team-tryouts/tests/test_subresource_integrity.py

"""Third-party assets are pinned (QUA-004).

Two CDNs serve this site: cdnjs for Font Awesome, jsDelivr for FullCalendar.
The CSP names both as allowed origins, so neither would be stopped by it —
whoever controls those hosts controls what runs on every page, and on the
calendar page that includes executable script.

`integrity` pins each file: the browser refuses one that has been altered
since the hash was taken. It does not prove the file was honest at that
moment. Worth being clear about, because SRI is often read as more than it
is.

This is a guard, not a test of behaviour. Its job is to fail the day someone
adds a CDN URL without a hash, or bumps a version and leaves the old hash
behind — the second of which fails *silently* in a browser, since a script
that fails its integrity check simply does not run.
"""

import re

import pytest

TEMPLATES = 'app/templates'

#: Hosts we deliberately load from. Anything else on a template needs a
#: decision, not a hash.
KNOWN_CDNS = ('cdnjs.cloudflare.com', 'cdn.jsdelivr.net')

#: Discord avatars. Not a subresource — an <img> src built at render time,
#: which cannot carry an integrity hash and executes nothing.
IMAGE_ONLY_HOSTS = ('cdn.discordapp.com',)


def _templates():
    import os

    for root, _dirs, files in os.walk(TEMPLATES):
        for name in files:
            if name.endswith('.html'):
                path = os.path.join(root, name)
                with open(path, encoding='utf-8') as handle:
                    yield path, handle.read()


def _tags_loading_from(host, markup):
    """Every <script src> and <link href> pointing at this host."""
    pattern = re.compile(
        r'<(script|link)\b[^>]*?(?:src|href)\s*=\s*"https://' + re.escape(host) + r'[^"]*"[^>]*>',
        re.IGNORECASE | re.DOTALL,
    )
    return pattern.findall(markup), pattern


@pytest.mark.parametrize('host', KNOWN_CDNS)
def test_every_asset_from_a_cdn_carries_an_integrity_hash(host):
    offenders = []
    for path, markup in _templates():
        _names, pattern = _tags_loading_from(host, markup)
        for tag in pattern.finditer(markup):
            if 'integrity=' not in tag.group(0):
                offenders.append(f'{path}: {tag.group(0)[:120]}')

    assert not offenders, 'CDN asset loaded without integrity:\n' + '\n'.join(offenders)


@pytest.mark.parametrize('host', KNOWN_CDNS)
def test_integrity_is_paired_with_crossorigin(host):
    """A browser ignores integrity on a request it did not make in CORS mode,
    so the hash without crossorigin is decoration."""
    offenders = []
    for path, markup in _templates():
        _names, pattern = _tags_loading_from(host, markup)
        for tag in pattern.finditer(markup):
            if 'integrity=' in tag.group(0) and 'crossorigin=' not in tag.group(0):
                offenders.append(f'{path}: {tag.group(0)[:120]}')

    assert not offenders, 'integrity without crossorigin:\n' + '\n'.join(offenders)


def test_no_unexpected_third_party_host_appears():
    """A new CDN is a decision — a supply-chain dependency and a CSP entry —
    not something to notice later."""
    allowed = set(KNOWN_CDNS) | set(IMAGE_ONLY_HOSTS)
    found = set()
    for _path, markup in _templates():
        found.update(re.findall(r'https://([a-z0-9.-]+)/', markup, re.IGNORECASE))

    unexpected = {host for host in found if host not in allowed}
    # Documentation links in comments are fine; only loaded assets matter.
    unexpected -= {'discord.com', 'www.w3.org', 'developer.mozilla.org'}

    assert not unexpected, f'unexpected third-party hosts in templates: {sorted(unexpected)}'


def test_the_csp_and_the_templates_agree(app):
    """A hash is no use if the CSP blocks the request outright, and an origin
    left in the CSP after its last use is a widened policy nobody needs."""
    with app.test_request_context():
        from app.app import build_csp

        policy = build_csp(nonce='x', allow_inline_script=False)

    for host in KNOWN_CDNS:
        assert host in policy, f'{host} is loaded by a template but absent from the CSP'