1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
<!DOCTYPE HTML>
<html lang="en">
<head>
<meta charset="utf8">
<title>Test for the network actor (HSTS detection)</title>
<script src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
<script type="text/javascript" src="common.js"></script>
<!-- Any copyright is dedicated to the Public Domain.
- http://creativecommons.org/publicdomain/zero/1.0/ -->
</head>
<body>
<p>Test for the network actor (HSTS detection)</p>
<iframe src="https://example.com/chrome/devtools/shared/webconsole/test/chrome/network_requests_iframe.html"></iframe>
<script class="testbody" type="text/javascript">
"use strict";
SimpleTest.waitForExplicitFinish();
const TEST_CASES = [
{
desc: "no HSTS",
url: "https://example.com",
usesHSTS: false,
},
{
desc: "HSTS from this response",
url: "https://example.com/"+
"browser/browser/base/content/test/general/browser_star_hsts.sjs",
usesHSTS: true,
},
{
desc: "stored HSTS from previous response",
url: "https://example.com/",
usesHSTS: true,
}
];
async function startTest()
{
info("Test detection of HTTP Strict Transport Security.");
for (const testCase of TEST_CASES) {
await checkHSTS(testCase)
}
// Reset HSTS state.
const gSSService = Cc["@mozilla.org/ssservice;1"].getService(Ci.nsISiteSecurityService);
const uri = Services.io.newURI(TEST_CASES[0].url);
gSSService.resetState(uri);
SimpleTest.finish();
}
async function checkHSTS({ url, usesHSTS}) {
info("Testing HSTS for " + url);
const commands = await createCommandsForTab();
const resourceCommand = commands.resourceCommand;
const resource = await new Promise(resolve => {
resourceCommand
.watchResources([resourceCommand.TYPES.NETWORK_EVENT], {
onAvailable: () => {},
onUpdated: resourceUpdate => {
resolve(resourceUpdate[0].resource);
},
})
.then(() => {
// Spawn the network requests after we started watching
const iframe = document.querySelector("iframe").contentWindow;
iframe.wrappedJSObject.makeXhrCallback("GET", url);
});
});
const packet = await commands.client.request({ to: resource.actor, type: "getSecurityInfo" });
is(
packet.securityInfo.hsts,
usesHSTS,
"Strict Transport Security detected correctly for " + url
);
await commands.destroy();
}
addEventListener("load", startTest, { once: true });
</script>
</body>
</html>
|
