67 lines
2.5 KiB
HTML
67 lines
2.5 KiB
HTML
<!DOCTYPE html>
|
|
<meta charset="utf-8">
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
|
|
<body>
|
|
<script>
|
|
let frame = null;
|
|
let worker = null;
|
|
const scope = 'support/empty.html';
|
|
const script = 'support/sandboxed-service-worker.js';
|
|
|
|
// Currently, sandbox directives for workers are not specified
|
|
// https://github.com/w3c/webappsec-csp/issues/279
|
|
// and thus this test asserts that the origin of ServiceWorker is not sandboxed.
|
|
|
|
// Global setup: this must be the first promise_test.
|
|
promise_test(async (t) => {
|
|
const registration =
|
|
await service_worker_unregister_and_register(t, script, scope);
|
|
worker = registration.installing;
|
|
await wait_for_state(t, worker, 'activated');
|
|
frame = await with_iframe(scope);
|
|
|
|
// Global cleanup: the final promise_test.
|
|
promise_test(() => {
|
|
if (frame)
|
|
frame.remove();
|
|
return registration.unregister();
|
|
}, 'global cleanup');
|
|
}, 'global setup');
|
|
|
|
promise_test(async (t) => {
|
|
const r = await frame.contentWindow.fetch('/get-origin', {mode: 'cors'});
|
|
const j = await r.json();
|
|
assert_equals(j.origin, location.origin, 'Origin should not be sandboxed');
|
|
}, 'Origin of service worker');
|
|
|
|
promise_test(async (t) => {
|
|
const r = await frame.contentWindow.fetch('/get-origin',
|
|
{mode: 'same-origin'});
|
|
const j = await r.json();
|
|
assert_equals(j.origin, location.origin, 'Origin should not be opaque');
|
|
}, 'Response generated by service worker can be fetched as same-origin');
|
|
|
|
// Because the origin of service worker should be `location.origin`,
|
|
// fetches from service worker to `location.origin` should be successful.
|
|
for (const mode of ['same-origin', 'cors']) {
|
|
for (const hasACAOrigin of [true, false]) {
|
|
promise_test(async (t) => {
|
|
const final_url = new URL('/fetch/api/resources/', location);
|
|
final_url.pathname += hasACAOrigin ? 'cors-top.txt' : 'top.txt';
|
|
final_url.searchParams.set('hash', Math.random());
|
|
|
|
const url = new URL('/fetch', location);
|
|
url.searchParams.set('url', final_url);
|
|
url.searchParams.set('hash', Math.random());
|
|
const r = await frame.contentWindow.fetch(url, {mode});
|
|
const text = await r.text();
|
|
assert_equals(text, 'top');
|
|
}, 'Origin used in fetch on service worker (mode: ' +
|
|
mode +
|
|
(hasACAOrigin ? ', with ACAOrigin' : '') +
|
|
')');
|
|
}
|
|
}
|
|
</script>
|