120 lines
4 KiB
HTML
120 lines
4 KiB
HTML
<!DOCTYPE html>
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
|
|
<meta http-equiv="Content-Security-Policy" content="img-src 'none'">
|
|
<body>
|
|
<script>
|
|
let message_from = (w, starts_with) => {
|
|
return new Promise(resolve => {
|
|
window.addEventListener('message', msg => {
|
|
if (msg.source == w) {
|
|
if (!starts_with || msg.data.startsWith(starts_with))
|
|
resolve(msg.data);
|
|
}
|
|
});
|
|
});
|
|
};
|
|
|
|
const img_url = window.origin + "/content-security-policy/support/fail.png";
|
|
const img_tag_string = `
|
|
<img src="${img_url}"
|
|
onload="top.postMessage('img loaded', '*');"
|
|
onerror="top.postMessage('img blocked', '*');"
|
|
>
|
|
`;
|
|
|
|
const html_test_payload = `
|
|
<!doctype html>
|
|
<div>${img_tag_string}</div>
|
|
`;
|
|
let blob_url = URL.createObjectURL(
|
|
new Blob([html_test_payload], { type: 'text/html' }));
|
|
|
|
let write_img_to_iframe = (iframe) => {
|
|
let div = iframe.contentDocument.createElement('div');
|
|
div.innerHTML = img_tag_string;
|
|
iframe.contentDocument.body.appendChild(div);
|
|
};
|
|
|
|
|
|
// Test location.reload() for "about:blank".
|
|
promise_test(async t => {
|
|
// Create an empty iframe.
|
|
window.iframe = document.createElement('iframe');
|
|
document.body.appendChild(iframe);
|
|
|
|
// Add an img.
|
|
let message = message_from(iframe.contentWindow);
|
|
write_img_to_iframe(iframe);
|
|
|
|
// Check that the empty document inherits CSP from the initiator.
|
|
assert_equals(await message, "img blocked",
|
|
"Image should be blocked by CSP inherited from the parent.");
|
|
|
|
// Now perform a reload.
|
|
let message_2 = message_from(iframe.contentWindow);
|
|
let loaded = new Promise(resolve => iframe.onload = resolve);
|
|
iframe.contentWindow.location.reload();
|
|
await loaded;
|
|
|
|
// Add an img.
|
|
write_img_to_iframe(iframe);
|
|
|
|
// Check that the empty document still has the right CSP after reload.
|
|
assert_equals(await message_2, "img blocked",
|
|
"Image should be blocked by CSP after reload.");
|
|
}, "location.reload() of empty iframe.");
|
|
|
|
|
|
// Test location.reload() for a blob URL.
|
|
promise_test(async t => {
|
|
// Create an iframe.
|
|
window.iframe = document.createElement('iframe');
|
|
document.body.appendChild(iframe);
|
|
|
|
// Navigate to the blob URL.
|
|
let message = message_from(iframe.contentWindow);
|
|
iframe.contentWindow.location = blob_url;
|
|
|
|
// Check that the blob URL inherits CSP from the initiator.
|
|
assert_equals(await message, "img blocked",
|
|
"Image should be blocked by CSP inherited from navigation initiator.");
|
|
|
|
// Now perform a reload.
|
|
let message_2 = message_from(iframe.contentWindow);
|
|
let loaded = new Promise(resolve => iframe.onload = resolve);
|
|
iframe.contentWindow.location.reload();
|
|
await loaded;
|
|
|
|
// Check that the blob URL document still has the right CSP after reload.
|
|
assert_equals(await message_2, "img blocked",
|
|
"Image should be blocked by CSP after reload.");
|
|
}, "location.reload() of blob URL iframe.");
|
|
|
|
|
|
// Test location.reload() for a srcdoc iframe.
|
|
promise_test(async t => {
|
|
// Create a srcdoc iframe.
|
|
window.iframe = document.createElement('iframe');
|
|
document.body.appendChild(iframe);
|
|
|
|
let message = message_from(iframe.contentWindow);
|
|
iframe.srcdoc = `${html_test_payload}`;
|
|
|
|
// Check that the srcdoc iframe inherits from the parent.
|
|
assert_equals(await message, "img blocked",
|
|
"Image should be blocked by CSP inherited from navigation initiator.");
|
|
|
|
// Now perform a reload.
|
|
let message_2 = message_from(iframe.contentWindow);
|
|
let loaded = new Promise(resolve => iframe.onload = resolve);
|
|
iframe.contentWindow.location.reload();
|
|
await loaded;
|
|
|
|
// Check that the srcdoc iframe still has the right CSP after reload.
|
|
assert_equals(await message_2, "img blocked",
|
|
"Image should be blocked by CSP after reload.");
|
|
}, "location.reload() of srcdoc iframe.");
|
|
</script>
|
|
</body>
|