trusted-types-source-file-path.html

Enable keyboard shortcuts

This WPT test may be referenced by the following Test IDs:
- /trusted-types/trusted-types-source-file-path.html - WPT Dashboard Interop Dashboard

<!DOCTYPE html>

<head>

  <title>

    Check the reported TrustedType violation's sourceFile.

  </title>

  <script src="/resources/testharness.js"></script>

  <script src="/resources/testharnessreport.js"></script>

  <script src="/common/get-host-info.sub.js"></script>

  <script src="./support/csp-violations.js"></script>

  <meta http-equiv="Content-Security-Policy"

        content="require-trusted-types-for 'script'; trusted-types id">

  <meta http-equiv="Content-Security-Policy" content="connect-src 'none'">

  </head>

<body>

<script id="to-be-modified"></script>

<script>

let toBeModified = document.querySelector("#to-be-modified");

let id_policy = trustedTypes.createPolicy("id", {

  createHTML: x => x,

  createScriptURL: x => x,

  createScript: x => x,

});

function futureScript(url) {

  return new Promise(r => {

    let script = document.createElement("script");

    script.src = id_policy.createScriptURL(url);

    script.onload = r;

    document.body.appendChild(script);

});

promise_test(async t => {

  const input = "'test'";

  let violation = await trusted_type_violation_for(TypeError, _ =>

    document.getElementById("to-be-modified").innerHTML = input

);

  assert_equals(violation.sourceFile, location.href);

  assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`);

}, "same-document script")

promise_test(async t => {

  const input = "'test'";

  let script_origin = get_host_info().HTTP_ORIGIN;

  let script_src = script_origin +

    "/trusted-types/support/set-inner-html.js";

  let script = await futureScript(script_src);

  let violation = await trusted_type_violation_for(TypeError, _ =>

    setInnerHtml(toBeModified, input)

);

  assert_equals(violation.sourceFile, script_src);

  assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`);

}, "same-origin script")

promise_test(async t => {

  const input = "'test'";

  let script_origin = get_host_info().HTTP_REMOTE_ORIGIN;

  let script_src = script_origin +

    "/trusted-types/support/set-inner-html.js";

  let script = await futureScript(script_src);

  let violation = await trusted_type_violation_for(TypeError, _ =>

    setInnerHtml(toBeModified, input)

);

  assert_equals(violation.sourceFile, script_src);

  assert_equals(violation.sample, `Element innerHTML|${clipSampleIfNeeded(input)}`);

}, "cross-origin script")

// TODO(arthursonzogni): Check what happens with redirects. Do we report the

// request's URL or the response's URL?

</script>

</body>