Source code

Revision control

Other Tools

Test Info:

  • This test was skipped 110 times in the preceding 7 days.
<!DOCTYPE html>
<head>
<title>
Check the reported TrustedType violation's sourceFile.
</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<meta http-equiv="Content-Security-Policy"
content="require-trusted-types-for 'script'; trusted-types id">
</head>
<body>
<script id="to-be-modified"></script>
<script>
let toBeModified = document.querySelector("#to-be-modified");
let id_policy = trustedTypes.createPolicy("id", {
createHTML: x => x,
createScriptURL: x => x,
createScript: x => x,
});
function futureViolation() {
return new Promise(r => addEventListener("securitypolicyviolation", r), {
once: true
});
}
function futureScript(url) {
return new Promise(r => {
let script = document.createElement("script");
script.src = id_policy.createScriptURL(url);
script.onload = r;
document.body.appendChild(script);
});
}
promise_test(async t => {
let future_violation = futureViolation();
assert_throws_js(TypeError, _ => {
document.getElementById("to-be-modified").innerHTML = "'test'";
});
let violation = await future_violation;
assert_equals(violation.sourceFile, location.href)
}, "same-document script")
promise_test(async t => {
let script_origin = get_host_info().HTTP_ORIGIN;
let script_src = script_origin +
"/trusted-types/support/set-inner-html.js";
let script = await futureScript(script_src);
let future_violation = futureViolation();
assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'"));
let violation = await future_violation;
assert_equals(violation.sourceFile, script_src);
}, "same-origin script")
promise_test(async t => {
let script_origin = get_host_info().HTTP_REMOTE_ORIGIN;
let script_src = script_origin +
"/trusted-types/support/set-inner-html.js";
let script = await futureScript(script_src);
let future_violation = futureViolation();
assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'"));
let violation = await future_violation;
assert_equals(violation.sourceFile, script_src);
}, "cross-origin script")
// TODO(arthursonzogni): Check what happens with redirects. Do we report the
// request's URL or the response's URL?
</script>
</body>