'Test case in which we set vulnerables policies for
"sandbox","reflected-xss" directives using valid values.'

def test_find_vulns_case03(self):

    header_value = 'sandbox    allow-*    allow-forms    allow-same-origin    allow-scripts    allow-top-navigation;reflected-xss    allow;'
    hrds = {CSP_HEADER_W3C: header_value}.items()
    csp_headers = Headers(hrds)
    http_response = HTTPResponse(200, '', csp_headers, self.url, self.url)
    vulns = find_vulns(http_response)
    self.assertEqual(len(vulns), 2)
    self.assertEqual(len(vulns[CSP_DIRECTIVE_SANDBOX]), 2)
    warn_msg = "Directive    'sandbox'    apply    no    restrictions."
    self.assertTrue(vulns[CSP_DIRECTIVE_SANDBOX][0].desc, warn_msg)
    self.assertTrue(vulns[CSP_DIRECTIVE_SANDBOX][1].desc, warn_msg)
    self.assertEqual(len(vulns[CSP_DIRECTIVE_XSS]), 1)
    warn_msg = "Directive    'reflected-xss'    instruct    user    agent    to    disable    its    active    protections    against    reflected    XSS."
    self.assertTrue(self._vuln_exists(warn_msg, vulns[CSP_DIRECTIVE_XSS]))
