1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
|
from asgiref.sync import iscoroutinefunction
from django.http import HttpRequest, HttpResponse
from django.middleware.clickjacking import XFrameOptionsMiddleware
from django.test import SimpleTestCase
from django.views.decorators.clickjacking import (
xframe_options_deny,
xframe_options_exempt,
xframe_options_sameorigin,
)
class XFrameOptionsDenyTests(SimpleTestCase):
def test_wrapped_sync_function_is_not_coroutine_function(self):
def sync_view(request):
return HttpResponse()
wrapped_view = xframe_options_deny(sync_view)
self.assertIs(iscoroutinefunction(wrapped_view), False)
def test_wrapped_async_function_is_coroutine_function(self):
async def async_view(request):
return HttpResponse()
wrapped_view = xframe_options_deny(async_view)
self.assertIs(iscoroutinefunction(wrapped_view), True)
def test_decorator_sets_x_frame_options_to_deny(self):
@xframe_options_deny
def a_view(request):
return HttpResponse()
response = a_view(HttpRequest())
self.assertEqual(response.headers["X-Frame-Options"], "DENY")
async def test_decorator_sets_x_frame_options_to_deny_async_view(self):
@xframe_options_deny
async def an_async_view(request):
return HttpResponse()
response = await an_async_view(HttpRequest())
self.assertEqual(response.headers["X-Frame-Options"], "DENY")
class XFrameOptionsSameoriginTests(SimpleTestCase):
def test_wrapped_sync_function_is_not_coroutine_function(self):
def sync_view(request):
return HttpResponse()
wrapped_view = xframe_options_sameorigin(sync_view)
self.assertIs(iscoroutinefunction(wrapped_view), False)
def test_wrapped_async_function_is_coroutine_function(self):
async def async_view(request):
return HttpResponse()
wrapped_view = xframe_options_sameorigin(async_view)
self.assertIs(iscoroutinefunction(wrapped_view), True)
def test_decorator_sets_x_frame_options_to_sameorigin(self):
@xframe_options_sameorigin
def a_view(request):
return HttpResponse()
response = a_view(HttpRequest())
self.assertEqual(response.headers["X-Frame-Options"], "SAMEORIGIN")
async def test_decorator_sets_x_frame_options_to_sameorigin_async_view(self):
@xframe_options_sameorigin
async def an_async_view(request):
return HttpResponse()
response = await an_async_view(HttpRequest())
self.assertEqual(response.headers["X-Frame-Options"], "SAMEORIGIN")
class XFrameOptionsExemptTests(SimpleTestCase):
def test_wrapped_sync_function_is_not_coroutine_function(self):
def sync_view(request):
return HttpResponse()
wrapped_view = xframe_options_exempt(sync_view)
self.assertIs(iscoroutinefunction(wrapped_view), False)
def test_wrapped_async_function_is_coroutine_function(self):
async def async_view(request):
return HttpResponse()
wrapped_view = xframe_options_exempt(async_view)
self.assertIs(iscoroutinefunction(wrapped_view), True)
def test_decorator_stops_x_frame_options_being_set(self):
"""
@xframe_options_exempt instructs the XFrameOptionsMiddleware to NOT set
the header.
"""
@xframe_options_exempt
def a_view(request):
return HttpResponse()
request = HttpRequest()
response = a_view(request)
self.assertIsNone(response.get("X-Frame-Options", None))
self.assertIs(response.xframe_options_exempt, True)
# The real purpose of the exempt decorator is to suppress the
# middleware's functionality.
middleware_response = XFrameOptionsMiddleware(a_view)(request)
self.assertIsNone(middleware_response.get("X-Frame-Options"))
async def test_exempt_decorator_async_view(self):
@xframe_options_exempt
async def an_async_view(request):
return HttpResponse()
request = HttpRequest()
response = await an_async_view(request)
self.assertIsNone(response.get("X-Frame-Options"))
self.assertIs(response.xframe_options_exempt, True)
# The real purpose of the exempt decorator is to suppress the
# middleware's functionality.
middleware_response = await XFrameOptionsMiddleware(an_async_view)(request)
self.assertIsNone(middleware_response.get("X-Frame-Options"))
|
