1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

package main

import (
	"testing"
)

// TestVendoredStylizeCSS pins the recovered stylesheet.
//
// The upstream repository (vasanthv/stylize.css) has been deleted from GitHub,
// so this file cannot be re-downloaded. The copy in resources/ was recovered
// from a long-running process on haku; the hash below is the integrityHash that
// was recorded next to the URL in the Haskell implementation, which is what
// establishes that the recovered bytes are the authentic original.
//
// If this test fails, the vendored file has been modified and no longer matches
// what upstream published.
func TestVendoredStylizeCSS(t *testing.T) {
	const wantHash = "sha384-EsaVGfq7QMIquv7LCLomD9pQFZbPh2fOY3gcgN9MW/AlV2aQk/miZ1/EbrcwMr67"
	const wantSize = 5207

	if len(vendoredStylizeCSS) != wantSize {
		t.Errorf("vendored stylize.css is %d bytes, want %d", len(vendoredStylizeCSS), wantSize)
	}
	if got := sriHash(vendoredStylizeCSS); got != wantHash {
		t.Errorf("vendored stylize.css hash =\n  %s\nwant\n  %s", got, wantHash)
	}
}

// TestSRIHashFormat checks the Subresource Integrity encoding: the value is the
// base64 of the raw digest, not of its hex representation, and a mistake there
// would make browsers silently refuse to load every asset.
func TestSRIHashFormat(t *testing.T) {
	// python3 -c "import hashlib,base64; print(base64.b64encode(hashlib.sha384(b'hello').digest()).decode())"
	const want = "sha384-WeF0h3dEjGnea4ANejO7+5/xtGPkQ1TDVTvNucZm+pASWjx5+QOXvfX2oT3oKGhP"
	if got := sriHash([]byte("hello")); got != want {
		t.Errorf("sriHash = %q, want %q", got, want)
	}
}

// TestAssetTags checks the markup, since a wrong tag type or a missing
// crossorigin attribute breaks the page in ways that are only visible in a
// browser.
func TestAssetTags(t *testing.T) {
	link := fetchedAsset{
		spec:      assetSpec{localPath: "/resources/stylize.css", kind: assetLink},
		integrity: "sha384-abc",
	}
	want := `<link rel="stylesheet" href="/resources/stylize.css" integrity="sha384-abc" crossorigin="anonymous">`
	if got := link.tag(); got != want {
		t.Errorf("link tag =\n  %s\nwant\n  %s", got, want)
	}

	script := fetchedAsset{
		spec:      assetSpec{localPath: "/resources/htmx.js", kind: assetScript},
		integrity: "sha384-def",
	}
	want = `<script src="/resources/htmx.js" integrity="sha384-def" crossorigin="anonymous"></script>`
	if got := script.tag(); got != want {
		t.Errorf("script tag =\n  %s\nwant\n  %s", got, want)
	}
}