247
225- // Duplicate directive
248+ @ Test
249+ public void testTrustedTypesErrorsDuplicateDirective () {
226250 roundTrips (
227251 "trusted-types one; trusted-types two" ,
228252 e (Policy .Severity .Warning , "Duplicate directive trusted-types" , 1 , -1 )
229253 );
254+ }
230255
231- // Empty directive
256+ @ Test
257+ public void testTrustedTypesErrorsEmptyDirective () {
232258 roundTrips (
233259 "trusted-types" ,
234260 e (Policy .Severity .Warning , "Empty trusted-types directive allows all policy names (use '*' or 'none' to be explicit)" , 0 , -1 )
235261 );
262+ }
236263
264+ @ Test
265+ public void testTrustedTypesErrorsAllowDuplicatesalone () {
237266 // 'allow-duplicates' alone (no policy names or wildcard)
238267 roundTrips (
239268 "trusted-types 'allow-duplicates'" ,
240269 e (Policy .Severity .Warning , "'allow-duplicates' has no effect without policy names or wildcard" , 0 , -1 )
241270 );
271+ }
242272
273+ @ Test
274+ public void testTrustedTypesErrorsWildcardWithAllowDuplicates () {
243275 // Wildcard with allow-duplicates (redundant)
244276 roundTrips (
245277 "trusted-types * 'allow-duplicates'" ,
246278 e (Policy .Severity .Warning , "Wildcard policy names (*) permit any policy name, which may reduce security" , 0 , 0 ),
247279 e (Policy .Severity .Warning , "'allow-duplicates' is redundant when wildcard (*) is present" , 0 , -1 )
248280 );
281+ }
249282
283+ @ Test
284+ public void testTrustedTypesErrorsPolicyNameWithWildcardAndAllowDuplicates () {
250285 // Policy names with wildcard and allow-duplicates (multiple redundancies)
251286 roundTrips (
252287 "trusted-types myPolicy * 'allow-duplicates'" ,
253288 e (Policy .Severity .Warning , "Wildcard policy names (*) permit any policy name, which may reduce security" , 0 , 1 ),
254289 e (Policy .Severity .Warning , "Wildcard (*) permits any policy name, making specific policy names redundant" , 0 , -1 ),
255290 e (Policy .Severity .Warning , "'allow-duplicates' is redundant when wildcard (*) is present" , 0 , -1 )
256291 );
292+ }
257293
294+ @ Test
295+ public void testTrustedTypesErrorsWildcardBeforePolicyName () {
258296 // Order independence: wildcard before policy name
259297 roundTrips (
260298 "trusted-types * myPolicy" ,
@@ -426,10 +464,6 @@ public void testAllowsWildcardPolicyNames() {
426464 // Helper methods
427465
428466 private static void roundTrips (String input , PolicyError ... errors ) {
429- serializesTo (input , input , errors );
430- }
431-
432- private static void serializesTo (String input , String output , PolicyError ... errors ) {
433467 ArrayList <PolicyError > observedErrors = new ArrayList <>();
434468 Policy .PolicyErrorConsumer consumer = (severity , message , directiveIndex , valueIndex ) -> {
435469 observedErrors .add (e (severity , message , directiveIndex , valueIndex ));
@@ -439,6 +473,6 @@ private static void serializesTo(String input, String output, PolicyError... err
439473 for (int i = 0 ; i < errors .length ; ++i ) {
440474 assertEquals (errors [i ], observedErrors .get (i ));
441475 }
442- assertEquals (output , policy .toString ());
476+ assertEquals (input , policy .toString ());
443477 }
444478}
0 commit comments