Merge pull request #872 from mendix/DEPS-553_allow_http_headers

DEPS-553 allow cross-origin related http response headers

Author: sailhenz

buildpack/core/nginx.py

@@ -23,6 +23,10 @@
     "X-Permitted-Cross-Domain-Policies": r"(?i)(^all$|^none$|^master-only$|^by-content-type$|^by-ftp-filename$)",  # noqa: C0301
     "Origin-Trial": r"[a-zA-Z0-9:;/''\"\*_\- \.\n?=%&+]+",
     "X-XSS-Protection": r"(?i)(^0$|^1$|^1; mode=block$|^1; report=https?://([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9])(\.([a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9\-]{0,61}[a-zA-Z0-9]))*(:\d+)?$)",  # noqa: C0301
+    "Cross-Origin-Resource-Policy": r"(?i)(^same-origin$|^same-site$|^cross-origin$)",
+    "Cross-Origin-Opener-Policy": r"(?i)(^unsafe-none$|^same-origin$|^same-origin-allow-popups$|^noopener-allow-popups$)",
+    "Cross-Origin-Embedder-Policy": r"(?i)(^unsafe-none$|^require-corp$|^credentialless$)",
+    "Clear-Site-Data": r"(?i)(^cache$|^cookies$|^storage$|^executionContexts$|^prefetchCache$|^prerenderCache$)",
 }
 
 CONFIG_FILE = "nginx/conf/nginx.conf"

tests/unit/test_custom_headers.py

@@ -192,3 +192,91 @@ def test_inValid_header_originTrial(self):
         )
         header_config = nginx._get_http_headers()
         self.assertEqual([], header_config)
+
+    def test_valid_header_cross_origin_resource_policy(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Cross-Origin-Resource-Policy": "same-origin"
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertIn(
+            ("Cross-Origin-Resource-Policy",
+             "same-origin",
+             ),
+            header_config,
+        )
+    def test_invalid_header_cross_origin_resource_policy(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Cross-Origin-Resource-Policy": "#####"
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertEqual([], header_config)
+
+    def test_valid_header_cross_origin_opener_policy(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Cross-Origin-Opener-Policy": "same-origin"
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertIn(
+            ("Cross-Origin-Opener-Policy",
+             "same-origin",
+             ),
+            header_config,
+        )
+    def test_invalid_header_cross_origin_opener_policy(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Cross-Origin-Opener-Policy": "&^%$#"
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertEqual([], header_config)
+
+    def test_valid_header_cross_origin_embedder_policy(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Cross-Origin-Embedder-Policy": "require-corp"
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertIn(
+            ("Cross-Origin-Embedder-Policy",
+             "require-corp",
+             ),
+            header_config,
+        )
+    def test_invalid_header_cross_origin_embedder_policy(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Cross-Origin-Embedder-Policy": "&^as%$#"
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertEqual([], header_config)
+
+    def test_valid_header_clear_site_data_policy(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Clear-Site-Data": "executionContexts"
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertIn(
+            ("Clear-Site-Data",
+             "executionContexts",
+             ),
+            header_config,
+        )
+    def test_invalid_header_clear_site_data_policy(self):
+        os.environ["HTTP_RESPONSE_HEADERS"] = json.dumps(
+            {
+                "Clear-Site-Data": "&^as%$#"
+            }
+        )
+        header_config = nginx._get_http_headers()
+        self.assertEqual([], header_config)