116 lines
3.6 KiB
HTML
116 lines
3.6 KiB
HTML
<!DOCTYPE HTML>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>Bug 1720103 - Https-first: Do not upgrade form submissions (for now)</title>
|
|
<script src="/tests/SimpleTest/SimpleTest.js"></script>
|
|
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
|
</head>
|
|
<body>
|
|
<iframe style="width:100%;" id="testframe"></iframe>
|
|
<script class="testbody" type="text/javascript">
|
|
/*
|
|
* Description of the test:
|
|
* We test https-first behaviour with forms.
|
|
* We perform each test once with same origin and the second time
|
|
* with a cross origin. We perform two GET form requests and two POST
|
|
* form requests.
|
|
*/
|
|
SimpleTest.waitForExplicitFinish();
|
|
window.addEventListener("message", receiveMessage);
|
|
|
|
const SAME_ORIGIN = "http://example.com/tests/dom/security/test/https-first/file_form_submission.sjs";
|
|
const CROSS_ORIGIN = SAME_ORIGIN.replace(".com", ".org");
|
|
const Tests = [{
|
|
// 1. Test GET, gets upgraded
|
|
query: "?test=1",
|
|
scheme: "https:",
|
|
method: "GET",
|
|
value: "test=success",
|
|
},
|
|
{
|
|
// 2. Test GET, gets downgraded again
|
|
// 2. a) If the second request is same-origin there is an upgrade exception
|
|
// so no upgrade is performed.
|
|
// 2. b) If the submmission domain is different, the request is upgraded.
|
|
query:"?test=2",
|
|
scheme: "http:",
|
|
method: "GET",
|
|
value: "test=success"
|
|
},
|
|
{ // 3. Test POST formular, does not get upgraded
|
|
query: "?test=3",
|
|
scheme: "http:",
|
|
method: "POST",
|
|
value: "test=success"
|
|
},
|
|
{ // 4. Test POST formular, does not get upgraded
|
|
query: "?test=4",
|
|
scheme: "http:",
|
|
method: "POST",
|
|
value: "test=success"
|
|
},
|
|
];
|
|
let currentTest;
|
|
let counter = 0;
|
|
let testWin;
|
|
let sameOrigin = true;
|
|
|
|
// Verify that top-level request got the expected scheme and reached the correct location.
|
|
async function receiveMessage(event){
|
|
let data = event.data;
|
|
let origin = sameOrigin? SAME_ORIGIN : CROSS_ORIGIN
|
|
let wantedScheme = currentTest.scheme;
|
|
if (!sameOrigin && counter === 1) {
|
|
// cross-origin still gets upgraded, same-origin has a stored exception
|
|
// after the first fail
|
|
// See 2. a) and 2. b) above.
|
|
wantedScheme = "https:";
|
|
}
|
|
// Since the form is always sent to example.com we expect it here as location
|
|
is(data.location.includes(SAME_ORIGIN.replace("http:", wantedScheme)), true,
|
|
"Reached the correct location for " + currentTest.query );
|
|
is(data.scheme, wantedScheme,`${currentTest.query} upgraded or downgraded to ` + wantedScheme);
|
|
// Check that the form value is correct
|
|
is(data.form, currentTest.value, "Form was transfered");
|
|
testWin.close();
|
|
// Flip origin flag
|
|
sameOrigin ^= true;
|
|
// Only go to next test if already sent same and cross origin request for current test
|
|
if (sameOrigin) {
|
|
counter++;
|
|
}
|
|
await SpecialPowers.removePermission(
|
|
"https-only-load-insecure",
|
|
origin
|
|
);
|
|
// Check if we have test left, if not finish the testing
|
|
if (counter >= Tests.length) {
|
|
window.removeEventListener("message", receiveMessage);
|
|
SimpleTest.finish();
|
|
return;
|
|
}
|
|
// If we didn't reached the end yet, run next test
|
|
runTest();
|
|
}
|
|
|
|
function runTest() {
|
|
currentTest = Tests[counter];
|
|
// If sameOrigin flag is set make a origin request, else a cross origin request
|
|
if (sameOrigin) {
|
|
testWin= window.open(SAME_ORIGIN + currentTest.query, "_blank");
|
|
} else {
|
|
testWin= window.open(CROSS_ORIGIN + currentTest.query, "_blank");
|
|
}
|
|
}
|
|
|
|
// Set prefs and start test
|
|
SpecialPowers.pushPrefEnv({ set: [
|
|
["dom.security.https_first", true],
|
|
["security.warn_submit_secure_to_insecure", false]
|
|
]}, runTest);
|
|
|
|
|
|
</script>
|
|
</body>
|
|
</html>
|