diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 19:33:14 +0000 |
| commit | 36d22d82aa202bb199967e9512281e9a53db42c9 (patch) | |
| tree | 105e8c98ddea1c1e4784a60a5a6410fa416be2de /testing/web-platform/tests/content-security-policy/sandbox/service-worker-sandbox.https.html | |
| parent | Initial commit. (diff) | |
| download | firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip | |
Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/content-security-policy/sandbox/service-worker-sandbox.https.html')
| -rw-r--r-- | testing/web-platform/tests/content-security-policy/sandbox/service-worker-sandbox.https.html | 67 |
1 files changed, 67 insertions, 0 deletions
diff --git a/testing/web-platform/tests/content-security-policy/sandbox/service-worker-sandbox.https.html b/testing/web-platform/tests/content-security-policy/sandbox/service-worker-sandbox.https.html new file mode 100644 index 0000000000..8b7d72e0ef --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/sandbox/service-worker-sandbox.https.html @@ -0,0 +1,67 @@ +<!DOCTYPE html> +<meta charset="utf-8"> +<script src="/resources/testharness.js"></script> +<script src="/resources/testharnessreport.js"></script> +<script src="/service-workers/service-worker/resources/test-helpers.sub.js"></script> +<body> +<script> +let frame = null; +let worker = null; +const scope = 'support/empty.html'; +const script = 'support/sandboxed-service-worker.js'; + +// Currently, sandbox directives for workers are not specified +// https://github.com/w3c/webappsec-csp/issues/279 +// and thus this test asserts that the origin of ServiceWorker is not sandboxed. + +// Global setup: this must be the first promise_test. +promise_test(async (t) => { + const registration = + await service_worker_unregister_and_register(t, script, scope); + worker = registration.installing; + await wait_for_state(t, worker, 'activated'); + frame = await with_iframe(scope); + + // Global cleanup: the final promise_test. + promise_test(() => { + if (frame) + frame.remove(); + return registration.unregister(); + }, 'global cleanup'); +}, 'global setup'); + +promise_test(async (t) => { + const r = await frame.contentWindow.fetch('/get-origin', {mode: 'cors'}); + const j = await r.json(); + assert_equals(j.origin, location.origin, 'Origin should not be sandboxed'); +}, 'Origin of service worker'); + +promise_test(async (t) => { + const r = await frame.contentWindow.fetch('/get-origin', + {mode: 'same-origin'}); + const j = await r.json(); + assert_equals(j.origin, location.origin, 'Origin should not be opaque'); +}, 'Response generated by service worker can be fetched as same-origin'); + +// Because the origin of service worker should be `location.origin`, +// fetches from service worker to `location.origin` should be successful. +for (const mode of ['same-origin', 'cors']) { + for (const hasACAOrigin of [true, false]) { + promise_test(async (t) => { + const final_url = new URL('/fetch/api/resources/', location); + final_url.pathname += hasACAOrigin ? 'cors-top.txt' : 'top.txt'; + final_url.searchParams.set('hash', Math.random()); + + const url = new URL('/fetch', location); + url.searchParams.set('url', final_url); + url.searchParams.set('hash', Math.random()); + const r = await frame.contentWindow.fetch(url, {mode}); + const text = await r.text(); + assert_equals(text, 'top'); + }, 'Origin used in fetch on service worker (mode: ' + + mode + + (hasACAOrigin ? ', with ACAOrigin' : '') + + ')'); + } +} +</script> |