1309 lines
43 KiB
HTML
1309 lines
43 KiB
HTML
<!DOCTYPE html>
|
|
<!--
|
|
This test was procedurally generated. Please do not modify it directly.
|
|
Sources:
|
|
- fetch/metadata/tools/fetch-metadata.conf.yml
|
|
- fetch/metadata/tools/templates/css-images.sub.html
|
|
-->
|
|
<html lang="en">
|
|
<meta charset="utf-8">
|
|
<meta name="timeout" content="long">
|
|
<title>HTTP headers on request for CSS image-accepting properties</title>
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
<script src="/fetch/metadata/resources/helper.sub.js"></script>
|
|
<body>
|
|
<script>
|
|
'use strict';
|
|
|
|
/**
|
|
* The subtests in this file use an iframe to induce requests for CSS
|
|
* resources because an iframe's `onload` event is the most direct and
|
|
* generic mechanism to detect loading of CSS resources. As an optimization,
|
|
* the subtests share the same iframe and document.
|
|
*/
|
|
const declarations = [];
|
|
const iframe = document.createElement('iframe');
|
|
const whenIframeReady = new Promise((resolve, reject) => {
|
|
iframe.onload = resolve;
|
|
iframe.onerror = reject;
|
|
});
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-site - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-site - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-site - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-site - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-site - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-site - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-site - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-site - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-site - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-site - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-site - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-site - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-site - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-site - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-site - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-mode - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-mode - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-mode - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-mode - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-mode - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-mode - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-mode - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-mode - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-mode - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-mode - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-mode - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-mode - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-mode - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-mode - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-mode');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-mode - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-dest - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-dest - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-dest - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-dest - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-dest - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-dest - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-dest - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-dest - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-dest - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-dest - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-dest - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-dest - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-dest - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-dest - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-dest');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-dest - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-user - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-user - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-user - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-user - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-user - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-user - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-user - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-user - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-user - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-user - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-user - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-user - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-user - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-user - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-user');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-user - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-storage-access - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-storage-access - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-storage-access - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-storage-access - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-storage-access - Not sent to non-trustworthy same-origin destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-storage-access - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-storage-access - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-storage-access - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-storage-access - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpSameSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-storage-access - Not sent to non-trustworthy same-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-storage-access - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-storage-access - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-storage-access - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-storage-access - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpCrossSite']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-storage-access');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-storage-access - Not sent to non-trustworthy cross-site destination');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-site - HTTPS downgrade (header not sent)');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-site - HTTPS downgrade (header not sent)');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-site - HTTPS downgrade (header not sent)');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-site - HTTPS downgrade (header not sent)');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_not_own_property(headers, 'sec-fetch-site');
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-site - HTTPS downgrade (header not sent)');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_equals(headers['sec-fetch-site'], 'cross-site');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-site - HTTPS upgrade');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-site - HTTPS upgrade');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-site - HTTPS upgrade');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-site - HTTPS upgrade');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-site - HTTPS upgrade');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`background-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_equals(headers['sec-fetch-site'], 'cross-site');
|
|
})
|
|
.then(t.step_func_done(), (error) => t.unreached_func());
|
|
}, 'background-image sec-fetch-site - HTTPS downgrade-upgrade');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`border-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'border-image sec-fetch-site - HTTPS downgrade-upgrade');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`content: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'content sec-fetch-site - HTTPS downgrade-upgrade');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`cursor: url("${url}"), auto;`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'cursor sec-fetch-site - HTTPS downgrade-upgrade');
|
|
|
|
async_test((t) => {
|
|
const key = '{{uuid()}}';
|
|
const url = makeRequestURL(key, ['httpsOrigin', 'httpOrigin', 'httpsOrigin']);
|
|
|
|
declarations.push(`list-style-image: url("${url}");`);
|
|
|
|
whenIframeReady
|
|
.then(() => retrieve(key))
|
|
.then((headers) => {
|
|
assert_own_property(headers, 'sec-fetch-site');
|
|
assert_array_equals(headers['sec-fetch-site'], ['cross-site']);
|
|
})
|
|
.then(t.step_func_done(), t.unreached_func());
|
|
}, 'list-style-image sec-fetch-site - HTTPS downgrade-upgrade');
|
|
|
|
iframe.srcdoc = declarations.map((declaration, index) => `
|
|
<style>.el${index} { ${declaration} }</style><div class="el${index}"></div>`
|
|
).join('');
|
|
document.body.appendChild(iframe);
|
|
|
|
</script>
|
|
</body>
|
|
</html>
|