Add test for report with embedded script

labkey-tchad · labkey-tchad · commit 7405519080be · 2025-07-02T14:49:57.000-07:00
diff --git a/data/reports/knitr_no_scriptpad.rhtml b/data/reports/knitr_no_scriptpad.rhtml
@@ -93,5 +93,11 @@ end.rcode-->
 <p>Well, everything seems to be working. Let's ask R what is the
     value of &pi;? Of course it is <!--rinline pi -->.</p>
 
+<span>Nonce check: <span id="nonce-check-result">FAIL</span></span>
+
+<script>
+    document.getElementById('nonce-check-result').innerText = "SUCCESS";
+</script>
+
 </body>
 </html>
diff --git a/data/reports/knitr_no_scriptpad.rmd b/data/reports/knitr_no_scriptpad.rmd
@@ -113,6 +113,12 @@ library(knitr)
 knit('knitr-minimal.Rmd')
 ```
 
+<span>Nonce check: <span id="nonce-check-result">FAIL</span></span>
+
+<script>
+    document.getElementById('nonce-check-result').innerText = "SUCCESS";
+</script>
+
 ## Conclusion
 
 Markdown is super easy to write. Go to **knitr** [homepage](http://yihui.name/knitr) for details.
diff --git a/data/reports/nonce_check.rhtml b/data/reports/nonce_check.rhtml
@@ -0,0 +1,15 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <title>Test script nonce in Knitr HTML</title>
+</head>
+<body>
+
+<span>Nonce check: <span id="nonce-check-result">FAIL</span></span>
+
+<script>
+    document.getElementById('nonce-check-result').innerText = "SUCCESS";
+</script>
+
+</body>
+</html>
diff --git a/data/reports/plotly.rmd b/data/reports/plotly.rmd
diff --git a/modules/scriptpad/resources/reports/schemas/script_rhtml.rhtml b/modules/scriptpad/resources/reports/schemas/script_rhtml.rhtml
@@ -87,5 +87,11 @@ end.rcode-->
 <p>Well, everything seems to be working. Let's ask R what is the
     value of &pi;? Of course it is <!--rinline pi -->.</p>
 
+<span>Nonce check: <span id="nonce-check-result">FAIL</span></span>
+
+<script>
+    document.getElementById('nonce-check-result').innerText = "SUCCESS";
+</script>
+
 </body>
 </html>
diff --git a/modules/scriptpad/resources/reports/schemas/script_rmd.rmd b/modules/scriptpad/resources/reports/schemas/script_rmd.rmd
@@ -108,6 +108,12 @@ library(knitr)
 knit('knitr-minimal.Rmd')
 ```
 
+<span>Nonce check: <span id="nonce-check-result">FAIL</span></span>
+
+<script>
+    document.getElementById('nonce-check-result').innerText = "SUCCESS";
+</script>
+
 ## Conclusion
 
 Markdown is super easy to write. Go to **knitr** [homepage](http://yihui.name/knitr) for details.
diff --git a/src/org/labkey/test/pages/wiki/EditPage.java b/src/org/labkey/test/pages/wiki/EditPage.java
@@ -100,10 +100,48 @@ public EditPage setTitle(String title)
 
     public EditPage setBody(String body)
     {
+        switchWikiToSourceView();
         elementCache().bodyTextArea.set(body);
         return this;
     }
 
+    /**
+     * Switches the wiki edit page to source view when the format type is HTML.
+     */
+    public void switchWikiToSourceView()
+    {
+        String curFormat = executeScript("return LABKEY._wiki.getProps().rendererType;", String.class);
+        if (curFormat.equalsIgnoreCase("HTML"))
+        {
+            if (isElementPresent(Locator.css("#wiki-tab-source.labkey-tab-inactive")))
+            {
+                Locator tab = Locator.css("#wiki-tab-source > a");
+                waitForElementToBeVisible(tab);
+                click(tab);
+                waitForElement(Locator.css("#wiki-tab-source.labkey-tab-active"));
+            }
+        }
+    }
+
+    public void switchWikiToVisualView()
+    {
+        String curFormat = (String) executeScript("return LABKEY._wiki.getProps().rendererType;");
+        if (curFormat.equalsIgnoreCase("HTML"))
+        {
+            if (isElementPresent(Locator.css("#wiki-tab-visual.labkey-tab-inactive")))
+            {
+                Locator tab = Locator.css("#wiki-tab-visual > a");
+                waitForElementToBeVisible(tab);
+                click(tab);
+
+                Locator yesButton = Locator.tagWithText("span","Yes");
+                waitForElementToBeVisible(yesButton);
+                waitAndClick(yesButton);
+                waitForElement(Locator.css("#wiki-tab-visual.labkey-tab-active"));
+            }
+        }
+    }
+
     public EditPage setShouldIndex(boolean shouldIndex)
     {
         elementCache().shouldIndexCheckbox.set(shouldIndex);
diff --git a/src/org/labkey/test/tests/AbstractKnitrReportTest.java b/src/org/labkey/test/tests/AbstractKnitrReportTest.java
@@ -27,11 +27,13 @@
 import org.labkey.test.pages.core.admin.logger.ManagerPage;
 import org.labkey.test.pages.reports.ManageViewsPage;
 import org.labkey.test.util.CodeMirrorHelper;
+import org.labkey.test.util.CspLogUtil;
 import org.labkey.test.util.Log4jUtils;
 import org.labkey.test.util.LogMethod;
 import org.labkey.test.util.LoggedParam;
 import org.labkey.test.util.PortalHelper;
 import org.labkey.test.util.RReportHelper;
+import org.labkey.test.util.WikiHelper;
 import org.labkey.test.util.core.admin.CspConfigHelper;
 import org.openqa.selenium.WebElement;
 
@@ -55,7 +57,9 @@ public abstract class AbstractKnitrReportTest extends BaseWebDriverTest
     protected static final Path rmdReport_no_scriptpad = TestFileUtils.getSampleData("reports/knitr_no_scriptpad.rmd").toPath();
     private static final Path rhtmlReport = scriptpadReports.resolve("script_rhtml.rhtml");
     private static final Path rhtmlReport_no_scriptpad = TestFileUtils.getSampleData("reports/knitr_no_scriptpad.rhtml").toPath();
-    protected static final Path rmdReport_embedded_script = TestFileUtils.getSampleData("reports/plotly.rmd").toPath();
+    private static final Path rhtmlNonceCheck = TestFileUtils.getSampleData("reports/nonce_check.rhtml").toPath();
+    private static final Locator.XPathLocator nonceCheckLoc = Locator.id("nonce-check-result");
+    private static final Locator.XPathLocator nonceCheckSuccessLoc = nonceCheckLoc.withText("SUCCESS");
 
     protected final RReportHelper _rReportHelper = new RReportHelper(this);
 
@@ -170,7 +174,9 @@ protected void htmlFormat()
                                     Locator.tag("pre").containing("## \"1\",249318596,\"2008-05-17\",86,36,129,76,64"),
                                     Locator.tag("pre").withText("## knitr says hello to HTML!"),
                                     Locator.tag("pre").startsWith("## Error").containing(": non-numeric argument to binary operator"),
-                                    Locator.tag("p").startsWith("Well, everything seems to be working. Let's ask R what is the value of \u03C0? Of course it is 3.141")};
+                                    Locator.tag("p").startsWith("Well, everything seems to be working. Let's ask R what is the value of \u03C0? Of course it is 3.141"),
+                                    nonceCheckSuccessLoc // Inline script should run
+        };
         String[] reportNotContains = {"<html>",                          // Uninterpreted html
                                       "<!--",                            // ditto
                                       "A minimal knitr example in HTML", // report title element
@@ -199,7 +205,8 @@ protected void markdownV2()
                 Locator.tag("h2").withText("R code chunks"),
                 Locator.tag("code").containing("set.seed(123)"),       // Echoed R code
                 Locator.css("p").containing("2 x pi = 6.283"),
-                Locator.tag("sup").withText("write") //should not contain the hat markdown v2 closing tag
+                Locator.tag("sup").withText("write"), //should not contain the hat markdown v2 closing tag
+                nonceCheckSuccessLoc // Inline script should run
         };
 
         String[] reportNotContains = {"```",              // Markdown for R code chunks
@@ -233,13 +240,36 @@ protected void moduleReportDependencies()
      * Issue 53211: CSP reports when an R/Plotly graph is displayed in Reports web part, same thing wrapped in a wiki works fine with strict csp
      */
     @Test
-    public void reportEmbeddedScript()
+    public void testEmbeddedReportNonce()
     {
-        Locator[] reportContains = {};
-
-        String[] reportNotContains = {};
-
-        createAndVerifyKnitrReport(rmdReport_embedded_script, RReportHelper.ReportOption.knitrMarkdown, reportContains,
-            reportNotContains, true);
+        String name = "rhtml nonce check";
+        String success = "SUCCESS";
+        Locator[] reportContains = {nonceCheckSuccessLoc};
+
+        createAndVerifyKnitrReport(rhtmlNonceCheck, RReportHelper.ReportOption.knitrHtml, reportContains,
+            null, true, name);
+        CspLogUtil.checkNewCspWarnings(getArtifactCollector());
+
+        log("Create wiki with embedded report");
+        new WikiHelper(this).createNewWikiPage()
+            .setName(name)
+            .setBody("""
+                ${labkey.webPart(partName='Report',
+                    reportName='%s',
+                    showFrame='false'
+                )}
+            """.formatted(name))
+            .saveAndClose();
+        clickAndWait(Locator.linkWithText(name));
+        assertEquals("Nonce check result", success, getText(nonceCheckLoc));
+        CspLogUtil.checkNewCspWarnings(getArtifactCollector());
+
+        log("Add report webpart");
+        new PortalHelper(this).doInAdminMode(ph -> {
+            ph.addTab(name); // Use a separate tab to ensure report isn't run accidentally
+            ph.addReportWebPart(name);
+            assertEquals("Nonce check result", success, getText(nonceCheckLoc));
+            CspLogUtil.checkNewCspWarnings(getArtifactCollector());
+        });
     }
 }
diff --git a/src/org/labkey/test/tests/TabTest.java b/src/org/labkey/test/tests/TabTest.java
@@ -66,7 +66,7 @@ private void doTabManagementTests()
         navigateToFolder(getProjectName(), FOLDER_NAME);
 
         // Move tabs
-        portalHelper.enableTabEditMode();
+        portalHelper.enterAdminMode();
         portalHelper.moveTab("Tab 1", PortalHelper.Direction.LEFT); // Nothing should happen.
         portalHelper.moveTab("Tab 1", PortalHelper.Direction.RIGHT);
         List<PortalTab> tabs = PortalTab.findTabs(getDriver());
diff --git a/src/org/labkey/test/util/PortalHelper.java b/src/org/labkey/test/util/PortalHelper.java
@@ -62,16 +62,6 @@ public WebDriver getWrappedDriver()
         return _driverWrapper.getWrappedDriver();
     }
 
-    public void enableTabEditMode()
-    {
-        new SiteNavBar(getDriver()).enterPageAdminMode();
-    }
-
-    public void disableTabEditMode()
-    {
-        new SiteNavBar(getDriver()).exitPageAdminMode();
-    }
-
     public PortalTab activateTab(String tabText)
     {
         tabText = tabText.trim();
@@ -124,18 +114,18 @@ public void hideTab(@LoggedParam String tabText)
     {
         PortalTab.find(tabText, getDriver()).hide();
 
-        disableTabEditMode();
+        exitAdminMode();
         assertElementNotPresent(Locator.xpath("//div[@class='lk-nav-tabs-ct']//ul//li//a[text()='" + tabText +"']"));
-        enableTabEditMode();
+        enterAdminMode();
     }
 
     @LogMethod(quiet = true)
     public void showTab(@LoggedParam String tabText)
     {
         PortalTab.find(tabText, getDriver()).show();
-        disableTabEditMode();
+        exitAdminMode();
         assertElementVisible(Locator.xpath("//div[@class='lk-nav-tabs-ct']//ul//li//a[contains(text(),'" + tabText +"')]"));
-        enableTabEditMode();
+        enterAdminMode();
     }
 
     @LogMethod(quiet = true)
diff --git a/src/org/labkey/test/util/WikiHelper.java b/src/org/labkey/test/util/WikiHelper.java
@@ -262,36 +262,12 @@ public String setSourceFromFile(File file, String wikiName)
      */
     public void switchWikiToSourceView()
     {
-        String curFormat = (String) _test.executeScript("return LABKEY._wiki.getProps().rendererType;");
-        if (curFormat.equalsIgnoreCase("HTML"))
-        {
-            if (_test.isElementPresent(Locator.css("#wiki-tab-source.labkey-tab-inactive")))
-            {
-                Locator tab = Locator.css("#wiki-tab-source > a");
-                _test.waitForElementToBeVisible(tab);
-                _test.click(tab);
-                _test.waitForElement(Locator.css("#wiki-tab-source.labkey-tab-active"));
-            }
-        }
+        new EditPage(_test.getDriver()).switchWikiToSourceView();
     }
 
     public void switchWikiToVisualView()
     {
-        String curFormat = (String) _test.executeScript("return LABKEY._wiki.getProps().rendererType;");
-        if (curFormat.equalsIgnoreCase("HTML"))
-        {
-            if (_test.isElementPresent(Locator.css("#wiki-tab-visual.labkey-tab-inactive")))
-            {
-                Locator tab = Locator.css("#wiki-tab-visual > a");
-                _test.waitForElementToBeVisible(tab);
-                _test.click(tab);
-
-                Locator yesButton = Locator.tagWithText("span","Yes");
-                _test.waitForElementToBeVisible(yesButton);
-                _test.waitAndClick(yesButton);
-                _test.waitForElement(Locator.css("#wiki-tab-visual.labkey-tab-active"));
-            }
-        }
+        new EditPage(_test.getDriver()).switchWikiToVisualView();
     }
 
     // need to be on a wiki page in the source container, and destinationFolder needs to be a unique link on the page
