'Test case in which we set vulnerables policies for "sandbox",
"script-nonce","plugin-types","reflected-xss" directives
using invalid values.'

def test_find_vulns_case02(self):

    header_value = 'sandbox    allow-invalid;    script-nonce    aaa,bbb;plugin-types    app/titi    application/pdf;    reflected-xss    disallow;'
    hrds = {CSP_HEADER_W3C: header_value}.items()
    csp_headers = Headers(hrds)
    http_response = HTTPResponse(200, '', csp_headers, self.url, self.url)
    vulns = find_vulns(http_response)
    self.assertEqual(len(vulns), 4)
    self.assertEqual(len(vulns[CSP_DIRECTIVE_SANDBOX]), 1)
    warn_msg = "Directive    'sandbox'    specify    invalid    value:    'allow-invalid'."
    self.assertTrue(self._vuln_exists(warn_msg, vulns[CSP_DIRECTIVE_SANDBOX]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_SCRIPT_NONCE]), 1)
    warn_msg = "Directive    'script-nonce'    is    defined    but    nonce    contains    invalid    character    (','|';')."
    self.assertTrue(self._vuln_exists(warn_msg, vulns[CSP_DIRECTIVE_SCRIPT_NONCE]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_XSS]), 1)
    warn_msg = "Directive    'reflected-xss'    specify    invalid    value:    'disallow'."
    self.assertTrue(self._vuln_exists(warn_msg, vulns[CSP_DIRECTIVE_XSS]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_PLUGIN_TYPES]), 1)
    warn_msg = "Directive    'plugin-types'    specify    invalid    mime    type:    'app/titi'."
    self.assertTrue(self._vuln_exists(warn_msg, vulns[CSP_DIRECTIVE_PLUGIN_TYPES]))
