1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
|
<!doctype html>
<html>
<title> Check enforcement of COEP in a ServiceWorker using CacheStorage. </title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script>
<script>
// See also: ./dedicated-worker-cache-storage.https.html
function remote(path) {
const REMOTE_ORIGIN = get_host_info().HTTPS_REMOTE_ORIGIN;
return new URL(path, REMOTE_ORIGIN);
}
const iframe_path = "./resources/iframe.html?pipe=";
const service_worker_path = "./resources/universal-worker.js?pipe=";
const ressource_path = "/images/blue.png?pipe=";
const coep_header= {
"coep-none" : "",
"coep-require-corp" : "|header(Cross-Origin-Embedder-Policy,require-corp)",
}
const corp_header = {
"corp-undefined" : "",
"corp-cross-origin" : "|header(Cross-Origin-Resource-Policy,cross-origin)",
}
// Send a message to the |worker| and wait for its response.
function executeCommandInServiceWorker(worker, command) {
const channel = new MessageChannel();
const response = new Promise(resolve => channel.port1.onmessage = resolve);
worker.postMessage(command, [ channel.port2 ]);
return response;
}
// Check enforcement of COEP in a ServiceWorker using CacheStorage.
//
// 1) Fetch a response from a document with COEP:none. Store it in the
// CacheStorage. The response is cross-origin without any CORS header.
// 2) From a ServiceWorker, retrieve the response from the CacheStorage.
//
// Test parameters:
// - |worker_coep| the COEP header of the ServiceWorker's script response.
// - |response_corp| the CORP header of the response.
//
// Test expectations:
// |loaded| is true whenever the worker is able to fetch the response from
// the CacheStorage. According to the specification:
// https://mikewest.github.io/corpp/#initialize-embedder-policy-for-global
// it must be false when:
// - |worker_coep| is 'coep-require-corp' and
// - |response-corp| is 'corp-undefined'.
function check(
// Test parameters:
worker_coep,
response_corp,
// Test expectations:
loaded) {
promise_test(async (t) => {
// 1) Fetch a response from a document with COEP:none. Store it in the
// CacheStorage. The response is cross-origin without any CORS header.
const resource_path = ressource_path + corp_header[response_corp];
const resource_url = remote(resource_path);
const fetch_request = new Request(resource_url, {mode: 'no-cors'});
const cache = await caches.open('v1');
const fetch_response = await fetch(fetch_request);
await cache.put(fetch_request, fetch_response);
// 2) Start a ServiceWorker.
const SCOPE= new URL(location.href).pathname;
const service_worker_allowed = `|header(service-worker-allowed,${SCOPE})`;
const SCRIPT =
service_worker_path +
coep_header[worker_coep] +
service_worker_allowed;
const reg = await service_worker_unregister_and_register(t, SCRIPT, SCOPE);
add_completion_callback(() => reg.unregister());
// Start talking to the ServiceWorker, no matter its state.
const worker = reg.installing || reg.waiting || reg.active;
// 3) From the service worker, try to retrieve the response from the
// CacheStorage.
const response = executeCommandInServiceWorker(worker, `
(async function() {
const cache = await caches.open('v1');
const request = new Request('${resource_url}', {
mode: 'no-cors'
});
try {
const response = await cache.match(request);
message.ports[0].postMessage('success');
} catch(error) {
message.ports[0].postMessage('error');
}
})()
`);
const {data} = await response;
assert_equals(data === "success", loaded);
}, `A ServiceWorker with ${worker_coep} use CacheStorage to get a ${response_corp} response.`)
}
// ------------------------------------------------------
// worker_coep , response_corp , loaded
// ------------------------------------------------------
check("coep-none" , "corp-undefined" , true);
check("coep-none" , "corp-cross-origin" , true);
check("coep-require-corp" , "corp-undefined" , false);
check("coep-require-corp" , "corp-cross-origin" , true);
</script>
</html>
|
