1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
|
<!DOCTYPE html>
<head>
<title>
Check the reported TrustedType violation's sourceFile.
</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="/common/get-host-info.sub.js"></script>
<meta http-equiv="Content-Security-Policy"
content="require-trusted-types-for 'script'; trusted-types id">
</head>
<body>
<script id="to-be-modified"></script>
<script>
let toBeModified = document.querySelector("#to-be-modified");
let id_policy = trustedTypes.createPolicy("id", {
createHTML: x => x,
createScriptURL: x => x,
createScript: x => x,
});
function futureViolation() {
return new Promise(r => addEventListener("securitypolicyviolation", r), {
once: true
});
}
function futureScript(url) {
return new Promise(r => {
let script = document.createElement("script");
script.src = id_policy.createScriptURL(url);
script.onload = r;
document.body.appendChild(script);
});
}
promise_test(async t => {
let future_violation = futureViolation();
assert_throws_js(TypeError, _ => {
document.getElementById("to-be-modified").innerHTML = "'test'";
});
let violation = await future_violation;
assert_equals(violation.sourceFile, location.href)
}, "same-document script")
promise_test(async t => {
let script_origin = get_host_info().HTTP_ORIGIN;
let script_src = script_origin +
"/trusted-types/support/set-inner-html.js";
let script = await futureScript(script_src);
let future_violation = futureViolation();
assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'"));
let violation = await future_violation;
assert_equals(violation.sourceFile, script_src);
}, "same-origin script")
promise_test(async t => {
let script_origin = get_host_info().HTTP_REMOTE_ORIGIN;
let script_src = script_origin +
"/trusted-types/support/set-inner-html.js";
let script = await futureScript(script_src);
let future_violation = futureViolation();
assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'"));
let violation = await future_violation;
assert_equals(violation.sourceFile, script_src);
}, "cross-origin script")
// TODO(arthursonzogni): Check what happens with redirects. Do we report the
// request's URL or the response's URL?
</script>
</body>
|
