alighasami
3d5eaf9445
Security: Sync from Public / sync-from-public (push) Has been cancelled
Test: Benchmark Nightly / build (push) Has been cancelled
Test: Benchmark Nightly / Notify Cats on failure (push) Has been cancelled
CI: Python / Checks (push) Has been cancelled
Test: Evals Python / Workflow Comparison Python (push) Has been cancelled
Util: Check Docs URLs / check-docs-urls (push) Has been cancelled
Test: Visual Storybook / Cloudflare Pages (push) Has been cancelled
Test: E2E Performance / build-and-test-performance (push) Has been cancelled
Test: Workflows Nightly / Run Workflow Tests (push) Has been cancelled
Util: Cleanup CI Docker Images / Delete stale CI images (push) Has been cancelled
Test: Benchmark Destroy Env / build (push) Has been cancelled
Util: Update Node Popularity / update-popularity (push) Has been cancelled
Test: E2E Coverage Weekly / Coverage Tests (push) Has been cancelled
46 lines
1.6 KiB
TypeScript
46 lines
1.6 KiB
TypeScript
import { test, expect } from '../../../fixtures/base';
|
|
|
|
test.describe('Webhook Origin Isolation', {
|
|
annotation: [
|
|
{ type: 'owner', description: 'Catalysts' },
|
|
],
|
|
}, () => {
|
|
test.beforeAll(async ({ api }) => {
|
|
await api.workflows.importWorkflowFromFile('webhook-origin-isolation.json', {
|
|
makeUnique: false,
|
|
});
|
|
});
|
|
|
|
const webhookPaths = [
|
|
'webhook-response-data-text-html',
|
|
'webhook-response-data-wo-content-type',
|
|
'webhook-last-node-no-content-type-header',
|
|
'webhook-last-node-text-html-header',
|
|
'webhook-last-node-text-html-content-type',
|
|
'webhook-response-data-csp-header',
|
|
'webhook-last-node-csp-header',
|
|
'webhook-last-node-binary-text-html',
|
|
'webhook-last-node-binary-no-content-type',
|
|
'webhook-last-node-binary-csp-header',
|
|
'respond-to-webhook-text-no-content-type',
|
|
'respond-to-webhook-text-content-type-text-html',
|
|
'respond-to-webhook-text-csp-header',
|
|
'respond-to-webhook-json-as-text-html',
|
|
];
|
|
|
|
const expectedCSP =
|
|
'sandbox allow-downloads allow-forms allow-modals allow-orientation-lock allow-pointer-lock allow-popups allow-presentation allow-scripts allow-top-navigation allow-top-navigation-by-user-activation allow-top-navigation-to-custom-protocols';
|
|
|
|
for (const webhookPath of webhookPaths) {
|
|
test(`Webhook responses should include the correct response headers for ${webhookPath}`, async ({
|
|
api,
|
|
}) => {
|
|
const webhookResponse = await api.webhooks.trigger(`/webhook/${webhookPath}`);
|
|
expect(webhookResponse.ok()).toBe(true);
|
|
|
|
const headers = webhookResponse.headers();
|
|
expect(headers['content-security-policy']).toBe(expectedCSP);
|
|
});
|
|
}
|
|
});
|