changeset 591:3cb7c6162c77

new test for XSS
author Alain Mazy <am@osimis.io>
date Tue, 12 Dec 2023 10:14:37 +0100
parents c28bd957cb93
children 6753d96dd71f
files Tests/Tests.py
diffstat 1 files changed, 20 insertions(+), 0 deletions(-) [+]
line wrap: on
line diff
--- a/Tests/Tests.py	Sat Nov 25 12:23:45 2023 +0100
+++ b/Tests/Tests.py	Tue Dec 12 10:14:37 2023 +0100
@@ -10023,3 +10023,23 @@
             self.assertEqual('M3D', tags['Modality'])
             self.assertEqual('model/obj', tags['MIMETypeOfEncapsulatedDocument'])
             self.assertEqual('1.2.840.10008.5.1.4.1.1.104.4', tags['SOPClassUID'])
+
+
+    def test_error_codes_content_type(self):
+
+        # from 1.12.2, check that a ContentType header is included in errors with an error description (ex: 404)
+        (headers, body) = DoGetRaw(_REMOTE, '/rnm94%3Cscript%3Ealert(1)%3C/script%3Ejdtkc/explorer.html')
+        self.assertEqual('404', headers['status'])
+
+        if IsOrthancVersionAbove(_REMOTE, 1, 12, 2):
+            self.assertEqual('application/json', headers['content-type'])
+
+        (headers, body) = DoPutRaw(_REMOTE, '/system', 'hello')
+        self.assertEqual('405', headers['status'])
+        # when there is no body, there is no content-type
+        self.assertNotIn('content-type', headers)
+
+        # responses with bodies contain x-content-type-options
+        if IsOrthancVersionAbove(_REMOTE, 1, 12, 2):
+            (headers, body) = DoGetRaw(_REMOTE, '/system')
+            self.assertIn('nosniff', headers['x-content-type-options'])