android / android/android-test

Testing web elements is impossible when CSP is enabled

Open
#637 0 comments 15 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
1.2k
Forks
342
Avg merge
11h 29m
Merged PRs (30d)
2

Description

### Description
It is impossible to use espresso-web to test properly secured web pages that use CSP to disable the unsafe-eval javascript functionality.

When creating a ui test for an android app that uses espresso-web library a security error is thrown by the webview.
When Javascript interact with the page but the page has the following property:
http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'
but does not have a unsafe-eval CSP policy
More information here:
https://stackoverflow.com/questions/61456737/override-security-policy-with-android-espresso-web

### Steps to Reproduce
Create an espresso-web test on a page that has the above CSP policy.

### Expected Results
Espresso-web should find relevant elements to interact with

### Actual Results
The tests will fail with:
java.lang.RuntimeException: java.lang.RuntimeException: Fatal exception checking document state: Evaluation: status: 13 value: {message=Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive:

### AndroidX Test and Android OS Versions
Android: 10
AndroidX: 3.2.0

### Link to a public git repo demonstrating the problem:

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the espresso-web test against an Android 10 WebView page using the stated Content-Security-Policy without 'unsafe-eval'. Read the espresso-web document-state evaluation path implicated by the reported exception; done means relevant elements can be found and interacted with without the CSP security error.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java, javascript
Domain
mobile, security, testing
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.