Source code

Revision control

Copy as Markdown

Other Tools

Test Info: Warnings

<!DOCTYPE HTML>
<html>
<head>
<title>Tests for Content Security Policy during redirects</title>
<script src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<p id="display"></p>
<div id="content" style="display: none">
</div>
<iframe style="width:100%;height:300px;" id="harness"></iframe>
<pre id="log"></pre>
<script class="testbody" type="text/javascript">
var path = "/tests/dom/security/test/csp/";
// debugging
function log(s) {
// dump("**" + s + "\n");
// var log = document.getElementById("log");
// log.textContent = log.textContent+s+"\n";
}
SpecialPowers.registerObservers("csp-on-violate-policy");
// used to watch if requests are blocked by CSP or allowed through
function examiner() {
SpecialPowers.addObserver(this, "csp-on-violate-policy");
SpecialPowers.addObserver(this, "specialpowers-csp-on-violate-policy");
SpecialPowers.addObserver(this, "specialpowers-http-notify-request");
}
examiner.prototype = {
observe(subject, topic, data) {
var testpat = new RegExp("testid=([a-z0-9-]+)");
var asciiSpec;
var testid;
if (topic === "specialpowers-http-notify-request") {
// request was sent
var allowedUri = data;
if (!testpat.test(allowedUri)) return;
testid = testpat.exec(allowedUri)[1];
if (testExpectedResults[testid] == "completed") return;
log("allowed: "+allowedUri);
window.testResult(testid, allowedUri, true);
}
else if (topic === "csp-on-violate-policy" || topic === "specialpowers-csp-on-violate-policy") {
// request was blocked
asciiSpec = SpecialPowers.getPrivilegedProps(SpecialPowers.do_QueryInterface(subject, "nsIURI"), "asciiSpec");
if (!testpat.test(asciiSpec)) return;
testid = testpat.exec(asciiSpec)[1];
// had to add this check because http-on-modify-request can fire after
// csp-on-violate-policy, apparently, even though the request does
// not hit the wire.
if (testExpectedResults[testid] == "completed") return;
log("BLOCKED: "+asciiSpec);
window.testResult(testid, asciiSpec, false);
}
},
remove() {
SpecialPowers.removeObserver(this, "csp-on-violate-policy");
SpecialPowers.removeObserver(this, "specialpowers-csp-on-violate-policy");
SpecialPowers.removeObserver(this, "specialpowers-http-notify-request");
}
}
window.examiner = new examiner();
// contains { test_frame_id : expected_result }
var testExpectedResults = { "font-src": true,
"font-src-redir": false,
"frame-src": true,
"frame-src-redir": false,
"img-src": true,
"img-src-redir": false,
"media-src": true,
"media-src-redir": false,
"object-src": true,
"object-src-redir": false,
"script-src": true,
"script-src-redir": false,
"style-src": true,
"style-src-redir": false,
"xhr-src": true,
"xhr-src-redir": false,
"from-worker": true,
"script-src-redir-from-worker": true, // redir is allowed since policy isn't inherited
"xhr-src-redir-from-worker": true, // redir is allowed since policy isn't inherited
"fetch-src-redir-from-worker": true, // redir is allowed since policy isn't inherited
"from-blob-worker": true,
"script-src-redir-from-blob-worker": false,
"xhr-src-redir-from-blob-worker": false,
"fetch-src-redir-from-blob-worker": false,
"img-src-from-css": true,
"img-src-redir-from-css": false,
};
// takes the name of the test, the URL that was tested, and whether the
// load occurred
var testResult = function(testName, url, result) {
log(" testName: "+testName+", result: "+result+", expected: "+testExpectedResults[testName]+"\n");
is(result, testExpectedResults[testName], testName+" test: "+url);
// mark test as completed
testExpectedResults[testName] = "completed";
// don't finish until we've run all the tests
for (var t in testExpectedResults) {
if (testExpectedResults[t] != "completed") {
return;
}
}
window.examiner.remove();
SimpleTest.finish();
}
SimpleTest.waitForExplicitFinish();
SpecialPowers.pushPrefEnv(
{'set':[// On a cellular connection the default preload value is 0 ("preload
// none"). Our Android emulators emulate a cellular connection, and
// so by default preload no media data. This causes the media_* tests
// to timeout. We set the default used by cellular connections to the
// same as used by non-cellular connections in order to get
// consistent behavior across platforms/devices.
["media.preload.default", 2],
["media.preload.default.cellular", 2]]},
function() {
// save this for last so that our listeners are registered.
// ... this loads the testbed of good and bad requests.
document.getElementById("harness").src = "file_redirects_main.html";
});
</script>
</pre>
</body>
</html>