summaryrefslogtreecommitdiffstats
path: root/testing/web-platform/tests/content-security-policy/script-src/scriptnonce-changed-1.html
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-19 00:47:55 +0000
commit26a029d407be480d791972afb5975cf62c9360a6 (patch)
treef435a8308119effd964b339f76abb83a57c29483 /testing/web-platform/tests/content-security-policy/script-src/scriptnonce-changed-1.html
parentInitial commit. (diff)
downloadfirefox-26a029d407be480d791972afb5975cf62c9360a6.tar.xz
firefox-26a029d407be480d791972afb5975cf62c9360a6.zip
Adding upstream version 124.0.1.upstream/124.0.1
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/content-security-policy/script-src/scriptnonce-changed-1.html')
-rw-r--r--testing/web-platform/tests/content-security-policy/script-src/scriptnonce-changed-1.html31
1 files changed, 31 insertions, 0 deletions
diff --git a/testing/web-platform/tests/content-security-policy/script-src/scriptnonce-changed-1.html b/testing/web-platform/tests/content-security-policy/script-src/scriptnonce-changed-1.html
new file mode 100644
index 0000000000..75f92f354a
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/script-src/scriptnonce-changed-1.html
@@ -0,0 +1,31 @@
+<!DOCTYPE html>
+<head>
+ <title>CSP inline script check is done at #prepare-a-script (nonce)</title>
+ <script src="/resources/testharness.js"></script>
+ <script src="/resources/testharnessreport.js"></script>
+ <meta http-equiv="Content-Security-Policy" content="script-src 'self' 'nonce-abc' 'sha256-deadbeef'"></meta>
+</head>
+<!--
+ "Should element's inline behavior be blocked by Content Security Policy?"
+ is executed at the time of https://html.spec.whatwg.org/C/#prepare-a-script,
+ not at https://html.spec.whatwg.org/C/#execute-the-script-block.
+ So when nonce is modified after #prepare-a-script, the nonce BEFORE
+ the modification is used for hash check.
+-->
+<script nonce="abc">
+let log1 = '';
+</script>
+
+<!-- Execution order:
+ async script is executed
+ -> stylesheet is loaded
+ -> inline script is executed. -->
+<link rel="stylesheet" href="support/empty.css?dummy=3&pipe=trickle(d2)" type="text/css">
+<script src="support/change-scriptnonce-before-execute.js?dummy=3&pipe=trickle(d1)" async></script>
+<script id="scr1" nonce="abc">log1 += 'scr1 executed';</script>
+
+<script nonce="abc">
+test(() => {
+ assert_equals(log1, 'scr1 executed');
+}, 'scr1 nonce before modification should not be blocked');
+</script>