@@ -711,4 +711,29 @@ private static void serializesTo(final String input, final String output, final
711
711
}
712
712
assertEquals (output , policy .toString ());
713
713
}
714
+
715
+ /**
716
+ * Test for https://github.com/shapesecurity/salvation/issues/244.
717
+ */
718
+ @ Test
719
+ public void invalidHashSyntax () {
720
+ final ArrayList <PolicyListError > observedErrors = new ArrayList <>();
721
+ final Policy .PolicyListErrorConsumer consumer = (severity , message , policyIndex , directiveIndex , valueIndex ) -> {
722
+ observedErrors .add (e (severity , message , policyIndex , directiveIndex , valueIndex ));
723
+ };
724
+
725
+ final PolicyList p = Policy .parseSerializedCSPList (
726
+ "default-src 'none'; script-src 'sha256- RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc=';" , consumer );
727
+ assertEquals ("default-src 'none'; script-src 'sha256- RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc='" , p .toString ());
728
+
729
+ final PolicyListError [] errors = {
730
+ e (Policy .Severity .Error , "'sha...' source-expression uses an unrecognized algorithm "
731
+ + "or does not match the base64-value grammar (or is missing its trailing \" '\" )" , 0 , 1 , 0 ),
732
+ e (Policy .Severity .Error , "Unrecognized source-expression RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc='" , 0 , 1 , 1 )
733
+ };
734
+ assertEquals (errors .length , observedErrors .size ());
735
+ for (int i = 0 ; i < errors .length ; ++i ) {
736
+ assertEquals (errors [i ], observedErrors .get (i ));
737
+ }
738
+ }
714
739
}
0 commit comments