to-javascript-url-script-src.html

Enable keyboard shortcuts

This test has a WPT meta file that expects 4 subtest issues.
This WPT test may be referenced by the following Test IDs:
- /content-security-policy/navigation/to-javascript-url-script-src.html - WPT Dashboard Interop Dashboard

<!DOCTYPE html>

<script src="/resources/testharness.js"></script>

<script src="/resources/testharnessreport.js"></script>

<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc'">

<body>

<script nonce="abc">

  function assert_csp_event_for_element(test, element) {

    assert_equals(typeof SecurityPolicyViolationEvent, "function", "These tests require 'SecurityPolicyViolationEvent'.");

    document.addEventListener("securitypolicyviolation", test.step_func(e => {

      if (e.target != element)

        return;

      assert_equals(e.blockedURI, "inline");

      assert_equals(e.effectiveDirective, "script-src-elem");

      assert_equals(element.contentDocument.body.innerText, "", "Ensure that 'Fail' doesn't appear in the child document.");

      element.remove();

      test.done();

    }));

  function navigate_to_javascript_onload(test, iframe) {

    iframe.addEventListener("load", test.step_func(e => {

      assert_equals(typeof SecurityPolicyViolationEvent, "function");

      iframe.contentDocument.addEventListener(

        "securitypolicyviolation",

        test.unreached_func("The CSP event should be fired in the embedding document, not in the embedee.")

);

      iframe.src = "javascript:'Fail.'";

    }));

  async_test(t => {

    var i = document.createElement("iframe");

    i.src = "javascript:'Fail.'";

    assert_csp_event_for_element(t, i);

    document.body.appendChild(i);

  }, "<iframe src='javascript:'> blocked without 'unsafe-inline'.");

  async_test(t => {

    var i = document.createElement("iframe");

    assert_csp_event_for_element(t, i);

    navigate_to_javascript_onload(t, i);

    document.body.appendChild(i);

  }, "<iframe> navigated to 'javascript:' blocked without 'unsafe-inline'.");

  async_test(t => {

    var i = document.createElement("iframe");

    i.src = "../support/echo-policy.py?policy=" + encodeURIComponent("script-src 'unsafe-inline'");

    assert_csp_event_for_element(t, i);

    navigate_to_javascript_onload(t, i);

    document.body.appendChild(i);

  }, "<iframe src='...'> with 'unsafe-inline' navigated to 'javascript:' blocked in this document");

  async_test(t => {

    var i = document.createElement("iframe");

    i.src = "../support/echo-policy.py?policy=" + encodeURIComponent("script-src 'none'");

    assert_csp_event_for_element(t, i);

    navigate_to_javascript_onload(t, i);

    document.body.appendChild(i);

  }, "<iframe src='...'> without 'unsafe-inline' navigated to 'javascript:' blocked in this document.");

</script>