From 0ebf5bdf043a27fd3dfb7f92e0cb63d88954c44d Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Fri, 19 Apr 2024 03:47:29 +0200 Subject: Adding upstream version 115.8.0esr. Signed-off-by: Daniel Baumann --- testing/web-platform/tests/reporting/META.yml | 5 + testing/web-platform/tests/reporting/README.md | 19 +++ .../web-platform/tests/reporting/bufferSize.html | 27 ++++ ...oss-origin-report-no-credentials.https.sub.html | 38 ++++++ ...eport-no-credentials.https.sub.html.sub.headers | 2 + .../cross-origin-reports-isolated.https.sub.html | 45 +++++++ ...gin-reports-isolated.https.sub.html.sub.headers | 2 + ...oss-origin-same-site-credentials.https.sub.html | 54 ++++++++ .../web-platform/tests/reporting/disconnect.html | 26 ++++ ...ument-reporting-bypass-report-to.https.sub.html | 41 ++++++ ...ing-bypass-report-to.https.sub.html.sub.headers | 3 + ...ument-reporting-default-endpoint.https.sub.html | 35 +++++ ...ing-default-endpoint.https.sub.html.sub.headers | 1 + ...ing-destroy-after-document-close.https.sub.html | 39 ++++++ ...cument-reporting-named-endpoints.https.sub.html | 54 ++++++++ ...ting-named-endpoints.https.sub.html.sub.headers | 4 + ...porting-not-batch-different-document.https.html | 35 +++++ ...ment-reporting-override-endpoint.https.sub.html | 41 ++++++ ...ng-override-endpoint.https.sub.html.sub.headers | 3 + ...document-reporting-path-absolute.https.sub.html | 37 ++++++ ...orting-path-absolute.https.sub.html.sub.headers | 1 + ...nerateTestReport-honors-endpoint.https.sub.html | 51 ++++++++ ...port-honors-endpoint.https.sub.html.sub.headers | 1 + .../tests/reporting/generateTestReport.html | 35 +++++ .../web-platform/tests/reporting/idlharness.any.js | 14 ++ .../web-platform/tests/reporting/nestedReport.html | 30 +++++ testing/web-platform/tests/reporting/order.html | 32 +++++ .../reporting-api-honors-limits.https.sub.html | 70 ++++++++++ ...ng-api-honors-limits.https.sub.html.sub.headers | 7 + ...ting-isolated-across-navigations.https.sub.html | 56 ++++++++ .../tests/reporting/resources/README.md | 75 +++++++++++ .../reporting/resources/csp-error.https.sub.html | 19 +++ .../resources/csp-error.https.sub.html.sub.headers | 2 + .../tests/reporting/resources/fail.png | Bin 0 -> 759 bytes .../resources/first-csp-report.https.sub.html | 22 ++++ .../first-csp-report.https.sub.html.sub.headers | 2 + .../resources/generate-csp-report.https.sub.html | 4 + .../generate-csp-report.https.sub.html.sub.headers | 1 + .../reporting/resources/generate-report-once.py | 34 +++++ .../resources/generate-report.https.sub.html | 6 + .../resources/middle-frame.https.sub.html | 15 +++ .../tests/reporting/resources/report-helper.js | 38 ++++++ .../tests/reporting/resources/report.py | 143 +++++++++++++++++++++ .../resources/same-origin-report.https.sub.html | 15 +++ .../same-origin-report.https.sub.html.sub.headers | 2 + .../resources/second-csp-report.https.sub.html | 24 ++++ .../second-csp-report.https.sub.html.sub.headers | 2 + ...me-origin-cross-site-credentials.https.sub.html | 53 ++++++++ .../same-origin-report-credentials.https.sub.html | 39 ++++++ ...n-report-credentials.https.sub.html.sub.headers | 2 + ...ame-origin-same-site-credentials.https.sub.html | 53 ++++++++ 51 files changed, 1359 insertions(+) create mode 100644 testing/web-platform/tests/reporting/META.yml create mode 100644 testing/web-platform/tests/reporting/README.md create mode 100644 testing/web-platform/tests/reporting/bufferSize.html create mode 100644 testing/web-platform/tests/reporting/cross-origin-report-no-credentials.https.sub.html create mode 100644 testing/web-platform/tests/reporting/cross-origin-report-no-credentials.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/cross-origin-reports-isolated.https.sub.html create mode 100644 testing/web-platform/tests/reporting/cross-origin-reports-isolated.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/cross-origin-same-site-credentials.https.sub.html create mode 100644 testing/web-platform/tests/reporting/disconnect.html create mode 100644 testing/web-platform/tests/reporting/document-reporting-bypass-report-to.https.sub.html create mode 100644 testing/web-platform/tests/reporting/document-reporting-bypass-report-to.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/document-reporting-default-endpoint.https.sub.html create mode 100644 testing/web-platform/tests/reporting/document-reporting-default-endpoint.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/document-reporting-destroy-after-document-close.https.sub.html create mode 100644 testing/web-platform/tests/reporting/document-reporting-named-endpoints.https.sub.html create mode 100644 testing/web-platform/tests/reporting/document-reporting-named-endpoints.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/document-reporting-not-batch-different-document.https.html create mode 100644 testing/web-platform/tests/reporting/document-reporting-override-endpoint.https.sub.html create mode 100644 testing/web-platform/tests/reporting/document-reporting-override-endpoint.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/document-reporting-path-absolute.https.sub.html create mode 100644 testing/web-platform/tests/reporting/document-reporting-path-absolute.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/generateTestReport-honors-endpoint.https.sub.html create mode 100644 testing/web-platform/tests/reporting/generateTestReport-honors-endpoint.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/generateTestReport.html create mode 100644 testing/web-platform/tests/reporting/idlharness.any.js create mode 100644 testing/web-platform/tests/reporting/nestedReport.html create mode 100644 testing/web-platform/tests/reporting/order.html create mode 100644 testing/web-platform/tests/reporting/reporting-api-honors-limits.https.sub.html create mode 100644 testing/web-platform/tests/reporting/reporting-api-honors-limits.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/reporting-isolated-across-navigations.https.sub.html create mode 100644 testing/web-platform/tests/reporting/resources/README.md create mode 100644 testing/web-platform/tests/reporting/resources/csp-error.https.sub.html create mode 100644 testing/web-platform/tests/reporting/resources/csp-error.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/resources/fail.png create mode 100644 testing/web-platform/tests/reporting/resources/first-csp-report.https.sub.html create mode 100644 testing/web-platform/tests/reporting/resources/first-csp-report.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/resources/generate-csp-report.https.sub.html create mode 100644 testing/web-platform/tests/reporting/resources/generate-csp-report.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/resources/generate-report-once.py create mode 100644 testing/web-platform/tests/reporting/resources/generate-report.https.sub.html create mode 100644 testing/web-platform/tests/reporting/resources/middle-frame.https.sub.html create mode 100644 testing/web-platform/tests/reporting/resources/report-helper.js create mode 100644 testing/web-platform/tests/reporting/resources/report.py create mode 100644 testing/web-platform/tests/reporting/resources/same-origin-report.https.sub.html create mode 100644 testing/web-platform/tests/reporting/resources/same-origin-report.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/resources/second-csp-report.https.sub.html create mode 100644 testing/web-platform/tests/reporting/resources/second-csp-report.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/same-origin-cross-site-credentials.https.sub.html create mode 100644 testing/web-platform/tests/reporting/same-origin-report-credentials.https.sub.html create mode 100644 testing/web-platform/tests/reporting/same-origin-report-credentials.https.sub.html.sub.headers create mode 100644 testing/web-platform/tests/reporting/same-origin-same-site-credentials.https.sub.html (limited to 'testing/web-platform/tests/reporting') diff --git a/testing/web-platform/tests/reporting/META.yml b/testing/web-platform/tests/reporting/META.yml new file mode 100644 index 0000000000..70f3136dd3 --- /dev/null +++ b/testing/web-platform/tests/reporting/META.yml @@ -0,0 +1,5 @@ +spec: https://w3c.github.io/reporting/ +suggested_reviewers: + - clelland + - dcreager + - igrigorik diff --git a/testing/web-platform/tests/reporting/README.md b/testing/web-platform/tests/reporting/README.md new file mode 100644 index 0000000000..52f08265c5 --- /dev/null +++ b/testing/web-platform/tests/reporting/README.md @@ -0,0 +1,19 @@ +Tests for the [Reporting API](https://w3c.github.io/reporting/). + +The tests in this directory validate the generic functionaity of the Reporting +API. Since reports are not actually generated by that specification, these tests +occasionally make use of other integrations, like CSP or Permissions Policy. + +## Testing integration with the Reporting API + +More comprehensive tests for other specifications' generated reports should be +in those specs' respective directories. + +There are two general methods of testing reporting integration: + +* The simpler is with the ReportingObserver interface, generating reports + within a document and reading them from script running in that document. +* For reports which cannot be observed from a document, there is a reporting + collector provided which can receive reports sent over HTTP and then serve + them in response to queries from the test script. See resources/README.md for + details. diff --git a/testing/web-platform/tests/reporting/bufferSize.html b/testing/web-platform/tests/reporting/bufferSize.html new file mode 100644 index 0000000000..0e50526772 --- /dev/null +++ b/testing/web-platform/tests/reporting/bufferSize.html @@ -0,0 +1,27 @@ + + +Reporting: Buffer size + + + + + + diff --git a/testing/web-platform/tests/reporting/cross-origin-report-no-credentials.https.sub.html b/testing/web-platform/tests/reporting/cross-origin-report-no-credentials.https.sub.html new file mode 100644 index 0000000000..f10d4cef3e --- /dev/null +++ b/testing/web-platform/tests/reporting/cross-origin-report-no-credentials.https.sub.html @@ -0,0 +1,38 @@ + + + + Test that reports are sent without credentials to cross-origin endpoints + + + + + + + + diff --git a/testing/web-platform/tests/reporting/cross-origin-report-no-credentials.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/cross-origin-report-no-credentials.https.sub.html.sub.headers new file mode 100644 index 0000000000..24eaf19fec --- /dev/null +++ b/testing/web-platform/tests/reporting/cross-origin-report-no-credentials.https.sub.html.sub.headers @@ -0,0 +1,2 @@ +Reporting-Endpoints: csp-endpoint="https://{{domains[www1]}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=fe5ca189-269a-4e74-a4dd-d7a3b33139d5" +Content-Security-Policy: script-src 'self' 'unsafe-inline'; img-src 'none'; report-to csp-endpoint diff --git a/testing/web-platform/tests/reporting/cross-origin-reports-isolated.https.sub.html b/testing/web-platform/tests/reporting/cross-origin-reports-isolated.https.sub.html new file mode 100644 index 0000000000..4e9cb1eb01 --- /dev/null +++ b/testing/web-platform/tests/reporting/cross-origin-reports-isolated.https.sub.html @@ -0,0 +1,45 @@ + + + + Test that reports from different origins are not sent together + + + + + + + + diff --git a/testing/web-platform/tests/reporting/cross-origin-reports-isolated.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/cross-origin-reports-isolated.https.sub.html.sub.headers new file mode 100644 index 0000000000..00b60a2d0c --- /dev/null +++ b/testing/web-platform/tests/reporting/cross-origin-reports-isolated.https.sub.html.sub.headers @@ -0,0 +1,2 @@ +Reporting-Endpoints: csp-endpoint="https://{{domains[www]}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=d0d517bf-891b-457a-b970-8b2b2c81a0bf" +Content-Security-Policy: script-src 'self' 'unsafe-inline'; img-src 'none'; report-to csp-endpoint diff --git a/testing/web-platform/tests/reporting/cross-origin-same-site-credentials.https.sub.html b/testing/web-platform/tests/reporting/cross-origin-same-site-credentials.https.sub.html new file mode 100644 index 0000000000..2f3f5fefca --- /dev/null +++ b/testing/web-platform/tests/reporting/cross-origin-same-site-credentials.https.sub.html @@ -0,0 +1,54 @@ + + + + Test that credentials are sent properly in a cross-origin but same-site nested context + + + + + + + + diff --git a/testing/web-platform/tests/reporting/disconnect.html b/testing/web-platform/tests/reporting/disconnect.html new file mode 100644 index 0000000000..12d33db8ff --- /dev/null +++ b/testing/web-platform/tests/reporting/disconnect.html @@ -0,0 +1,26 @@ + + +Reporting: Disconnect + + + + + + diff --git a/testing/web-platform/tests/reporting/document-reporting-bypass-report-to.https.sub.html b/testing/web-platform/tests/reporting/document-reporting-bypass-report-to.https.sub.html new file mode 100644 index 0000000000..394bc9e40a --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-bypass-report-to.https.sub.html @@ -0,0 +1,41 @@ + + + + + Test that reports ignore Report-To header when Reporting-Endpoints is configured + + + + + + + + + + + + + diff --git a/testing/web-platform/tests/reporting/document-reporting-bypass-report-to.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/document-reporting-bypass-report-to.https.sub.html.sub.headers new file mode 100644 index 0000000000..b2a3d20f48 --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-bypass-report-to.https.sub.html.sub.headers @@ -0,0 +1,3 @@ +Reporting-Endpoints: group1="https://{{host}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=6c2131d0-1e9b-4ee8-a196-952f2ae4ae97" +Report-To: { "group": "group1", "max_age": 10886400, "endpoints": [{ "url": "/reporting/resources/report.py?reportID=caddb022-90ea-48e8-a675-4cebaf7e8388" }] } +Document-Policy-Report-Only: document-write=?0;report-to=group1 diff --git a/testing/web-platform/tests/reporting/document-reporting-default-endpoint.https.sub.html b/testing/web-platform/tests/reporting/document-reporting-default-endpoint.https.sub.html new file mode 100644 index 0000000000..f1951e3469 --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-default-endpoint.https.sub.html @@ -0,0 +1,35 @@ + + +Test that document level reports are sent to default endpoint + + + + + +

No error

+ + + + + + diff --git a/testing/web-platform/tests/reporting/document-reporting-default-endpoint.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/document-reporting-default-endpoint.https.sub.html.sub.headers new file mode 100644 index 0000000000..e374d79be0 --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-default-endpoint.https.sub.html.sub.headers @@ -0,0 +1 @@ +Reporting-Endpoints: default="https://{{host}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=46ecac28-6d27-4763-a692-bcc588054716" diff --git a/testing/web-platform/tests/reporting/document-reporting-destroy-after-document-close.https.sub.html b/testing/web-platform/tests/reporting/document-reporting-destroy-after-document-close.https.sub.html new file mode 100644 index 0000000000..e6ec91ade3 --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-destroy-after-document-close.https.sub.html @@ -0,0 +1,39 @@ + + + + + Test that reports are not sent without Reporting-Endpoints header, with previous header set on same URL + + + + + + + + + + + + + diff --git a/testing/web-platform/tests/reporting/document-reporting-named-endpoints.https.sub.html b/testing/web-platform/tests/reporting/document-reporting-named-endpoints.https.sub.html new file mode 100644 index 0000000000..c24601147a --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-named-endpoints.https.sub.html @@ -0,0 +1,54 @@ + + + + + Test that reports are sent to multiple named endpoints + + + + + + + + + + + + + + diff --git a/testing/web-platform/tests/reporting/document-reporting-named-endpoints.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/document-reporting-named-endpoints.https.sub.html.sub.headers new file mode 100644 index 0000000000..2d5a308db2 --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-named-endpoints.https.sub.html.sub.headers @@ -0,0 +1,4 @@ +Reporting-Endpoints: group1="https://{{host}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=0d334af1-1c5c-4e59-9079-065131ff2a45" +Reporting-Endpoints: group2="https://{{host}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=09c1a265-5fc7-4c49-b35c-32078c2d0c19" +Content-Security-Policy: script-src 'self' 'unsafe-inline'; img-src 'none'; report-to group1 +Document-Policy-Report-Only: document-write=?0;report-to=group2 diff --git a/testing/web-platform/tests/reporting/document-reporting-not-batch-different-document.https.html b/testing/web-platform/tests/reporting/document-reporting-not-batch-different-document.https.html new file mode 100644 index 0000000000..e124bd7fbd --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-not-batch-different-document.https.html @@ -0,0 +1,35 @@ + + + + + Test that reports are sent to multiple named endpoints + + + + + + + + + + + + + diff --git a/testing/web-platform/tests/reporting/document-reporting-override-endpoint.https.sub.html b/testing/web-platform/tests/reporting/document-reporting-override-endpoint.https.sub.html new file mode 100644 index 0000000000..9264786093 --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-override-endpoint.https.sub.html @@ -0,0 +1,41 @@ + + + + + Test that Reporting-Endpoints header endpoint with same name override previous value + + + + + + + + + + + + + diff --git a/testing/web-platform/tests/reporting/document-reporting-override-endpoint.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/document-reporting-override-endpoint.https.sub.html.sub.headers new file mode 100644 index 0000000000..46954f4d5c --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-override-endpoint.https.sub.html.sub.headers @@ -0,0 +1,3 @@ +Reporting-Endpoints: group1="https://{{host}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=b523d7f5-28f0-4be6-9460-e163ee9b4ab8" +Reporting-Endpoints: group1="https://{{host}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=03e4474d-768c-42f2-8e17-39aa95b309e3" +Document-Policy-Report-Only: document-write=?0;report-to=group1 diff --git a/testing/web-platform/tests/reporting/document-reporting-path-absolute.https.sub.html b/testing/web-platform/tests/reporting/document-reporting-path-absolute.https.sub.html new file mode 100644 index 0000000000..48be010a00 --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-path-absolute.https.sub.html @@ -0,0 +1,37 @@ + + +Test that Reporting-Endpoints report received for absolute path endpoint. + + + + + +

No error

+ + + + + + diff --git a/testing/web-platform/tests/reporting/document-reporting-path-absolute.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/document-reporting-path-absolute.https.sub.html.sub.headers new file mode 100644 index 0000000000..547cd6a588 --- /dev/null +++ b/testing/web-platform/tests/reporting/document-reporting-path-absolute.https.sub.html.sub.headers @@ -0,0 +1 @@ +Reporting-Endpoints: default="/reporting/resources/report.py?reportID=8106c1d6-55f7-4c82-a8e1-fabc59f890f8" diff --git a/testing/web-platform/tests/reporting/generateTestReport-honors-endpoint.https.sub.html b/testing/web-platform/tests/reporting/generateTestReport-honors-endpoint.https.sub.html new file mode 100644 index 0000000000..f04f5e00f9 --- /dev/null +++ b/testing/web-platform/tests/reporting/generateTestReport-honors-endpoint.https.sub.html @@ -0,0 +1,51 @@ + + + + Test that the reporting-api generate_test_report feature honors endpoints + + + + + + + + + + + \ No newline at end of file diff --git a/testing/web-platform/tests/reporting/generateTestReport-honors-endpoint.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/generateTestReport-honors-endpoint.https.sub.html.sub.headers new file mode 100644 index 0000000000..7167d54d83 --- /dev/null +++ b/testing/web-platform/tests/reporting/generateTestReport-honors-endpoint.https.sub.html.sub.headers @@ -0,0 +1 @@ +Reporting-Endpoints: default="https://{{host}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=41534b09-65b2-498a-9fd3-104281ed63ce" diff --git a/testing/web-platform/tests/reporting/generateTestReport.html b/testing/web-platform/tests/reporting/generateTestReport.html new file mode 100644 index 0000000000..1c6e7dc225 --- /dev/null +++ b/testing/web-platform/tests/reporting/generateTestReport.html @@ -0,0 +1,35 @@ + + +Reporting: Generate Test Report + + + + + + diff --git a/testing/web-platform/tests/reporting/idlharness.any.js b/testing/web-platform/tests/reporting/idlharness.any.js new file mode 100644 index 0000000000..17cef81835 --- /dev/null +++ b/testing/web-platform/tests/reporting/idlharness.any.js @@ -0,0 +1,14 @@ +// META: script=/resources/WebIDLParser.js +// META: script=/resources/idlharness.js + +'use strict'; + +idl_test( + ['reporting'], + [], + idl_array => { + idl_array.add_objects({ + // TODO: objects + }); + } +); diff --git a/testing/web-platform/tests/reporting/nestedReport.html b/testing/web-platform/tests/reporting/nestedReport.html new file mode 100644 index 0000000000..156338ee74 --- /dev/null +++ b/testing/web-platform/tests/reporting/nestedReport.html @@ -0,0 +1,30 @@ + + +Reporting: Nested report + + + + + + diff --git a/testing/web-platform/tests/reporting/order.html b/testing/web-platform/tests/reporting/order.html new file mode 100644 index 0000000000..c43964220c --- /dev/null +++ b/testing/web-platform/tests/reporting/order.html @@ -0,0 +1,32 @@ + + +Reporting: Order + + + + + +

No error

+ + + diff --git a/testing/web-platform/tests/reporting/reporting-api-honors-limits.https.sub.html b/testing/web-platform/tests/reporting/reporting-api-honors-limits.https.sub.html new file mode 100644 index 0000000000..4732711888 --- /dev/null +++ b/testing/web-platform/tests/reporting/reporting-api-honors-limits.https.sub.html @@ -0,0 +1,70 @@ + + + + Test that the report-api honors buffer limits on a per-report type basis + + + + + + + + + + + diff --git a/testing/web-platform/tests/reporting/reporting-api-honors-limits.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/reporting-api-honors-limits.https.sub.html.sub.headers new file mode 100644 index 0000000000..376788443e --- /dev/null +++ b/testing/web-platform/tests/reporting/reporting-api-honors-limits.https.sub.html.sub.headers @@ -0,0 +1,7 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: reporting-api-honors-limits={{$id:uuid()}}; Path=/reporting +Reporting-Endpoints: csp-group="https://{{host}}:{{ports[https][0]}}/reporting/resources/report.py?op=put&reportID={{$id}}" +Content-Security-Policy: script-src 'self' 'unsafe-inline'; img-src 'none'; report-to csp-group diff --git a/testing/web-platform/tests/reporting/reporting-isolated-across-navigations.https.sub.html b/testing/web-platform/tests/reporting/reporting-isolated-across-navigations.https.sub.html new file mode 100644 index 0000000000..df61afa833 --- /dev/null +++ b/testing/web-platform/tests/reporting/reporting-isolated-across-navigations.https.sub.html @@ -0,0 +1,56 @@ + + +Bug test page 1 + + + + + +

Bug test main frame

+ + diff --git a/testing/web-platform/tests/reporting/resources/README.md b/testing/web-platform/tests/reporting/resources/README.md new file mode 100644 index 0000000000..b77d1f96b7 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/README.md @@ -0,0 +1,75 @@ +# Using the common report collector + +To send reports to the collector, configure the reporting API to POST reports +to the collector's URL. This can be same- or cross- origin with the reporting +document, as the collector will follow the CORS protocol. + +The collector supports both CSP Level 2 (report-uri) reports as well as +Reporting API reports. + +A GET request can be used to retrieve stored reports for analysis. + +A POST request can be used to clear reports stored in the server. + +Sent credentials are stored with the reports, and can be retrieved separately. + +CORS Notes: +* Preflight requests originating from www2.web-platform.test will be rejected. + This allows tests to ensure that cross-origin report uploads are not sent when + the endpoint does not support CORS. + +## Supported GET parameters: + `op`: For GET requests, a string indicating the operation to perform (see + below for description of supported operations). Defaults to + `retrieve_report`. + + `reportID`: A UUID to associate with the reports sent from this document. This + can be used to distinguish between reports from multiple documents, and to + provide multiple distinct endpoints for a single document. Either `reportID` + or `endpoint` must be provided. + + `endpoint`: A string which will be used to generate a UUID to be used as the + reportID. Either `reportID` or `endpoint` must be provided. + + `timeout`: The amount of time to wait, in seconds, before responding. Defaults + to 0.5s. + + `min_count`: The minimum number of reports to return with the `retrieve_report` + operation. If there have been fewer than this many reports received, then an + empty report list will be returned instead. + + `retain`: If present, reports will remain in the stash after being retrieved. + By default, reports are cleared once retrieved. + +### Operations: + `retrieve_report`: Returns all reports received so far for this reportID, as a + JSON-formatted list. If no reports have been received, an empty list will be + returned. + + `retrieve_cookies`: Returns the cookies sent with the most recent reports for + this reportID, as a JSON-formatted object. + + `retrieve_count`: Returns the number of POST requests for reports with this + reportID so far. + +## Supported POST JSON payload: + + `op`: For POST requests, a string indicating the operation to perform (see + below for description of supported operations). + + `reportIDs`: A list of `reportID`s, each one a UUID associated with reports stored in the server stash. + +### Operations +`DELETE`: Clear all reports associated with `reportID` listed in `reportIDs` list. + +### Example usage: +``` +# Clear reports on the server. +fetch('/reporting/resources/report.py', { + method: "POST", + body: JSON.stringify({ + op: "DELETE", + reportIDs: [...] # a list of reportID + }) +}); +``` diff --git a/testing/web-platform/tests/reporting/resources/csp-error.https.sub.html b/testing/web-platform/tests/reporting/resources/csp-error.https.sub.html new file mode 100644 index 0000000000..c883051945 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/csp-error.https.sub.html @@ -0,0 +1,19 @@ + + + + Notify parent on load and generate a CSP error + + + + + diff --git a/testing/web-platform/tests/reporting/resources/csp-error.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/resources/csp-error.https.sub.html.sub.headers new file mode 100644 index 0000000000..00b60a2d0c --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/csp-error.https.sub.html.sub.headers @@ -0,0 +1,2 @@ +Reporting-Endpoints: csp-endpoint="https://{{domains[www]}}:{{ports[https][0]}}/reporting/resources/report.py?reportID=d0d517bf-891b-457a-b970-8b2b2c81a0bf" +Content-Security-Policy: script-src 'self' 'unsafe-inline'; img-src 'none'; report-to csp-endpoint diff --git a/testing/web-platform/tests/reporting/resources/fail.png b/testing/web-platform/tests/reporting/resources/fail.png new file mode 100644 index 0000000000..b593380333 Binary files /dev/null and b/testing/web-platform/tests/reporting/resources/fail.png differ diff --git a/testing/web-platform/tests/reporting/resources/first-csp-report.https.sub.html b/testing/web-platform/tests/reporting/resources/first-csp-report.https.sub.html new file mode 100644 index 0000000000..9887769128 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/first-csp-report.https.sub.html @@ -0,0 +1,22 @@ + + + +Bug test page 1 + + +

Bug test page 1

+ + + + + + diff --git a/testing/web-platform/tests/reporting/resources/first-csp-report.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/resources/first-csp-report.https.sub.html.sub.headers new file mode 100644 index 0000000000..2f5eeb4d8c --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/first-csp-report.https.sub.html.sub.headers @@ -0,0 +1,2 @@ +Reporting-Endpoints: csp="/reporting/resources/report.py?pipe=trickle(d1)&endpoint=csp1" +Content-Security-Policy: img-src 'none'; report-to csp diff --git a/testing/web-platform/tests/reporting/resources/generate-csp-report.https.sub.html b/testing/web-platform/tests/reporting/resources/generate-csp-report.https.sub.html new file mode 100644 index 0000000000..7adec0f309 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/generate-csp-report.https.sub.html @@ -0,0 +1,4 @@ + + +Generate CSP reports + diff --git a/testing/web-platform/tests/reporting/resources/generate-csp-report.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/resources/generate-csp-report.https.sub.html.sub.headers new file mode 100644 index 0000000000..44242c3c89 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/generate-csp-report.https.sub.html.sub.headers @@ -0,0 +1 @@ +Content-Security-Policy: script-src 'self' 'unsafe-inline'; img-src 'none'; report-to default diff --git a/testing/web-platform/tests/reporting/resources/generate-report-once.py b/testing/web-platform/tests/reporting/resources/generate-report-once.py new file mode 100644 index 0000000000..163846a4b9 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/generate-report-once.py @@ -0,0 +1,34 @@ +def main(request, response): + # Handle CORS preflight requests + if request.method == u'OPTIONS': + # Always reject preflights for one subdomain + if b"www2" in request.headers[b"Origin"]: + return (400, [], u"CORS preflight rejected for www2") + return [ + (b"Content-Type", b"text/plain"), + (b"Access-Control-Allow-Origin", b"*"), + (b"Access-Control-Allow-Methods", b"get"), + (b"Access-Control-Allow-Headers", b"Content-Type"), + ], u"CORS allowed" + + if b"reportID" in request.GET: + key = request.GET.first(b"reportID") + else: + response.status = 400 + return "reportID parameter is required." + + with request.server.stash.lock: + visited = request.server.stash.take(key=key) + if visited is None: + response.headers.set("Reporting-Endpoints", + b"default=\"/reporting/resources/report.py?reportID=%s\"" % key) + request.server.stash.put(key=key, value=True) + + response.content = b""" + + +Generate deprecation report + +""" diff --git a/testing/web-platform/tests/reporting/resources/generate-report.https.sub.html b/testing/web-platform/tests/reporting/resources/generate-report.https.sub.html new file mode 100644 index 0000000000..f1f4e96300 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/generate-report.https.sub.html @@ -0,0 +1,6 @@ + + +Generate deprecation report + diff --git a/testing/web-platform/tests/reporting/resources/middle-frame.https.sub.html b/testing/web-platform/tests/reporting/resources/middle-frame.https.sub.html new file mode 100644 index 0000000000..0dd26ecc2b --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/middle-frame.https.sub.html @@ -0,0 +1,15 @@ + + + + Utility page which embeds a reporting page on the chosen host + + + + + \ No newline at end of file diff --git a/testing/web-platform/tests/reporting/resources/report-helper.js b/testing/web-platform/tests/reporting/resources/report-helper.js new file mode 100644 index 0000000000..213a635c49 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/report-helper.js @@ -0,0 +1,38 @@ +function wait(ms) { + return new Promise(resolve => step_timeout(resolve, ms)); +} + +async function pollReports(endpoint, id, min_count) { + const res = await fetch(`${endpoint}?reportID=${id}${min_count ? `&min_count=${min_count}` : ''}`, { cache: 'no-store' }); + const reports = []; + if (res.status === 200) { + for (const report of await res.json()) { + reports.push(report); + } + } + return reports; +} + +async function pollCookies(endpoint, id) { + const res = await fetch(`${endpoint}?reportID=${id}&op=retrieve_cookies`, { cache: 'no-store' }); + const dict = await res.json(); + if (dict.reportCookies == 'None') + return {}; + return dict.reportCookies; +} + +async function pollNumResults(endpoint, id) { + const res = await fetch(`${endpoint}?reportID=${id}&op=retrieve_count`, { cache: 'no-store' }); + const dict = await res.json(); + if (dict.report_count == 'None') + return 0; + return dict.report_count; +} + +function checkReportExists(reports, type, url) { + for (const report of reports) { + if (report.type !== type) continue; + if (report.body.documentURL == url || report.body.sourceFile === url) return true; + } + assert_unreached(`A report of ${type} from ${url} is not found.`); +} diff --git a/testing/web-platform/tests/reporting/resources/report.py b/testing/web-platform/tests/reporting/resources/report.py new file mode 100644 index 0000000000..b5ee0c07d8 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/report.py @@ -0,0 +1,143 @@ +import time +import json +import re +import uuid + +from wptserve.utils import isomorphic_decode + + +def retrieve_from_stash(request, key, timeout, default_value, min_count=None, retain=False): + """Retrieve the set of reports for a given report ID. + + This will extract either the set of reports, credentials, or request count + from the stash (depending on the key passed in) and return it encoded as JSON. + + When retrieving reports, this will not return any reports until min_count + reports have been received. + + If timeout seconds elapse before the requested data can be found in the stash, + or before at least min_count reports are received, default_value will be + returned instead.""" + t0 = time.time() + while time.time() - t0 < timeout: + time.sleep(0.5) + with request.server.stash.lock: + value = request.server.stash.take(key=key) + if value is not None: + have_sufficient_reports = ( + min_count is None or len(value) >= min_count) + if retain or not have_sufficient_reports: + request.server.stash.put(key=key, value=value) + if have_sufficient_reports: + return json.dumps(value) + + return default_value + + +def main(request, response): + # Handle CORS preflight requests + if request.method == u'OPTIONS': + # Always reject preflights for one subdomain + if b"www2" in request.headers[b"Origin"]: + return (400, [], u"CORS preflight rejected for www2") + return [ + (b"Content-Type", b"text/plain"), + (b"Access-Control-Allow-Origin", b"*"), + (b"Access-Control-Allow-Methods", b"post"), + (b"Access-Control-Allow-Headers", b"Content-Type"), + ], u"CORS allowed" + + # Delete reports as requested + if request.method == u'POST': + body = json.loads(request.body) + if (isinstance(body, dict) and "op" in body): + if body["op"] == "DELETE" and "reportIDs" in body: + with request.server.stash.lock: + for key in body["reportIDs"]: + request.server.stash.take(key=key) + return "reports cleared" + response.status = 400 + return "op parameter value not recognized" + + if b"reportID" in request.GET: + key = request.GET.first(b"reportID") + elif b"endpoint" in request.GET: + key = uuid.uuid5(uuid.NAMESPACE_OID, isomorphic_decode( + request.GET[b'endpoint'])).urn.encode('ascii')[9:] + else: + response.status = 400 + return "Either reportID or endpoint parameter is required." + + # Cookie and count keys are derived from the report ID. + cookie_key = re.sub(b'^....', b'cccc', key) + count_key = re.sub(b'^....', b'dddd', key) + + if request.method == u'GET': + try: + timeout = float(request.GET.first(b"timeout")) + except: + timeout = 0.5 + try: + min_count = int(request.GET.first(b"min_count")) + except: + min_count = 1 + retain = (b"retain" in request.GET) + + op = request.GET.first(b"op", b"") + if op in (b"retrieve_report", b""): + return [(b"Content-Type", b"application/json")], retrieve_from_stash(request, key, timeout, u'[]', min_count, retain) + + if op == b"retrieve_cookies": + return [(b"Content-Type", b"application/json")], u"{ \"reportCookies\" : " + str(retrieve_from_stash(request, cookie_key, timeout, u"\"None\"")) + u"}" + + if op == b"retrieve_count": + return [(b"Content-Type", b"application/json")], u"{ \"report_count\": %s }" % retrieve_from_stash(request, count_key, timeout, 0) + + response.status = 400 + return "op parameter value not recognized." + + # Save cookies. + if len(request.cookies.keys()) > 0: + # Convert everything into strings and dump it into a dict. + temp_cookies_dict = {} + for dict_key in request.cookies.keys(): + temp_cookies_dict[isomorphic_decode(dict_key)] = str( + request.cookies.get_list(dict_key)) + with request.server.stash.lock: + # Clear any existing cookie data for this request before storing new data. + request.server.stash.take(key=cookie_key) + request.server.stash.put(key=cookie_key, value=temp_cookies_dict) + + # Append new report(s). + new_reports = json.loads(request.body) + + # If the incoming report is a CSP report-uri report, then it will be a single + # dictionary rather than a list of reports. To handle this case, ensure that + # any non-list request bodies are wrapped in a list. + if not isinstance(new_reports, list): + new_reports = [new_reports] + + for report in new_reports: + report[u"metadata"] = { + u"content_type": isomorphic_decode(request.headers[b"Content-Type"]), + } + + with request.server.stash.lock: + reports = request.server.stash.take(key=key) + if reports is None: + reports = [] + reports.extend(new_reports) + request.server.stash.put(key=key, value=reports) + + # Increment report submission count. This tracks the number of times this + # reporting endpoint was contacted, rather than the total number of reports + # submitted, which can be seen from the length of the report list. + with request.server.stash.lock: + count = request.server.stash.take(key=count_key) + if count is None: + count = 0 + count += 1 + request.server.stash.put(key=count_key, value=count) + + # Return acknowledgement report. + return [(b"Content-Type", b"text/plain")], b"Recorded report " + request.body diff --git a/testing/web-platform/tests/reporting/resources/same-origin-report.https.sub.html b/testing/web-platform/tests/reporting/resources/same-origin-report.https.sub.html new file mode 100644 index 0000000000..326a0fd0ed --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/same-origin-report.https.sub.html @@ -0,0 +1,15 @@ + + + + Generates a CSP violation report and sends it to a same-origin endpoint + + + + + diff --git a/testing/web-platform/tests/reporting/resources/same-origin-report.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/resources/same-origin-report.https.sub.html.sub.headers new file mode 100644 index 0000000000..8244fafb22 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/same-origin-report.https.sub.html.sub.headers @@ -0,0 +1,2 @@ +Reporting-Endpoints: csp-endpoint="/reporting/resources/report.py?reportID=d0d517bf-891b-457a-b970-8b2b2c81a0bf" +Content-Security-Policy: script-src 'self' 'unsafe-inline'; img-src 'none'; report-to csp-endpoint diff --git a/testing/web-platform/tests/reporting/resources/second-csp-report.https.sub.html b/testing/web-platform/tests/reporting/resources/second-csp-report.https.sub.html new file mode 100644 index 0000000000..a34bc653f5 --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/second-csp-report.https.sub.html @@ -0,0 +1,24 @@ + + + +Bug test page 2 + + +

Bug test page 2

+ + + diff --git a/testing/web-platform/tests/reporting/resources/second-csp-report.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/resources/second-csp-report.https.sub.html.sub.headers new file mode 100644 index 0000000000..b32c548fef --- /dev/null +++ b/testing/web-platform/tests/reporting/resources/second-csp-report.https.sub.html.sub.headers @@ -0,0 +1,2 @@ +Reporting-Endpoints: csp="/reporting/resources/report.py?endpoint=csp2" +Content-Security-Policy: img-src 'none'; report-to csp diff --git a/testing/web-platform/tests/reporting/same-origin-cross-site-credentials.https.sub.html b/testing/web-platform/tests/reporting/same-origin-cross-site-credentials.https.sub.html new file mode 100644 index 0000000000..258ab8e103 --- /dev/null +++ b/testing/web-platform/tests/reporting/same-origin-cross-site-credentials.https.sub.html @@ -0,0 +1,53 @@ + + + + Test that credentials are sent properly in a same-origin but not same-site context + + + + + + + + diff --git a/testing/web-platform/tests/reporting/same-origin-report-credentials.https.sub.html b/testing/web-platform/tests/reporting/same-origin-report-credentials.https.sub.html new file mode 100644 index 0000000000..cd93bd601b --- /dev/null +++ b/testing/web-platform/tests/reporting/same-origin-report-credentials.https.sub.html @@ -0,0 +1,39 @@ + + + + Test that reports are sent with credentials to same-origin endpoints + + + + + + + + diff --git a/testing/web-platform/tests/reporting/same-origin-report-credentials.https.sub.html.sub.headers b/testing/web-platform/tests/reporting/same-origin-report-credentials.https.sub.html.sub.headers new file mode 100644 index 0000000000..a88efd0cf9 --- /dev/null +++ b/testing/web-platform/tests/reporting/same-origin-report-credentials.https.sub.html.sub.headers @@ -0,0 +1,2 @@ +Reporting-Endpoints: csp-endpoint="/reporting/resources/report.py?reportID=320db941-960a-4529-8c4a-24aeb6739309" +Content-Security-Policy: script-src 'self' 'unsafe-inline'; img-src 'none'; report-to csp-endpoint diff --git a/testing/web-platform/tests/reporting/same-origin-same-site-credentials.https.sub.html b/testing/web-platform/tests/reporting/same-origin-same-site-credentials.https.sub.html new file mode 100644 index 0000000000..9b99edb26e --- /dev/null +++ b/testing/web-platform/tests/reporting/same-origin-same-site-credentials.https.sub.html @@ -0,0 +1,53 @@ + + + + Test that credentials are sent properly in a same-origin and also same-site nested context + + + + + + + + -- cgit v1.2.3