summercms

golem15/summercms

Fork 0

Commit Graph

Author	SHA1	Message	Date
Jakub Zych	8d80580083	test(19.3-06): unit tests for the review fixes - TestCORSCredentialedOriginRules, TestCORSAnchoredPatternNoSuffixMatch (D-04) - TestAPIDocsCSPNoHostSource (D-17) - TestLoadCookieConfigProductionInferredSecure, TestZeroCookieConfigDefaults (D-03) - TestSiteCachePurgeWaitAndClose, TestSiteCacheBulkCommitCoalesced (D-10)	2026-10-15 22:45:16 +02:00
Jakub Zych	f705343904	fix(19.3-06): api-docs CSP allows only nonce-carrying scripts (WR-06) - the two pinned jsDelivr scripts carry the per-request nonce next to their SRI hash; script-src holds only the nonce, no host source	2026-10-15 22:28:34 +02:00
Jakub Zych	055f51c94f	test(19.3-05): surf CORS, profiles, api-docs and store lookup; cabana reorder hook - cors_profile_test.go: credentials with * refused (global and profile), pattern errors, anchored wildcard origins, Vary: Origin on dynamic answers, api/www credentialed case, unchanged * answers, profile preflight routes and boot errors, turnstile factory params - apidocs_test.go: off by default, pinned 5.33.1 page with the RESEARCH SRI hashes and nonce CSP, ordered compact JSON, provider count, path validation, escaped title - store_lookup_test.go: MemoryStore fallback, published Store, no dial - reorder_hook_test.go (Postgres): hook sees the new order in the tx, its error rolls back, no hook answers unchanged - gate: surf names in the go stage, cabana names in the docker stage	2026-10-15 19:30:52 +02:00

Author

SHA1

Message

Date

Jakub Zych

8d80580083

test(19.3-06): unit tests for the review fixes

- TestCORSCredentialedOriginRules, TestCORSAnchoredPatternNoSuffixMatch (D-04)
- TestAPIDocsCSPNoHostSource (D-17)
- TestLoadCookieConfigProductionInferredSecure, TestZeroCookieConfigDefaults (D-03)
- TestSiteCachePurgeWaitAndClose, TestSiteCacheBulkCommitCoalesced (D-10)

2026-10-15 22:45:16 +02:00

Jakub Zych

f705343904

fix(19.3-06): api-docs CSP allows only nonce-carrying scripts (WR-06)

- the two pinned jsDelivr scripts carry the per-request nonce next to
  their SRI hash; script-src holds only the nonce, no host source

2026-10-15 22:28:34 +02:00

Jakub Zych

055f51c94f

test(19.3-05): surf CORS, profiles, api-docs and store lookup; cabana reorder hook

- cors_profile_test.go: credentials with * refused (global and profile),
  pattern errors, anchored wildcard origins, Vary: Origin on dynamic
  answers, api/www credentialed case, unchanged * answers, profile
  preflight routes and boot errors, turnstile factory params
- apidocs_test.go: off by default, pinned 5.33.1 page with the RESEARCH
  SRI hashes and nonce CSP, ordered compact JSON, provider count, path
  validation, escaped title
- store_lookup_test.go: MemoryStore fallback, published Store, no dial
- reorder_hook_test.go (Postgres): hook sees the new order in the tx,
  its error rolls back, no hook answers unchanged
- gate: surf names in the go stage, cabana names in the docker stage

2026-10-15 19:30:52 +02:00

3 Commits