@@ -711,4 +711,29 @@ private static void serializesTo(final String input, final String output, final
711711 }
712712 assertEquals (output , policy .toString ());
713713 }
714+
715+ /**
716+ * Test for https://github.com/shapesecurity/salvation/issues/244.
717+ */
718+ @ Test
719+ public void invalidHashSyntax () {
720+ final ArrayList <PolicyListError > observedErrors = new ArrayList <>();
721+ final Policy .PolicyListErrorConsumer consumer = (severity , message , policyIndex , directiveIndex , valueIndex ) -> {
722+ observedErrors .add (e (severity , message , policyIndex , directiveIndex , valueIndex ));
723+ };
724+
725+ final PolicyList p = Policy .parseSerializedCSPList (
726+ "default-src 'none'; script-src 'sha256- RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc=';" , consumer );
727+ assertEquals ("default-src 'none'; script-src 'sha256- RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc='" , p .toString ());
728+
729+ final PolicyListError [] errors = {
730+ e (Policy .Severity .Error , "'sha...' source-expression uses an unrecognized algorithm "
731+ + "or does not match the base64-value grammar (or is missing its trailing \" '\" )" , 0 , 1 , 0 ),
732+ e (Policy .Severity .Error , "Unrecognized source-expression RFWPLDbv2BY+rCkDzsE+0fr8ylGr2R2faWMhq4lfEQc='" , 0 , 1 , 1 )
733+ };
734+ assertEquals (errors .length , observedErrors .size ());
735+ for (int i = 0 ; i < errors .length ; ++i ) {
736+ assertEquals (errors [i ], observedErrors .get (i ));
737+ }
738+ }
714739}
0 commit comments