change-csp-attribute-and-history-navigation.html

Enable keyboard shortcuts

This WPT test may be referenced by the following Test IDs:
- /content-security-policy/embedded-enforcement/change-csp-attribute-and-history-navigation.html - WPT Dashboard Interop Dashboard

<!DOCTYPE html>

<html>

<script src="/resources/testharness.js"></script>

<script src="/resources/testharnessreport.js"></script>

<body>

<script>

  let message_from = (w, starts_with) => {

    return new Promise(resolve => {

      window.addEventListener('message', msg => {

        if (msg.source == w) {

          if (!starts_with ||

                  (msg.data.startsWith && msg.data.startsWith(starts_with)))

            resolve(msg.data);

});

});

};

  const img_url = window.origin + "/content-security-policy/support/pass.png";

  const function_addImage_string = `

    function addImage() {

      let img = document.createElement('img');

      img.onload = () => top.postMessage('img loaded', '*');

      img.onerror = () => top.postMessage('img blocked', '*');

      img.src = '${img_url}';

      document.body.appendChild(img);

`;

  const html_test_payload = `

    <!doctype html>

    <script>${function_addImage_string}</scr`+`ipt>

    <body onpageshow="addImage();"></body>

`;

  let blob_url = URL.createObjectURL(

    new Blob([html_test_payload], { type: 'text/html' }));

  // A local-scheme document is loaded in an iframe with CSPEE. Then the csp

  // attribute is changed and the iframe is navigated away and back. Since the

  // policies are reloaded from history, the fact that the csp attribute changed

  // is irrelevant.

  promise_test(async t => {

    // Create an iframe.

    let iframe = document.createElement('iframe');

    iframe.csp = "img-src 'none'; style-src 'none'";

    document.body.appendChild(iframe);

    let message_1 = message_from(iframe.contentWindow, "img");

    iframe.src = blob_url;

    assert_equals(await message_1, "img blocked",

                  "Img should be blocked by CSP enforced via CSPEE.");

    iframe.csp = "style-src 'none'";

    let message_2 = message_from(iframe.contentWindow, "img");

    iframe.src = "../inheritance/support/message-top-and-navigate-back.html";

    assert_equals(await message_2, "img blocked",

                  "Img should be blocked by CSP reloaded from history.");

    let message_3 = message_from(iframe.contentWindow, "img");

    iframe.src = "about:blank";

    iframe.src = blob_url;

    assert_equals(await message_3, "img loaded",

                  "Img should be allowed by CSP enforced by new csp attribute.");

  }, "Iframe csp attribute changed before history navigation of local scheme.");

  // A network-scheme document is loaded in an iframe with CSPEE. Then the csp

  // attribute is changed and the iframe is navigated away and back. Since the

  // policies are calculated again, the new csp attribute should be enforced

  // after the history navigation.

  promise_test(async t => {

    // Create an iframe.

    let iframe = document.createElement('iframe');

    iframe.csp = "img-src 'none'; style-src 'none'";

    document.body.appendChild(iframe);

    let message_1 = message_from(iframe.contentWindow, "img");

    iframe.src = "./support/embed-img-and-message-top.html";

    assert_equals(await message_1, "img blocked",

                  "Img should be blocked by CSP enforced via CSPEE.");

    iframe.csp = "style-src 'none'";

    let message_2 = message_from(iframe.contentWindow, "img");

    iframe.src = "../inheritance/support/message-top-and-navigate-back.html";

    assert_equals(await message_2, "img loaded",

                  "Img should be allowed by CSP enforced by new csp attribute.");

  }, "Iframe csp attribute changed before history navigation of network scheme.");

</script>

</body>

</html>