| 1 | import fs from 'fs' |
| 2 | import { fileURLToPath } from 'node:url' |
| 3 | import { describe, expect, it } from 'vitest' |
| 4 | |
| 5 | const rendererIndexPath = fileURLToPath( |
| 6 | new URL('../../../src/renderer/index.html', import.meta.url) |
| 7 | ) |
| 8 | |
| 9 | describe('renderer content security policy', () => { |
| 10 | it('allows HTTP(S) image and media resources without expanding script permissions', async () => { |
| 11 | const html = await fs.promises.readFile(rendererIndexPath, 'utf-8') |
| 12 | |
| 13 | expect(html).toContain("img-src 'self' data: local-asset: http: https:") |
| 14 | expect(html).toContain("media-src 'self' local-asset: http: https:") |
| 15 | expect(html).toContain("script-src 'self' 'unsafe-inline'") |
| 16 | expect(html).not.toContain('script-src *') |
| 17 | }) |
| 18 | }) |
| 19 |