Julien Castiaux
3f8296a16e
The Content-Security-Policy[^1] http header was only set on the response generated by controllers but it was missing from the `/<module>/static/` route. It is not strictly necessary to set that header on the responses comming from that routes as it is not possible to add new static files or edit existing ones via the interface (not even as admin). Only the developers and system administrator can access those files. It is also worth mentionning that using the Odoo internal web server to deliver static files is suboptimal. Outside of a dev environment, those files will typically be delivered via a web server[^2] and sysadmins should configure their web server to set the CSP header on static images. [^1]: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP [^2]: https://www.odoo.com/documentation/master/administration/install/deploy.html#serving-static-files-and-attachments closes odoo/odoo#146591 X-original-commit: 55e09d504df9bd134afb6e0b38f03457b5c71e8e Related: odoo/documentation#6953 Signed-off-by: Julien Castiaux (juc) <juc@odoo.com>
20 lines
766 B
Python
20 lines
766 B
Python
from odoo.tests import tagged
|
|
from .test_common import TestHttpBase
|
|
|
|
|
|
@tagged('-at_install', 'post_install')
|
|
class TestXSS(TestHttpBase):
|
|
# In case a XSS isn't filtered, it'll load /test_http/fail which logs an error.
|
|
# browser_js only returns when it finds "test successful" in the logs.
|
|
fake_success = "console.log('test successfulness cannot be determined via JS')"
|
|
# ^^^^^^^^^^^^^^^
|
|
|
|
def test_xss_static(self):
|
|
self.browser_js('/test_http/static/src/img/xss.svg', self.fake_success)
|
|
|
|
def test_xss_web_content(self):
|
|
self.browser_js('/web/content/test_http.xss_svg', self.fake_success)
|
|
|
|
def test_xss_web_image(self):
|
|
self.browser_js('/web/image/test_http.xss_svg', self.fake_success)
|