1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
<!DOCTYPE html>
<html>
<head>
<title>Embedded Enforcement: Sec-Required-CSP header.</title>
<!--
This test is creating and navigating several iframes. This can exceed the
"short" timeout". See https://crbug.com/1091896
-->
<meta name="timeout" content="long">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="support/testharness-helper.sub.js"></script>
</head>
<body>
<script>
var tests = [
// CRLF characters
{ "name": "\\r\\n character after directive name",
"csp": "style-src\r\n'unsafe-inline'",
"expected": null },
{ "name": "\\r\\n character in directive value",
"csp": "style-src 'unsafe-inline'\r\n'unsafe-eval'",
"expected": null },
{ "name": "\\n character after directive name",
"csp": "style-src\n'unsafe-inline'",
"expected": null },
{ "name": "\\n character in directive value",
"csp": "style-src 'unsafe-inline'\n'unsafe-eval'",
"expected": null },
{ "name": "\\r character after directive name",
"csp": "style-src\r'unsafe-inline'",
"expected": null },
{ "name": "\\r character in directive value",
"csp": "style-src 'unsafe-inline'\r'unsafe-eval'",
"expected": null },
// Attempt HTTP Header injection
{ "name": "Attempt injecting after directive name using \\r\\n",
"csp": "style-src\r\nTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after directive name using \\r",
"csp": "style-src\rTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after directive name using \\n",
"csp": "style-src\nTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after directive value using \\r\\n",
"csp": "style-src example.com\r\nTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after directive value using \\r",
"csp": "style-src example.com\rTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after directive value using \\n",
"csp": "style-src example.com\nTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after semicolon using \\r\\n",
"csp": "style-src example.com;\r\nTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after semicolon using \\r",
"csp": "style-src example.com;\rTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after semicolon using \\n",
"csp": "style-src example.com;\nTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after space between name and value using \\r\\n",
"csp": "style-src \r\nTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after space between name and value using \\r",
"csp": "style-src \rTest-Header-Injection: dummy",
"expected": null },
{ "name": "Attempt injecting after space between name and value using \\n",
"csp": "style-src \nTest-Header-Injection: dummy",
"expected": null },
];
tests.forEach(test => {
async_test(t => {
var url = generateURLString(Host.SAME_ORIGIN, PolicyHeader.REQUIRED_CSP);
assert_required_csp(t, url, test.csp, [test.expected]);
}, "Test CRLF: " + test.name);
});
</script>
</body>
</html>
|
