android / android/android-test
Testing web elements is impossible when CSP is enabled
- Dominant language
- Java
- Stars
- 1.2k
- Forks
- 342
- Avg merge
- 11h 29m
- Merged PRs (30d)
- 2
Description
### Description
It is impossible to use espresso-web to test properly secured web pages that use CSP to disable the unsafe-eval javascript functionality.
When creating a ui test for an android app that uses espresso-web library a security error is thrown by the webview.
When Javascript interact with the page but the page has the following property:
http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'
but does not have a unsafe-eval CSP policy
More information here:
https://stackoverflow.com/questions/61456737/override-security-policy-with-android-espresso-web
### Steps to Reproduce
Create an espresso-web test on a page that has the above CSP policy.
### Expected Results
Espresso-web should find relevant elements to interact with
### Actual Results
The tests will fail with:
java.lang.RuntimeException: java.lang.RuntimeException: Fatal exception checking document state: Evaluation: status: 13 value: {message=Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive:
### AndroidX Test and Android OS Versions
Android: 10
AndroidX: 3.2.0
### Link to a public git repo demonstrating the problem:
Contributor guide
Research direction
Start by reproducing the espresso-web test against an Android 10 WebView page using the stated Content-Security-Policy without 'unsafe-eval'. Read the espresso-web document-state evaluation path implicated by the reported exception; done means relevant elements can be found and interacted with without the CSP security error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- android, java, javascript
- Domain
- mobile, security, testing
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100