fix: Migrate security headers check tests and fix the SetupCheck implementation

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>

1 files changed, 0 insertions, 409 deletions

diff --git a/core/js/tests/specs/setupchecksSpec.js b/core/js/tests/specs/setupchecksSpec.js
index bef316b16c9..b027bfd21bd 100644
--- a/core/js/tests/specs/setupchecksSpec.js
+++ b/core/js/tests/specs/setupchecksSpec.js
@@ -336,416 +336,10 @@ describe('OC.SetupChecks tests', function() {
 				expect(data).toEqual([{
 					msg: 'Error occurred while checking server setup',
 					type: OC.SetupChecks.MESSAGE_TYPE_ERROR
-				},{
-					msg: 'Error occurred while checking server setup',
-					type: OC.SetupChecks.MESSAGE_TYPE_ERROR
 				}]);
 				done();
 			});
 		});
-
-		it('should return all errors if all headers are missing', function(done) {
-			protocolStub.returns('https');
-			var async = OC.SetupChecks.checkGeneric();
-
-			suite.server.requests[0].respond(
-				200,
-				{
-					'Content-Type': 'application/json',
-					'Strict-Transport-Security': 'max-age=15768000'
-				},
-				'{}'
-			);
-
-			async.done(function( data, s, x ){
-				expect(data).toEqual([
-				{
-					msg: 'The "X-Content-Type-Options" HTTP header is not set to "nosniff". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-					type: OC.SetupChecks.MESSAGE_TYPE_WARNING
-				}, {
-					msg: 'The "X-Robots-Tag" HTTP header is not set to "noindex, nofollow". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-					type: OC.SetupChecks.MESSAGE_TYPE_WARNING
-				}, {
-					msg: 'The "X-Frame-Options" HTTP header is not set to "SAMEORIGIN". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-					type: OC.SetupChecks.MESSAGE_TYPE_WARNING
-				}, {
-					msg: 'The "X-Permitted-Cross-Domain-Policies" HTTP header is not set to "none". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-					type: OC.SetupChecks.MESSAGE_TYPE_WARNING
-				}, {
-					msg: 'The "X-XSS-Protection" HTTP header does not contain "1; mode=block". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-					type: OC.SetupChecks.MESSAGE_TYPE_WARNING
-				}, {
-					msg: 'The "Referrer-Policy" HTTP header is not set to "no-referrer", "no-referrer-when-downgrade", "strict-origin", "strict-origin-when-cross-origin" or "same-origin". This can leak referer information. See the <a target="_blank" rel="noreferrer noopener" class="external" href="https://www.w3.org/TR/referrer-policy/">W3C Recommendation ↗</a>.',
-					type: OC.SetupChecks.MESSAGE_TYPE_INFO
-				}
-				]);
-				done();
-			});
-		});
-
-		it('should return only some errors if just some headers are missing', function(done) {
-			protocolStub.returns('https');
-			var async = OC.SetupChecks.checkGeneric();
-
-			suite.server.requests[0].respond(
-				200,
-				{
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'Strict-Transport-Security': 'max-age=15768000;preload',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer',
-				}
-			);
-
-			async.done(function( data, s, x ){
-				expect(data).toEqual([
-				{
-					msg: 'The "X-Content-Type-Options" HTTP header is not set to "nosniff". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-					type: OC.SetupChecks.MESSAGE_TYPE_WARNING
-				}, {
-					msg: 'The "X-XSS-Protection" HTTP header does not contain "1; mode=block". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-					type: OC.SetupChecks.MESSAGE_TYPE_WARNING,
-				}
-				]);
-				done();
-			});
-		});
-
-		it('should return none errors if all headers are there', function(done) {
-			protocolStub.returns('https');
-			var async = OC.SetupChecks.checkGeneric();
-
-			suite.server.requests[0].respond(
-				200,
-				{
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer'
-				}
-			);
-
-			async.done(function( data, s, x ){
-				expect(data).toEqual([]);
-				done();
-			});
-		});
-
-		describe('check X-Robots-Tag header', function() {
-			it('should return no message if X-Robots-Tag is set to noindex,nofollow without space', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex,nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer',
-				});
-				result.done(function( data, s, x ){
-					expect(data).toEqual([]);
-					done();
-				});
-			});
-
-			it('should return a message if X-Robots-Tag is set to none', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'none',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer',
-				});
-				result.done(function( data, s, x ){
-					expect(data).toEqual([
-						{
-							msg: 'The "X-Robots-Tag" HTTP header is not set to "noindex, nofollow". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-							type: OC.SetupChecks.MESSAGE_TYPE_WARNING
-						}
-					]);
-					done();
-				});
-			});
-		});
-
-		describe('check X-XSS-Protection header', function() {
-			it('should return no message if X-XSS-Protection is set to 1; mode=block; report=https://example.com', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block; report=https://example.com',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([]);
-					done();
-				});
-			});
-
-			it('should return no message if X-XSS-Protection is set to 1; mode=block', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([]);
-					done();
-				});
-			});
-
-			it('should return a message if X-XSS-Protection is set to 1', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([
-						{
-							msg: 'The "X-XSS-Protection" HTTP header does not contain "1; mode=block". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-							type: OC.SetupChecks.MESSAGE_TYPE_WARNING
-						}
-					]);
-					done();
-				});
-			});
-
-			it('should return a message if X-XSS-Protection is set to 0', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '0',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([
-						{
-							msg: 'The "X-XSS-Protection" HTTP header does not contain "1; mode=block". This is a potential security or privacy risk, as it is recommended to adjust this setting accordingly.',
-							type: OC.SetupChecks.MESSAGE_TYPE_WARNING
-						}
-					]);
-					done();
-				});
-			});
-		});
-
-		describe('check Referrer-Policy header', function() {
-			it('should return no message if Referrer-Policy is set to no-referrer', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([]);
-					done();
-				});
-			});
-
-			it('should return no message if Referrer-Policy is set to no-referrer-when-downgrade', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'no-referrer-when-downgrade',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([]);
-					done();
-				});
-			});
-
-			it('should return no message if Referrer-Policy is set to strict-origin', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'strict-origin',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([]);
-					done();
-				});
-			});
-
-			it('should return no message if Referrer-Policy is set to strict-origin-when-cross-origin', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'strict-origin-when-cross-origin',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([]);
-					done();
-				});
-			});
-
-			it('should return no message if Referrer-Policy is set to same-origin', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'same-origin',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([]);
-					done();
-				});
-			});
-
-			it('should return a message if Referrer-Policy is set to origin', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'origin',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([
-						{
-							msg: 'The "Referrer-Policy" HTTP header is not set to "no-referrer", "no-referrer-when-downgrade", "strict-origin", "strict-origin-when-cross-origin" or "same-origin". This can leak referer information. See the <a target="_blank" rel="noreferrer noopener" class="external" href="https://www.w3.org/TR/referrer-policy/">W3C Recommendation ↗</a>.',
-							type: OC.SetupChecks.MESSAGE_TYPE_INFO
-						}
-					]);
-					done();
-				});
-			});
-
-			it('should return a message if Referrer-Policy is set to origin-when-cross-origin', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'origin-when-cross-origin',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([
-						{
-							msg: 'The "Referrer-Policy" HTTP header is not set to "no-referrer", "no-referrer-when-downgrade", "strict-origin", "strict-origin-when-cross-origin" or "same-origin". This can leak referer information. See the <a target="_blank" rel="noreferrer noopener" class="external" href="https://www.w3.org/TR/referrer-policy/">W3C Recommendation ↗</a>.',
-							type: OC.SetupChecks.MESSAGE_TYPE_INFO
-						}
-					]);
-					done();
-				});
-			});
-
-			it('should return a message if Referrer-Policy is set to unsafe-url', function(done) {
-				protocolStub.returns('https');
-				var result = OC.SetupChecks.checkGeneric();
-
-				suite.server.requests[0].respond(200, {
-					'Strict-Transport-Security': 'max-age=15768000',
-					'X-XSS-Protection': '1; mode=block',
-					'X-Content-Type-Options': 'nosniff',
-					'X-Robots-Tag': 'noindex, nofollow',
-					'X-Frame-Options': 'SAMEORIGIN',
-					'X-Permitted-Cross-Domain-Policies': 'none',
-					'Referrer-Policy': 'unsafe-url',
-				});
-
-				result.done(function( data, s, x ){
-					expect(data).toEqual([
-						{
-							msg: 'The "Referrer-Policy" HTTP header is not set to "no-referrer", "no-referrer-when-downgrade", "strict-origin", "strict-origin-when-cross-origin" or "same-origin". This can leak referer information. See the <a target="_blank" rel="noreferrer noopener" class="external" href="https://www.w3.org/TR/referrer-policy/">W3C Recommendation ↗</a>.',
-							type: OC.SetupChecks.MESSAGE_TYPE_INFO
-						}
-					]);
-					done();
-				});
-			});
-		});
 	});
 
 	it('should return an error if the response has no statuscode 200', function(done) {
@@ -762,9 +356,6 @@ describe('OC.SetupChecks tests', function() {
 			expect(data).toEqual([{
 				msg: 'Error occurred while checking server setup',
 				type: OC.SetupChecks.MESSAGE_TYPE_ERROR
-			}, {
-				msg: 'Error occurred while checking server setup',
-				type: OC.SetupChecks.MESSAGE_TYPE_ERROR
 			}]);
 			done();
 		});