1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
|
<!DOCTYPE HTML>
<html>
<head>
<title>Bug 1194052 - Append Principal to RedirectChain within LoadInfo before the channel is succesfully openend</title>
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
<script src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="testframe"></iframe>
<script class="testbody" type="text/javascript">
/*
* We perform the following tests on the redirectchain of the loadinfo:
* (1) checkLoadInfoWithoutRedirects:
* checks the length of the redirectchain and tries to pop an element
* which should result in an exception and not a crash.
* (2) checkLoadInfoWithTwoRedirects:
* perform two redirects and confirm that both redirect chains
* contain the redirected URIs.
* (3) checkLoadInfoWithInternalRedirects:
* perform two redirects including CSPs upgrade-insecure-requests
* so that the redirectchain which includes internal redirects differs.
* (4) checkLoadInfoWithInternalRedirectsAndFallback
* perform two redirects including CSPs upgrade-insecure-requests
* including a 404 repsonse and hence a fallback.
* (5) checkHTTPURITruncation
* perform a redirect to a URI with an HTTP scheme to check that unwanted
* URI components are removed before being added to the redirectchain.
* (6) checkHTTPSURITruncation
* perform a redirect to a URI with an HTTPS scheme to check that unwanted
* URI components are removed before being added to the redirectchain.
*/
SimpleTest.waitForExplicitFinish();
// ************** HELPERS ***************
function compareChains(aLoadInfo, aExpectedRedirectChain, aExpectedRedirectChainIncludingInternalRedirects) {
var redirectChain = aLoadInfo.redirectChain;
var redirectChainIncludingInternalRedirects = aLoadInfo.redirectChainIncludingInternalRedirects;
is(redirectChain.length,
aExpectedRedirectChain.length,
"confirming length of redirectChain is " + aExpectedRedirectChain.length);
is(redirectChainIncludingInternalRedirects.length,
aExpectedRedirectChainIncludingInternalRedirects.length,
"confirming length of redirectChainIncludingInternalRedirects is " +
aExpectedRedirectChainIncludingInternalRedirects.length);
}
function compareTruncatedChains(redirectChain, aExpectedRedirectChain) {
is(redirectChain.length,
aExpectedRedirectChain.length,
"confirming length of redirectChain is " + aExpectedRedirectChain.length);
for (var i = 0; i < redirectChain.length; i++) {
is(redirectChain[i],
aExpectedRedirectChain[i],
"redirect chain should match expected chain");
}
}
// *************** TEST 1 ***************
function checkLoadInfoWithoutRedirects() {
var myXHR = new XMLHttpRequest();
myXHR.open("GET", "http://mochi.test:8888/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-0");
myXHR.onload = function() {
var loadinfo = SpecialPowers.wrap(myXHR).channel.loadInfo;
var redirectChain = loadinfo.redirectChain;
var redirectChainIncludingInternalRedirects = loadinfo.redirectChainIncludingInternalRedirects;
is(redirectChain.length, 0, "no redirect, length should be 0");
is(redirectChainIncludingInternalRedirects.length, 0, "no redirect, length should be 0");
is(myXHR.responseText, "checking redirectchain", "sanity check to make sure redirects succeeded");
// try to pop an element from redirectChain
try {
loadinfo.popRedirectedPrincipal(false);
ok(false, "should not be possible to pop from redirectChain");
}
catch(e) {
ok(true, "popping element from empty redirectChain should throw");
}
// try to pop an element from redirectChainIncludingInternalRedirects
try {
loadinfo.popRedirectedPrincipal(true);
ok(false, "should not be possible to pop from redirectChainIncludingInternalRedirects");
}
catch(e) {
ok(true, "popping element from empty redirectChainIncludingInternalRedirects should throw");
}
// move on to the next test
checkLoadInfoWithTwoRedirects();
}
myXHR.onerror = function() {
ok(false, "xhr problem within checkLoadInfoWithoutRedirect()");
}
myXHR.send();
}
// *************** TEST 2 ***************
function checkLoadInfoWithTwoRedirects() {
var myXHR = new XMLHttpRequest();
myXHR.open("GET", "http://mochi.test:8888/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-2");
const EXPECTED_REDIRECT_CHAIN = [
"http://mochi.test:8888/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs",
"http://mochi.test:8888/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs"
];
const EXPECTED_REDIRECT_CHAIN_INCLUDING_INTERNAL_REDIRECTS = EXPECTED_REDIRECT_CHAIN;
// Referrer header will not change when redirect
const EXPECTED_REFERRER =
"http://mochi.test:8888/tests/netwerk/test/mochitests/test_loadinfo_redirectchain.html";
const isAndroid = !!navigator.userAgent.includes("Android");
const EXPECTED_REMOTE_IP = isAndroid ? "10.0.2.2" : "127.0.0.1";
myXHR.onload = function() {
is(myXHR.responseText, "checking redirectchain", "sanity check to make sure redirects succeeded");
var loadinfo = SpecialPowers.wrap(myXHR).channel.loadInfo;
compareChains(loadinfo, EXPECTED_REDIRECT_CHAIN, EXPECTED_REDIRECT_CHAIN_INCLUDING_INTERNAL_REDIRECTS);
for (var i = 0; i < loadinfo.redirectChain.length; i++) {
is(loadinfo.redirectChain[i].referrerURI.spec, EXPECTED_REFERRER, "referrer should match");
is(loadinfo.redirectChain[i].remoteAddress, EXPECTED_REMOTE_IP, "remote address should match");
}
// move on to the next test
checkLoadInfoWithInternalRedirects();
}
myXHR.onerror = function() {
ok(false, "xhr problem within checkLoadInfoWithTwoRedirects()");
}
myXHR.send();
}
// *************** TEST 3 ***************
function confirmCheckLoadInfoWithInternalRedirects(event) {
const EXPECTED_REDIRECT_CHAIN = [
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-https-2",
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-https-1"
];
const EXPECTED_REDIRECT_CHAIN_INCLUDING_INTERNAL_REDIRECTS = [
"http://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-https-2",
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-https-2",
"http://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-https-1",
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-https-1",
"http://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-https-0",
];
var loadinfo = JSON.parse(event.data.loadinfo);
compareChains(loadinfo, EXPECTED_REDIRECT_CHAIN, EXPECTED_REDIRECT_CHAIN_INCLUDING_INTERNAL_REDIRECTS);
// remove the postMessage listener and move on to the next test
window.removeEventListener("message", confirmCheckLoadInfoWithInternalRedirects);
checkLoadInfoWithInternalRedirectsAndFallback();
}
function checkLoadInfoWithInternalRedirects() {
// load the XHR request into an iframe so we can apply a CSP to the iframe
// a postMessage returns the result back to the main page.
window.addEventListener("message", confirmCheckLoadInfoWithInternalRedirects);
document.getElementById("testframe").src =
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?iframe-redir-https-2";
}
// *************** TEST 4 ***************
function confirmCheckLoadInfoWithInternalRedirectsAndFallback(event) {
var EXPECTED_REDIRECT_CHAIN = [
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-err-2",
];
var EXPECTED_REDIRECT_CHAIN_INCLUDING_INTERNAL_REDIRECTS = [
"http://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-err-2",
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-err-2",
"http://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-err-1",
];
var loadinfo = JSON.parse(event.data.loadinfo);
compareChains(loadinfo, EXPECTED_REDIRECT_CHAIN, EXPECTED_REDIRECT_CHAIN_INCLUDING_INTERNAL_REDIRECTS);
// remove the postMessage listener and finish test
window.removeEventListener("message", confirmCheckLoadInfoWithInternalRedirectsAndFallback);
checkHTTPURITruncation();
}
function checkLoadInfoWithInternalRedirectsAndFallback() {
// load the XHR request into an iframe so we can apply a CSP to the iframe
// a postMessage returns the result back to the main page.
window.addEventListener("message", confirmCheckLoadInfoWithInternalRedirectsAndFallback);
document.getElementById("testframe").src =
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?iframe-redir-err-2";
}
// *************** TEST 5 ***************
function checkHTTPURITruncation() {
var myXHR = new XMLHttpRequest();
myXHR.open("GET", "http://root:toor@mochi.test:8888/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?redir-1#baz");
const EXPECTED_REDIRECT_CHAIN = [
"http://mochi.test:8888/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs", // redir-1
];
var loadinfo = SpecialPowers.wrap(myXHR).channel.loadInfo;
myXHR.onload = function() {
var redirectChain = [];
for (var i = 0; i < loadinfo.redirectChain.length; i++) {
redirectChain[i] = loadinfo.redirectChain[i].principal.asciiSpec;
}
compareTruncatedChains(redirectChain, EXPECTED_REDIRECT_CHAIN);
// move on to the next test
checkHTTPSURITruncation();
}
myXHR.onerror = function(e) {
ok(false, "xhr problem within checkHTTPURITruncation()" + e);
}
myXHR.send();
}
// *************** TEST 6 ***************
function confirmCheckHTTPSURITruncation(event) {
const EXPECTED_REDIRECT_CHAIN = [
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs", // redir-https-2
"https://example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs", // redir-https-1
];
var loadinfo = JSON.parse(event.data.loadinfo);
compareTruncatedChains(loadinfo.redirectChain, EXPECTED_REDIRECT_CHAIN);
// remove the postMessage listener and move on to the next test
window.removeEventListener("message", confirmCheckHTTPSURITruncation);
SimpleTest.finish();
}
function checkHTTPSURITruncation() {
// load the XHR request into an iframe so we can apply a CSP to the iframe
// a postMessage returns the result back to the main page.
window.addEventListener("message", confirmCheckHTTPSURITruncation);
document.getElementById("testframe").src =
"https://root:toor@example.com/tests/netwerk/test/mochitests/file_loadinfo_redirectchain.sjs?iframe-redir-https-2#baz";
}
// *************** START TESTS ***************
checkLoadInfoWithoutRedirects();
</script>
</body>
</html>
|
