css-sw-same-origin-substitution.https.html

Enable keyboard shortcuts

This WPT test may be referenced by the following Test IDs:
- /service-workers/service-worker/css-sw-same-origin-substitution.https.html - WPT Dashboard Interop Dashboard

<!DOCTYPE html>

<title>Service Worker: a same-origin response substituted for a cross-origin CSS request must not taint the stylesheet</title>

<script src="/resources/testharness.js"></script>

<script src="/resources/testharnessreport.js"></script>

<script src="resources/test-helpers.sub.js"></script>

<script>

// Regression test for the canvas/CSS over-taint: when a service worker serves a

// SAME-ORIGIN response to a CROSS-ORIGIN request, the resulting stylesheet is

// same-origin and its rules must be readable.

promise_test(async t => {

  const SCOPE = 'resources/css-sw-same-origin-substitution-iframe.sub.html';

  const SCRIPT = 'resources/css-sw-same-origin-substitution-worker.js';

  const registration =

      await service_worker_unregister_and_register(t, SCRIPT, SCOPE);

  t.add_cleanup(() => registration.unregister());

  await wait_for_state(t, registration.installing, 'activated');

  const frame = await with_iframe(SCOPE);

  t.add_cleanup(() => frame.remove());

  assert_equals(frame.contentDocument.styleSheets.length, 1,

                'the substituted stylesheet should have loaded');

  const sheet = frame.contentDocument.styleSheets[0];

  // Accessing cssRules throws SecurityError if the sheet is (over-)tainted.

  assert_greater_than(

      sheet.cssRules.length, 0,

      'a same-origin response substituted by the service worker for a ' +

      'cross-origin request must be readable (not over-tainted)');

}, 'SW same-origin substitution for a cross-origin CSS request must not taint ' +

   'the stylesheet');

</script>