'Test case in which we set vulnerables policies using "*" as source
for all directives that allow this value.'

def test_find_vulns_case01(self):

    header_value = "default-src    '*';script-src    '*';object-src    '*';style-src    '*';img-src    '*';media-src    '*';frame-src    '*';font-src    '*';form-action    '*';connect-src    '*';plugin-types    '*';"
    hrds = {CSP_HEADER_W3C: header_value}.items()
    csp_headers = Headers(hrds)
    http_response = HTTPResponse(200, '', csp_headers, self.url, self.url)
    vulns = find_vulns(http_response)
    self.assertEqual(len(vulns), 11)
    self.assertEqual(len(vulns[CSP_DIRECTIVE_DEFAULT]), 1)
    self.assertTrue(self._vuln_exists("Directive    'default-src'    allows    all    sources.", vulns[CSP_DIRECTIVE_DEFAULT]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_SCRIPT]), 2)
    self.assertTrue(self._vuln_exists("Directive    'script-src'    allows    all    javascript    sources.", vulns[CSP_DIRECTIVE_SCRIPT]))
    warn_msg = "Directive    'script-src'    is    defined    but    no    directive    'script-nonce'    is    defined    to    protect    javascript    resources."
    self.assertTrue(self._vuln_exists(warn_msg, vulns[CSP_DIRECTIVE_SCRIPT]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_OBJECT]), 1)
    self.assertTrue(self._vuln_exists("Directive    'object-src'    allows    all    plugin    sources.", vulns[CSP_DIRECTIVE_OBJECT]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_STYLE]), 1)
    self.assertTrue(self._vuln_exists("Directive    'style-src'    allows    all    CSS    sources.", vulns[CSP_DIRECTIVE_STYLE]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_IMAGE]), 1)
    self.assertTrue(self._vuln_exists("Directive    'img-src'    allows    all    image    sources.", vulns[CSP_DIRECTIVE_IMAGE]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_MEDIA]), 1)
    self.assertTrue(self._vuln_exists("Directive    'media-src'    allows    all    audio/video    sources.", vulns[CSP_DIRECTIVE_MEDIA]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_FRAME]), 2)
    self.assertTrue(self._vuln_exists("Directive    'frame-src'    allows    all    sources.", vulns[CSP_DIRECTIVE_FRAME]))
    warn_msg = "Directive    'frame-src'    is    defined    but    no    directive    'sandbox'    is    defined    to    protect    resources.    Perhaps    sandboxing    is    defined    at    html    attribute    level    ?"
    self.assertTrue(self._vuln_exists(warn_msg, vulns[CSP_DIRECTIVE_FRAME]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_FONT]), 1)
    self.assertTrue(self._vuln_exists("Directive    'font-src'    allows    all    font    sources.", vulns[CSP_DIRECTIVE_FONT]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_CONNECTION]), 1)
    self.assertTrue(self._vuln_exists("Directive    'connect-src'    allows    all    connection    sources.", vulns[CSP_DIRECTIVE_CONNECTION]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_FORM]), 1)
    self.assertTrue(self._vuln_exists("Directive    'form-action'    allows    all    action    target.", vulns[CSP_DIRECTIVE_FORM]))
    self.assertEqual(len(vulns[CSP_DIRECTIVE_PLUGIN_TYPES]), 1)
    self.assertTrue(self._vuln_exists("Directive    'plugin-types'    allows    all    plugins    types.", vulns[CSP_DIRECTIVE_PLUGIN_TYPES]))
