v0.25.1

src/security/tests.rs

@@ -0,0 +1,30 @@
+mod tests {
+    use super::*;
+    #[test]
+    fn hsts_is_tls_only_and_preload_is_explicit() {
+        let mut s = SecurityHeaders::default();
+        s.hsts.enabled = true;
+        let c = s.compile().unwrap();
+        let mut h = HeaderMap::new();
+        c.apply(&mut h, true);
+        assert_eq!(h["strict-transport-security"], "max-age=31536000");
+        c.apply(&mut h, false);
+        assert!(!h.contains_key("strict-transport-security"));
+        s.hsts.preload = true;
+        assert!(s.compile().is_err());
+        s.hsts.include_subdomains = true;
+        assert!(s.compile().is_ok());
+        s.hsts.max_age_seconds = 0;
+        assert!(s.compile().is_err());
+        s.hsts.preload = false;
+        assert!(s.compile().is_ok());
+    }
+    #[test]
+    fn rejects_response_splitting() {
+        let s = SecurityHeaders {
+            content_security_policy: Some("x\r\ninjected: yes".into()),
+            ..Default::default()
+        };
+        assert!(s.compile().is_err());
+    }
+}