blob: 003c9df57cc394b4a620a5a3c836398110287c91 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
|
// custom *.sjs for Bug 1122236
// CSP: 'block-all-mixed-content'
const HEAD =
"<!DOCTYPE HTML>" +
'<html><head><meta charset="utf-8">' +
"<title>Bug 1122236 - CSP: Implement block-all-mixed-content</title>" +
"</head>";
const CSP_ALLOW =
'<meta http-equiv="Content-Security-Policy" content="img-src *">';
const CSP_BLOCK =
'<meta http-equiv="Content-Security-Policy" content="block-all-mixed-content">';
const BODY =
"<body>" +
'<img id="testimage" src="http://mochi.test:8888/tests/image/test/mochitest/blue.png"></img>' +
'<script type="application/javascript">' +
' var myImg = document.getElementById("testimage");' +
" myImg.onload = function(e) {" +
' window.parent.postMessage({result: "img-loaded"}, "*");' +
" };" +
" myImg.onerror = function(e) {" +
' window.parent.postMessage({result: "img-blocked"}, "*");' +
" };" +
"</script>" +
"</body>" +
"</html>";
// We have to use this special code fragment, in particular '?nocache' to trigger an
// actual network load rather than loading the image from the cache.
const BODY_CSPRO =
"<body>" +
'<img id="testimage" src="http://mochi.test:8888/tests/image/test/mochitest/blue.png?nocache"></img>' +
'<script type="application/javascript">' +
' var myImg = document.getElementById("testimage");' +
" myImg.onload = function(e) {" +
' window.parent.postMessage({result: "img-loaded"}, "*");' +
" };" +
" myImg.onerror = function(e) {" +
' window.parent.postMessage({result: "img-blocked"}, "*");' +
" };" +
"</script>" +
"</body>" +
"</html>";
function handleRequest(request, response) {
// avoid confusing cache behaviors
response.setHeader("Cache-Control", "no-cache", false);
var queryString = request.queryString;
if (queryString === "csp-block") {
response.write(HEAD + CSP_BLOCK + BODY);
return;
}
if (queryString === "csp-allow") {
response.write(HEAD + CSP_ALLOW + BODY);
return;
}
if (queryString === "no-csp") {
response.write(HEAD + BODY);
return;
}
if (queryString === "cspro-block") {
// CSP RO is not supported in meta tag, let's use the header
response.setHeader(
"Content-Security-Policy-Report-Only",
"block-all-mixed-content",
false
);
response.write(HEAD + BODY_CSPRO);
return;
}
// we should never get here but just in case return something unexpected
response.write("do'h");
}
|
