Source code
Revision control
Copy as Markdown
Other Tools
Test Info:
- This WPT test may be referenced by the following Test IDs:
- /content-security-policy/media-src/media-src-blocked-blob-url.html - WPT Dashboard Interop Dashboard
<!DOCTYPE HTML>
<html>
<head>
<title>Video element with blob: URL must be blocked when blob: is not in media-src</title>
<meta http-equiv="Content-Security-Policy" content="script-src * 'unsafe-inline'; media-src https://example.com; connect-src 'self';">
<script src='/resources/testharness.js'></script>
<script src='/resources/testharnessreport.js'></script>
</head>
<body>
<h1>Video element with blob: URL must be blocked when blob: is not in media-src</h1>
<div id='log'></div>
<script>
async function nextViolation() {
return await new Promise((resolve) => {
window.addEventListener("securitypolicyviolation", resolve, {
once: true,
});
});
}
promise_test(t => {
return fetch("/media/A4.mp4")
.then(response => response.blob())
.then(blob => {
const blobUrl = URL.createObjectURL(blob);
t.add_cleanup(() => URL.revokeObjectURL(blobUrl));
return new Promise((resolve, reject) => {
const violationPromise = nextViolation();
const video = document.createElement("video");
video.src = blobUrl;
video.onloadeddata = reject;
video.onerror = () => { resolve(violationPromise); };
document.body.appendChild(video);
}).then((violation) => {
assert_equals(violation.violatedDirective, "media-src", "directive");
assert_equals(violation.blockedURI, "blob", "blocked URI");
});
});
}, "Video with blob: URL blocked when blob: not in media-src");
promise_test(t => {
return fetch("/media/sound_5.oga")
.then(response => response.blob())
.then(blob => {
const blobUrl = URL.createObjectURL(blob);
t.add_cleanup(() => URL.revokeObjectURL(blobUrl));
return new Promise((resolve, reject) => {
const violationPromise = nextViolation();
const audio = document.createElement("audio");
audio.src = blobUrl;
audio.onloadeddata = reject;
audio.onerror = () => { resolve(violationPromise); };
document.body.appendChild(audio);
}).then((violation) => {
assert_equals(violation.violatedDirective, "media-src", "directive");
assert_equals(violation.blockedURI, "blob", "blocked URI");
});
});
}, "Audio with blob: URL blocked when blob: not in media-src");
</script>
</body>
</html>