diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-19 00:47:55 +0000 |
| commit | 26a029d407be480d791972afb5975cf62c9360a6 (patch) | |
| tree | f435a8308119effd964b339f76abb83a57c29483 /testing/web-platform/tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub.html | |
| parent | Initial commit. (diff) | |
| download | firefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz firefox-26a029d407be480d791972afb5975cf62c9360a6.zip | |
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub.html')
| -rw-r--r-- | testing/web-platform/tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub.html | 131 |
1 files changed, 131 insertions, 0 deletions
diff --git a/testing/web-platform/tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub.html b/testing/web-platform/tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub.html new file mode 100644 index 0000000000..f8e5b946f0 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub.html @@ -0,0 +1,131 @@ +<!DOCTYPE html> +<script src="/resources/testharness.js"></script> +<script src="/resources/testharnessreport.js"></script> + +<meta http-equiv="content-security-policy" content="script-src 'nonce-abc'; img-src 'none'"> + +<body> +<!-- Basics --> +<script nonce="abc" id="testScript"> + document.currentScript.setAttribute('executed', 'yay'); +</script> + +<script nonce="abc"> + var script = document.querySelector('#testScript'); + + test(t => { + // Query Selector + assert_equals(document.querySelector('body [nonce]'), script); + assert_equals(document.querySelector('body [nonce=""]'), null); + assert_equals(document.querySelector('body [nonce=abc]'), script); + + assert_equals(script.getAttribute('nonce'), 'abc'); + assert_equals(script.nonce, 'abc'); + }, "Reading 'nonce' content attribute and IDL attribute."); + + // Clone node. + test(t => { + script.setAttribute('executed', 'boo'); + var s2 = script.cloneNode(); + assert_equals(s2.nonce, 'abc', 'IDL attribute'); + assert_equals(s2.getAttribute('nonce'), 'abc'); + }, "Cloned node retains nonce."); + + async_test(t => { + var s2 = script.cloneNode(); + document.head.appendChild(s2); + assert_equals(s2.nonce, 'abc'); + assert_equals(s2.getAttribute('nonce'), 'abc'); + window.addEventListener('load', t.step_func_done(_ => { + // The cloned script won't execute, as its 'already started' flag is set. + assert_equals(s2.getAttribute('executed'), 'boo'); + })); + }, "Cloned node retains nonce when inserted."); + + // Set the content attribute to 'foo' + test(t => { + script.setAttribute('nonce', 'foo'); + assert_equals(script.getAttribute('nonce'), 'foo'); + assert_equals(script.nonce, 'foo'); + }, "Writing 'nonce' content attribute."); + + // Set the IDL attribute to 'bar' + test(t => { + script.nonce = 'bar'; + assert_equals(script.nonce, 'bar'); + assert_equals(script.getAttribute('nonce'), 'foo'); + }, "Writing 'nonce' IDL attribute."); + + // Fragment parser. + var documentWriteTest = async_test("Document-written script executes."); + document.write(`<script nonce='abc'> + documentWriteTest.done(); + test(t => { + var script = document.currentScript; + assert_equals(script.getAttribute('nonce'), 'abc'); + assert_equals(script.nonce, 'abc'); + }, "Document-written script's nonce value."); + </scr` + `ipt>`); + + // Create node. + async_test(t => { + var s = document.createElement('script'); + s.innerText = script.innerText; + s.nonce = 'abc'; + assert_equals(s.nonce, 'abc'); + assert_equals(s.getAttribute('nonce'), null); + document.head.appendChild(s); + assert_equals(s.nonce, 'abc'); + assert_equals(s.getAttribute('nonce'), null); + + window.addEventListener('load', t.step_func_done(_ => { + assert_equals(s.getAttribute('executed'), 'yay'); + })); + }, "createElement.nonce."); + + async_test(t => { + var s = document.createElement('script'); + s.innerText = script.innerText; + s.nonce = 'zyx'; + s.setAttribute('nonce', 'abc'); + assert_equals(s.nonce, 'abc'); + document.head.appendChild(s); + assert_equals(s.nonce, 'abc'); + assert_equals(s.getAttribute('nonce'), 'abc'); + + window.addEventListener('load', t.step_func_done(_ => { + assert_equals(s.getAttribute('executed'), 'yay'); + })); + }, "setAttribute('nonce') overwrites '.nonce' upon insertion."); + + // Create node. + async_test(t => { + var s = document.createElement('script'); + s.innerText = script.innerText; + s.setAttribute('nonce', 'abc'); + assert_equals(s.getAttribute('nonce'), 'abc', "Pre-insertion content"); + assert_equals(s.nonce, 'abc', "Pre-insertion IDL"); + document.head.appendChild(s); + assert_equals(s.nonce, 'abc', "Post-insertion IDL"); + assert_equals(s.getAttribute('nonce'), 'abc', "Post-insertion content"); + + window.addEventListener('load', t.step_func_done(_ => { + assert_equals(s.getAttribute('executed'), 'yay'); + })); + }, "createElement.setAttribute."); +</script> + +<!-- CSS Leakage --> +<style> + #cssTest { display: block; } + #cssTest[nonce=abc] { background: url(/security/resources/abe.png); } +</style> +<script nonce="abc" id="cssTest"> + test(t => { + const script = document.querySelector('#cssTest'); + t.add_cleanup(() => script.remove()); + var style = getComputedStyle(script); + assert_equals(style['display'], 'block'); + assert_equals(style['background-image'], "url(\"http://{{domains[]}}:{{ports[http][0]}}/security/resources/abe.png\")"); + }, "Nonces leak via CSS side-channels."); +</script> |