Merge branch 'master' of https://github.com/pixelated/pixelated-user-agent

# By Felix Hammerl (13) and Thais Siqueira (3)
# Via Christoph (1) and Thais Siqueira (1)
* 'master' of https://github.com/pixelated/pixelated-user-agent:
  Sets SSL certifications to false.
  Fixes pep8 errors and update requests to 2.9.1.
  Update locust test to run after xsrf token implementation.
  Issue #620: Adapt unit tests to CSS changes
  Issue #620: Refactor palceholder
  Issue #620: Remove former main css file
  Issue #620: Spike growl CSS modularization
  Issue #617: Highlight search terms by altering mail content
  Issue #617: Allow only >=3 alphanumeric characters in search field
  Issue #617: Restrict searching to alphanumeric characters
  Issue #617: Remove highlighting for sandboxed content
  Issue #617: Add sandbox to build scripts
  Issue #617: Add sandbox to user-agent
  Issue #617: Create sandbox resouces
  Issue #617: Add iframe-resizer
  Issue #617: Serve content from Sandbox resource

1 files changed, 38 insertions, 0 deletions

diff --git a/service/test/unit/resources/test_sandbox_resource.py b/service/test/unit/resources/test_sandbox_resource.py
new file mode 100644
index 00000000..3db43e12
--- /dev/null
+++ b/service/test/unit/resources/test_sandbox_resource.py
@@ -0,0 +1,38 @@
+import os
+import unittest
+
+from twisted.internet import defer
+from twisted.web.test.requesthelper import DummyRequest
+
+from pixelated.resources.sandbox_resource import SandboxResource
+from test.unit.resources import DummySite
+
+
+class TestSandBoxResource(unittest.TestCase):
+    def setUp(self):
+        static_folder = os.path.dirname(os.path.abspath(__file__))
+        self.resource = SandboxResource(static_folder)
+        self.resource.isLeaf = True
+        self.web = DummySite(self.resource)
+
+    @defer.inlineCallbacks
+    def test_render_GET_should_set_sandbox_csp_header(self):
+        request = DummyRequest(['/sandbox'])
+        request.method = 'GET'
+        request.isSecure = lambda: True
+        request.redirect = lambda _: 'irrelevant'
+
+        expected_csp_headers = "sandbox allow-popups allow-scripts;" \
+                               "default-src 'self';" \
+                               "style-src *;" \
+                               "script-src  *;" \
+                               "font-src *;" \
+                               "img-src *;" \
+                               "object-src 'none';" \
+                               "connect-src 'none';"
+
+        yield self.web.get(request)
+
+        self.assertEquals(expected_csp_headers, request.outgoingHeaders.get('X-Content-Security-Policy'.lower()))
+        self.assertEquals(expected_csp_headers, request.outgoingHeaders.get('Content-Security-Policy'.lower()))
+        self.assertEquals(expected_csp_headers, request.outgoingHeaders.get('X-Webkit-CSP'.lower()))