1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
|
<!DOCTYPE html>
<html>
<head>
<meta charset="utf-8" />
<title>Resource Timing TAO tests</title>
<link rel="author" title="Google" href="http://www.google.com/" />
<link rel="help"
href="https://www.w3.org/TR/resource-timing-2/#timing-allow-origin"/>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<script src="/common/custom-cors-response.js"></script>
<script src="resources/entry-invariants.js"></script>
<script src="resources/resource-loaders.js"></script>
<script src="resources/tao-response.js"></script>
<body>
<script>
const {ORIGIN, REMOTE_ORIGIN} = get_host_info();
const run_test = (loader, resource_type) => {
attribute_test(loader, remote_tao_response(ORIGIN),
invariants.assert_tao_pass_no_redirect_http,
`The timing allow check algorithm will pass when the Timing-Allow-Origin ` +
`header value contains only the origin. (${resource_type})`);
attribute_test(loader, remote_tao_response('*'),
invariants.assert_tao_pass_no_redirect_http,
`The timing allow check algorithm will pass when the Timing-Allow-Origin ` +
`header value contains only a wildcard. (${resource_type})`);
attribute_test(loader, remote_tao_response(`${ORIGIN},fake`),
invariants.assert_tao_pass_no_redirect_http,
`The timing allow check algorithm will pass when the Timing-Allow-Origin ` +
`header value list contains a case-sensitive match. (${resource_type})`);
attribute_test(loader, remote_tao_response(`${ORIGIN},*`),
invariants.assert_tao_pass_no_redirect_http,
`The timing allow check algorithm will pass when the Timing-Allow-Origin ` +
`header value list contains the origin and a wildcard. (${resource_type})`);
attribute_test(loader, remote_tao_response('fake,*'),
invariants.assert_tao_pass_no_redirect_http,
`The timing allow check algorithm will pass when the Timing-Allow-Origin ` +
`header value list contains a wildcard. (${resource_type})`);
attribute_test(loader, remote_tao_response('null'),
invariants.assert_tao_failure_resource,
`The timing allow check algorithm will fail when the Timing-Allow-Origin ` +
`header value list contains a null origin. (${resource_type})`);
attribute_test(loader, remote_tao_response('*,*'),
invariants.assert_tao_pass_no_redirect_http,
`The timing allow check algorithm will pass when the Timing-Allow-Origin ` +
`header value list contains multiple wildcards. (${resource_type})`);
attribute_test(loader, remote_tao_response(ORIGIN.toUpperCase()),
invariants.assert_tao_failure_resource,
`The timing allow check algorithm will fail when the Timing-Allow-Origin ` +
`header value contains only the uppercased origin. (${resource_type})`);
attribute_test(loader, remote_tao_response(`${ORIGIN} *`),
invariants.assert_tao_failure_resource,
`The timing allow check algorithm will fail when the Timing-Allow-Origin ` +
`header value contains the origin, a space, then a wildcard. ` +
`(${resource_type})`);
attribute_test(loader, custom_cors_response({}, REMOTE_ORIGIN),
invariants.assert_tao_failure_resource,
`The timing allow check algorithm will fail when the Timing-Allow-Origin ` +
`header is not present. (${resource_type})`);
};
run_test(load.font, "font");
run_test(load.iframe, "iframe");
run_test(load.image, "image");
run_test(load.script, "script");
run_test(load.stylesheet, "stylesheet");
run_test(load.xhr_sync, "XMLHttpRequest");
</script>
</body>
</html>
|
