tests/test-hgweb-csp.t

wix: tell ComponentSearch that it is finding a directory (not a file)

This is to fix an issue we've noticed where fresh installations start at
`C:\Program Files\Mercurial`, and then upgrades "walk up" the tree and end up in
`C:\Program Files` and finally `C:\` (where they stay).

ComponentSearch defaults to finding files, which I think means "it produces a
string like `C:\Program Files\Mercurial`", whereas with the type being
explicitly a directory, it would return `C:\Program Files\Mercurial\` (note the
final trailing backslash). Presumably, a latter step then tries to turn that
file name into a proper directory, by removing everything after the last `\`.

This could likely also be fixed by actually searching for the component for
hg.exe itself. That seemed a lot more complicated, as the GUID for hg.exe isn't
known in this file (it's one of the "auto-derived" ones). We could also consider
adding a Condition that I think could check the Property and ensure it's either
empty or ends in a trailing slash, but that would be an installer runtime check
and I'm not convinced it'd actually be useful.

This will *not* cause existing installations that are in one of the bad
directories to fix themselves. Doing that would require a fair amount more
understanding of wix and windows installer than I have, and it *probably*
wouldn't be possible to be 100% correct about it either (there's nothing
preventing a user from intentionally installing it in C:\, though I don't know
why they would do so).

If someone wants to tackle fixing existing installations, I think that the first
installation is actually the only one that shows up in "Add or Remove Programs",
and that its registry keys still exist. You might be able to find something
under HKEY_USERS that lists both the "good" and the "bad" InstallDirs. Mine was
under `HKEY_USERS\S-1-5-18\Software\Mercurial\InstallDir` (C:\), and
`HKEY_USERS\S-1-5-21-..numbers..\Software\Mercurial\InstallDir` (C:\Program
Files\Mercurial). If you find exactly two, with one being the default path, and
the other being a prefix of it, the user almost certainly hit this bug :D

We had originally thought that this bug might be due to unattended
installations/upgrades, but I no longer think that's the case. We were able to
reproduce the issue by uninstalling all copies of Mercurial I could find,
installing one version (it chose the correct location), and then starting the
installer for a different version (higher or lower didn't matter). I did not
need to deal with an unattended or headless installation/upgrade to trigger the
issue, but it's possible that my system was "primed" for this bug to happen
because of a previous unattended installation/upgrade.

Differential Revision: https://phab.mercurial-scm.org/D9891

#require serve

  $ cat > web.conf << EOF
  > [paths]
  > / = $TESTTMP/*
  > EOF

  $ hg init repo1
  $ cd repo1
  $ touch foo
  $ hg -q commit -A -m initial
  $ cd ..

  $ hg serve -p $HGPORT -d --pid-file=hg.pid --web-conf web.conf
  $ cat hg.pid >> $DAEMON_PIDS

repo index should not send Content-Security-Policy header by default

  $ get-with-headers.py --headeronly localhost:$HGPORT '' content-security-policy etag
  200 Script output follows

static page should not send CSP by default

  $ get-with-headers.py --headeronly localhost:$HGPORT static/mercurial.js content-security-policy etag
  200 Script output follows

repo page should not send CSP by default, should send ETag

  $ get-with-headers.py --headeronly localhost:$HGPORT repo1 content-security-policy etag
  200 Script output follows
  etag: W/"*" (glob)

  $ killdaemons.py

Configure CSP without nonce

  $ cat >> web.conf << EOF
  > [web]
  > csp = script-src https://example.com/ 'unsafe-inline'
  > EOF

  $ hg serve -p $HGPORT -d --pid-file=hg.pid --web-conf web.conf
  $ cat hg.pid > $DAEMON_PIDS

repo index should send Content-Security-Policy header when enabled

  $ get-with-headers.py --headeronly localhost:$HGPORT '' content-security-policy etag
  200 Script output follows
  content-security-policy: script-src https://example.com/ 'unsafe-inline'

static page should send CSP when enabled

  $ get-with-headers.py --headeronly localhost:$HGPORT static/mercurial.js content-security-policy etag
  200 Script output follows
  content-security-policy: script-src https://example.com/ 'unsafe-inline'

  $ get-with-headers.py --twice --headeronly localhost:$HGPORT repo1/static/style.css content-security-policy
  200 Script output follows
  content-security-policy: script-src https://example.com/ 'unsafe-inline'
  304 Not Modified
  content-security-policy: script-src https://example.com/ 'unsafe-inline'

repo page should send CSP by default, include etag w/o nonce

  $ get-with-headers.py --headeronly localhost:$HGPORT repo1 content-security-policy etag
  200 Script output follows
  content-security-policy: script-src https://example.com/ 'unsafe-inline'
  etag: W/"*" (glob)

nonce should not be added to html if CSP doesn't use it

  $ get-with-headers.py localhost:$HGPORT repo1/graph/tip | egrep 'content-security-policy|<script'
  <script type="text/javascript" src="/repo1/static/mercurial.js"></script>
  <script type="text/javascript">
  <script type="text/javascript">

Configure CSP with nonce

  $ killdaemons.py
  $ cat >> web.conf << EOF
  > csp = image-src 'self'; script-src https://example.com/ 'nonce-%nonce%'
  > EOF

  $ hg serve -p $HGPORT -d --pid-file=hg.pid --web-conf web.conf
  $ cat hg.pid > $DAEMON_PIDS

nonce should be substituted in CSP header

  $ get-with-headers.py --headeronly localhost:$HGPORT '' content-security-policy etag
  200 Script output follows
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)

nonce should be included in CSP for static pages

  $ get-with-headers.py --headeronly localhost:$HGPORT static/mercurial.js content-security-policy etag
  200 Script output follows
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)

repo page should have nonce, no ETag

  $ get-with-headers.py --headeronly localhost:$HGPORT repo1 content-security-policy etag
  200 Script output follows
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)

nonce should be added to html when used

  $ get-with-headers.py localhost:$HGPORT repo1/graph/tip content-security-policy | egrep 'content-security-policy|<script'
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)
  <script type="text/javascript" src="/repo1/static/mercurial.js"></script>
  <script type="text/javascript" nonce="*"> (glob)
  <script type="text/javascript" nonce="*"> (glob)

hgweb_mod w/o hgwebdir works as expected

  $ killdaemons.py

  $ hg serve -R repo1 -p $HGPORT -d --pid-file=hg.pid --config "web.csp=image-src 'self'; script-src https://example.com/ 'nonce-%nonce%'"
  $ cat hg.pid > $DAEMON_PIDS

static page sends CSP

  $ get-with-headers.py --headeronly localhost:$HGPORT static/mercurial.js content-security-policy etag
  200 Script output follows
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)

nonce included in <script> and headers

  $ get-with-headers.py localhost:$HGPORT graph/tip content-security-policy  | egrep 'content-security-policy|<script'
  content-security-policy: image-src 'self'; script-src https://example.com/ 'nonce-*' (glob)
  <script type="text/javascript" src="/static/mercurial.js"></script>
  <script type="text/javascript" nonce="*"> (glob)
  <script type="text/javascript" nonce="*"> (glob)