Source code
Revision control
Copy as Markdown
Other Tools
Test Info: Warnings
- This test has a WPT meta file that expects 4 subtest issues.
- This WPT test may be referenced by the following Test IDs:
- /fetch/orb/tentative/img-mime-types-coverage.tentative.sub.html - WPT Dashboard Interop Dashboard
<!-- Test verifies that cross-origin, nosniff images are 1) blocked when their
MIME type is covered by ORB and 2) allowed otherwise.
This test is very similar to fetch/orb/img-mime-types-coverage.tentative.sub.html,
except that it focuses on MIME types relevant to ORB.
-->
<script src=/resources/testharness.js></script>
<script src=/resources/testharnessreport.js></script>
<div id=log></div>
<script>
var passes = [
// ORB safelisted MIME-types - i.e. ones covered by:
"text/css",
"image/svg+xml",
// JavaScript MIME types
"application/ecmascript",
"application/javascript",
"application/x-ecmascript",
"application/x-javascript",
"text/ecmascript",
"text/javascript",
"text/javascript1.0",
"text/javascript1.1",
"text/javascript1.2",
"text/javascript1.3",
"text/javascript1.4",
"text/javascript1.5",
"text/jscript",
"text/livescript",
"text/x-ecmascript",
"text/x-javascript",
]
var fails = [
// ORB blocklisted MIME-types - i.e. ones covered by:
"text/html",
// JSON MIME type
"application/json",
"text/json",
"application/ld+json",
// XML MIME type
"text/xml",
"application/xml",
"application/xhtml+xml",
"application/dash+xml",
"application/gzip",
"application/msexcel",
"application/mspowerpoint",
"application/msword",
"application/msword-template",
"application/pdf",
"application/vnd.apple.mpegurl",
"application/vnd.ces-quickpoint",
"application/vnd.ces-quicksheet",
"application/vnd.ces-quickword",
"application/vnd.ms-excel",
"application/vnd.ms-excel.sheet.macroenabled.12",
"application/vnd.ms-powerpoint",
"application/vnd.ms-powerpoint.presentation.macroenabled.12",
"application/vnd.ms-word",
"application/vnd.ms-word.document.12",
"application/vnd.ms-word.document.macroenabled.12",
"application/vnd.msword",
"application/vnd.openxmlformats-officedocument.presentationml.presentation",
"application/vnd.openxmlformats-officedocument.presentationml.template",
"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
"application/vnd.openxmlformats-officedocument.spreadsheetml.template",
"application/vnd.openxmlformats-officedocument.wordprocessingml.document",
"application/vnd.openxmlformats-officedocument.wordprocessingml.template",
"application/vnd.presentation-openxml",
"application/vnd.presentation-openxmlm",
"application/vnd.spreadsheet-openxml",
"application/vnd.wordprocessing-openxml",
"application/x-gzip",
"application/x-protobuf",
"application/x-protobuffer",
"application/zip",
"audio/mpegurl",
"multipart/byteranges",
"multipart/signed",
"text/event-stream",
"text/csv",
"text/vtt",
]
const get_url = (mime) => {
// www1 is cross-origin, so the HTTP response is ORB-eligible -->
url = url + "/fetch/nosniff/resources/image.py"
if (mime != null) {
url += "?type=" + encodeURIComponent(mime)
}
return url
}
passes.forEach(function (mime) {
async_test(function (t) {
var img = document.createElement("img")
img.onerror = t.unreached_func("Unexpected error event")
img.onload = t.step_func_done(function () {
assert_equals(img.width, 96)
})
img.src = get_url(mime)
document.body.appendChild(img)
}, "ORB should allow the response if Content-Type is: '" + mime + "'. ")
})
fails.forEach(function (mime) {
async_test(function (t) {
var img = document.createElement("img")
img.onerror = t.step_func_done()
img.onload = t.unreached_func("Unexpected load event")
img.src = get_url(mime)
document.body.appendChild(img)
}, "ORB should block the response if Content-Type is: '" + mime + "'. ")
})
</script>