trusted-types-source-file-path.html

Enable keyboard shortcuts

This WPT test may be referenced by the following Test IDs:
- /trusted-types/trusted-types-source-file-path.html - WPT Dashboard Interop Dashboard

<!DOCTYPE html>

<head>

  <title>

    Check the reported TrustedType violation's sourceFile.

  </title>

  <script src="/resources/testharness.js"></script>

  <script src="/resources/testharnessreport.js"></script>

  <script src="/common/get-host-info.sub.js"></script>

  <meta http-equiv="Content-Security-Policy"

        content="require-trusted-types-for 'script'; trusted-types id">

  </head>

<body>

<script id="to-be-modified"></script>

<script>

let toBeModified = document.querySelector("#to-be-modified");

let id_policy = trustedTypes.createPolicy("id", {

  createHTML: x => x,

  createScriptURL: x => x,

  createScript: x => x,

});

function futureViolation() {

  return new Promise(r => addEventListener("securitypolicyviolation", r), {

    once: true

});

function futureScript(url) {

  return new Promise(r => {

    let script = document.createElement("script");

    script.src = id_policy.createScriptURL(url);

    script.onload = r;

    document.body.appendChild(script);

});

promise_test(async t => {

  let future_violation = futureViolation();

  assert_throws_js(TypeError, _ => {

    document.getElementById("to-be-modified").innerHTML = "'test'";

});

  let violation = await future_violation;

  assert_equals(violation.sourceFile, location.href)

}, "same-document script")

promise_test(async t => {

  let script_origin = get_host_info().HTTP_ORIGIN;

  let script_src = script_origin +

    "/trusted-types/support/set-inner-html.js";

  let script = await futureScript(script_src);

  let future_violation = futureViolation();

  assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'"));

  let violation = await future_violation;

  assert_equals(violation.sourceFile, script_src);

}, "same-origin script")

promise_test(async t => {

  let script_origin = get_host_info().HTTP_REMOTE_ORIGIN;

  let script_src = script_origin +

    "/trusted-types/support/set-inner-html.js";

  let script = await futureScript(script_src);

  let future_violation = futureViolation();

  assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'"));

  let violation = await future_violation;

  assert_equals(violation.sourceFile, script_src);

}, "cross-origin script")

// TODO(arthursonzogni): Check what happens with redirects. Do we report the

// request's URL or the response's URL?

</script>

</body>