microsoft / microsoft/BotFramework-WebChat
[Content Security Policy] Enable CSP for all tests
Nobody has claimed this yet.
- Dominant language
- HTML
- Stars
- 1.8k
- Forks
- 1.6k
- Avg merge
- 22h 58m
- Merged PRs (30d)
- 2
Description
Feature Request
After #3393 is resolved (PR #3443 is merged), we can start enabling CSP on all of our tests, to make sure we don't violate some of the directives in the future.
The baseline policy is documented at docs/CONTENT_SECURITY_POLICY.md. We will need to relax it a bit, for example, allowing images and media from certain domain.
This feature work is to:
- Extend the baseline policy to a minimum extent to fit our tests
- Enable CSP on all our tests, including both Jest tests and HTML tests
[Enhancement]
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with docs/CONTENT_SECURITY_POLICY.md to understand the baseline policy, then inspect how the Jest tests and HTML tests currently run. Enable CSP for both test groups and relax the baseline only as needed for their documented resources; done means all tests run with CSP enforcement without violations.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- html, javascript
- Domain
- security, testing-qa
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100