Function test_uploaded_file_security_headers

tests/integration/test_upload.py:1001–1083

Upload a file and verify security headers on the served response. For non-PDF files, Content-Disposition: attachment must be set to force a download. For PDF files, Content-Disposition must NOT be set so the browser can render them inline, but Content-Type: application/pdf is always pr

(
    tmp_path,
    upload_file: AppHarness,
    driver: WebDriver,
    exp_name: str,
    exp_contents: str,
    expect_attachment: bool,
    expected_mime_type: str,
)

    ids=["html", "pdf", "txt"],
)
def test_uploaded_file_security_headers(
    tmp_path,
    upload_file: AppHarness,
    driver: WebDriver,
    exp_name: str,
    exp_contents: str,
    expect_attachment: bool,
    expected_mime_type: str,
):
    """Upload a file and verify security headers on the served response.

    For non-PDF files, Content-Disposition: attachment must be set to force a
    download.  For PDF files, Content-Disposition must NOT be set so the browser
    can render them inline, but Content-Type: application/pdf is always present.
    X-Content-Type-Options: nosniff is always required.

    Args:
        tmp_path: pytest tmp_path fixture
        upload_file: harness for UploadFile app.
        driver: WebDriver instance.
        exp_name: filename to upload.
        exp_contents: file contents to upload.
        expect_attachment: whether the response should force a download.
        expected_mime_type: expected Content-Type mime type.
    """
    import httpx

    assert upload_file.app_instance is not None
    poll_for_token(driver, upload_file)
    clear_btn = driver.find_element(By.ID, "clear_uploads")
    clear_btn.click()

    upload_box = get_upload_box(driver, upload_root_id="tertiary")
    upload_button = driver.find_element(By.ID, "upload_button_tertiary")

    target_file = tmp_path / exp_name
    target_file.write_text(exp_contents)

    upload_box.send_keys(str(target_file))
    upload_button.click()

    upload_done = driver.find_element(By.ID, "upload_done")
    assert upload_file.poll_for_value(upload_done, exp_not_equal="false") == "true"

    # Fetch the uploaded file directly via httpx and check security headers.
    upload_url = f"{Endpoint.UPLOAD.get_url()}/{exp_name}"
    resp = httpx.get(upload_url)
    assert resp.status_code == 200
    assert resp.text == exp_contents
    assert resp.headers["x-content-type-options"] == "nosniff"
    assert resp.headers["content-type"] == expected_mime_type

    if expect_attachment:
        assert resp.headers["content-disposition"] == "attachment"
    else:
        assert "content-disposition" not in resp.headers

    if not expect_attachment: