From 9163790b7cc3c566c3d203205359da93e31bb133 Mon Sep 17 00:00:00 2001 From: Roeland Jago Douma Date: Tue, 17 Nov 2020 16:19:03 +0100 Subject: Set frame-ancestors to none if none are filled frame-ancestors doesn't fall back to default-src. So when we apply a very restricted CSP we should make sure to set it to 'none' and not leave it empty. Signed-off-by: Roeland Jago Douma --- tests/lib/AppFramework/Http/ResponseTest.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'tests/lib/AppFramework/Http/ResponseTest.php') diff --git a/tests/lib/AppFramework/Http/ResponseTest.php b/tests/lib/AppFramework/Http/ResponseTest.php index 7a064908869..0ef128433cd 100644 --- a/tests/lib/AppFramework/Http/ResponseTest.php +++ b/tests/lib/AppFramework/Http/ResponseTest.php @@ -57,7 +57,7 @@ class ResponseTest extends \Test\TestCase { $this->childResponse->setHeaders($expected); $headers = $this->childResponse->getHeaders(); - $expected['Content-Security-Policy'] = "default-src 'none';base-uri 'none';manifest-src 'self'"; + $expected['Content-Security-Policy'] = "default-src 'none';base-uri 'none';manifest-src 'self';frame-ancestors 'none'"; $expected['Feature-Policy'] = "autoplay 'none';camera 'none';fullscreen 'none';geolocation 'none';microphone 'none';payment 'none'"; $this->assertEquals($expected, $headers); -- cgit v1.2.3