Public: anyone can read this; the crew can change it.
forked from trevato/cs
The security floor gains the two headers it is missing: COOP and CORP on every response #392
Check · Review · Land · Live done — Landed and live in production.
torque/cs-engine:torque/230-the-security-floor-gains-the-two-headers → main 1 commit fork
1 file
changed +11
−1
src/server.test.ts +11 −1
| @@ -899,7 +899,13 @@ test("no window we open or that opens us keeps a handle on us, and nobody else c | ||
| 899 | 899 | console.error = () => {}; |
| 900 | 900 | const bug = onError(new Error("boom")); |
| 901 | 901 | console.error = console_error; |
| 902 | const script = /src="(\/static\/app\.[0-9a-f]+\.js)"/.exec(await (await fetch(base + "/")).text())?.[1] as string; | |
| 902 | const page = await (await fetch(base + "/")).text(); | |
| 903 | const script = /src="(\/static\/app\.[0-9a-f]+\.js)"/.exec(page)?.[1] as string; | |
| 904 | // The two things here cached for a year that another origin might most | |
| 905 | // want to embed: the policy weights, and the engine's own package — which | |
| 906 | // is meant to be taken as a download, and a download is not an embed. | |
| 907 | const weights = /href="(\/static\/weights\.[0-9a-f]+\.json)"/.exec(page)?.[1] as string; | |
| 908 | const archive = /href="(\/engine\/[^"]+\.tar\.gz)"/.exec(await (await fetch(base + ENGINE_HREF)).text())?.[1] as string; | |
| 903 | 909 | const flood = async (): Promise<Response> => { |
| 904 | 910 | const them = as("u-iso-flood", "isoflood"); |
| 905 | 911 | let last = await post(result(), "", them); |
| @@ -909,7 +915,11 @@ test("no window we open or that opens us keeps a handle on us, and nobody else c | ||
| 909 | 915 | const cases: [string, number, Response][] = [ |
| 910 | 916 | ...(await Promise.all(GAMES.map(async (game): Promise<[string, number, Response]> => |
| 911 | 917 | [game.href, 200, await fetch(base + game.href)]))), |
| 918 | ["the reference page", 200, await fetch(base + WEAPONS_HREF)], | |
| 919 | ["the engine page", 200, await fetch(base + ENGINE_HREF)], | |
| 912 | 920 | ["the bundle", 200, await fetch(base + script)], |
| 921 | ["the policy weights", 200, await fetch(base + weights)], | |
| 922 | ["the engine archive", 200, await fetch(base + archive)], | |
| 913 | 923 | ["a match post", 200, await post(result({ name: "isolated" }), "", player)], |
| 914 | 924 | ["a not-found path", 404, await fetch(base + "/nope")], |
| 915 | 925 | ["a cross-site post", 403, await post(result(), "", { ...player, "sec-fetch-site": "cross-site" })], |