Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Testing web elements is impossible when CSP is enabled #637

Open
snpori opened this issue May 11, 2020 · 0 comments
Open

Testing web elements is impossible when CSP is enabled #637

snpori opened this issue May 11, 2020 · 0 comments

Comments

@snpori
Copy link

snpori commented May 11, 2020

Description

It is impossible to use espresso-web to test properly secured web pages that use CSP to disable the unsafe-eval javascript functionality.

When creating a ui test for an android app that uses espresso-web library a security error is thrown by the webview.
When Javascript interact with the page but the page has the following property:
http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline'
but does not have a unsafe-eval CSP policy
More information here:
https://stackoverflow.com/questions/61456737/override-security-policy-with-android-espresso-web

Steps to Reproduce

Create an espresso-web test on a page that has the above CSP policy.

Expected Results

Espresso-web should find relevant elements to interact with

Actual Results

The tests will fail with:
java.lang.RuntimeException: java.lang.RuntimeException: Fatal exception checking document state: Evaluation: status: 13 value: {message=Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive:

AndroidX Test and Android OS Versions

Android: 10
AndroidX: 3.2.0

Link to a public git repo demonstrating the problem:

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant