diff options
Diffstat (limited to 'packages/meshbay-hub/tests/test_desktop_shell.py')
| -rw-r--r-- | packages/meshbay-hub/tests/test_desktop_shell.py | 13 |
1 files changed, 11 insertions, 2 deletions
diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py index 039ea2f..2e7ea82 100644 --- a/packages/meshbay-hub/tests/test_desktop_shell.py +++ b/packages/meshbay-hub/tests/test_desktop_shell.py @@ -154,8 +154,17 @@ def test_the_policy_is_sent_as_a_header(): """ source = _main() assert "'Content-Security-Policy': CSP" in source - assert "Content-Security-Policy" not in INDEX.read_text(encoding="utf-8") \ - .split("-->")[1], "the packaged page still carries a policy of its own" + # Comments stripped, all of them, rather than skipping past the first + # `-->`. The page's only mention of a policy is the comment explaining why + # it is not here, so the check has to see the markup with every comment + # gone — the earlier version took `split("-->")[1]`, which meant adding a + # second comment anywhere above made it read that comment's own text and + # fail on correct markup. A guard that depends on how many comments precede + # it is not guarding the thing it names. + markup = re.sub(r"<!--.*?-->", "", INDEX.read_text(encoding="utf-8"), + flags=re.S) + assert "Content-Security-Policy" not in markup, \ + "the packaged page still carries a policy of its own" def test_the_policy_keeps_wasm_unsafe_eval(): |