diff options
| author | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
|---|---|---|
| committer | Daniel Baumann <daniel.baumann@progress-linux.org> | 2024-04-07 09:22:09 +0000 |
| commit | 43a97878ce14b72f0981164f87f2e35e14151312 (patch) | |
| tree | 620249daf56c0258faa40cbdcf9cfba06de2a846 /testing/web-platform/tests/preload/preload-strict-dynamic.sub.html | |
| parent | Initial commit. (diff) | |
| download | firefox-43a97878ce14b72f0981164f87f2e35e14151312.tar.xz firefox-43a97878ce14b72f0981164f87f2e35e14151312.zip | |
Adding upstream version 110.0.1.upstream/110.0.1upstream
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'testing/web-platform/tests/preload/preload-strict-dynamic.sub.html')
| -rw-r--r-- | testing/web-platform/tests/preload/preload-strict-dynamic.sub.html | 88 |
1 files changed, 88 insertions, 0 deletions
diff --git a/testing/web-platform/tests/preload/preload-strict-dynamic.sub.html b/testing/web-platform/tests/preload/preload-strict-dynamic.sub.html new file mode 100644 index 0000000000..bdd7a1746b --- /dev/null +++ b/testing/web-platform/tests/preload/preload-strict-dynamic.sub.html @@ -0,0 +1,88 @@ +<!DOCTYPE html> +<head> +<script src="/resources/testharness.js" nonce="123"></script> +<script src="/resources/testharnessreport.js" nonce="123"></script> +<script src="/common/utils.js" nonce="123"></script> +<script src="/preload/resources/preload_helper.js" nonce="123"></script> +<title>CSP strict-dynamic + preload</title> +<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-123' 'strict-dynamic'" /> +</head> +<body> +<script nonce="123"> +const PATTERN = /\?key=([a-zA-Z0-9\-]+)$/; + +// We use async_test instead of promise_test in this file because these +// tests take long time to run and we want to run them in parallel. +async_test((t) => { + Promise.resolve().then(async () => { + let sawViolation = false; + self.addEventListener('securitypolicyviolation', (e) => { + const link = document.querySelector('#static-no-nonce'); + if (e.violatedDirective == 'script-src-elem' && e.blockedURI === link.href) { + sawViolation = true; + } + }); + + await new Promise((resolve) => step_timeout(resolve, 3000)); + + const link = document.querySelector('#static-no-nonce'); + const key = link.href.match(PATTERN)[1] + + assert_true(sawViolation, 'sawViolation'); + assert_false(await hasArrivedAtServer(key), 'hasArrivedAtServer'); + t.done(); + }).catch(t.step_func((e) => { + throw e; + })); +}, 'static-no-nonce'); + +async_test((t) => { + Promise.resolve().then(async () => { + let sawViolation = false; + self.addEventListener('securitypolicyviolation', (e) => { + const link = document.querySelector('#static-nonce'); + if (e.violatedDirective == 'script-src-elem' && e.blockedURI === link.href) { + sawViolation = true; + } + }); + + // TODO: Use step_wait after + // https://github.com/web-platform-tests/wpt/pull/34289 is merged. + await new Promise((resolve) => step_timeout(resolve, 3000)); + + const link = document.querySelector('#static-nonce'); + const key = link.href.match(PATTERN)[1] + + assert_false(sawViolation, 'sawViolation'); + assert_true(await hasArrivedAtServer(key), 'hasArrivedAtServer'); + t.done(); + }).catch(t.step_func((e) => { + throw e; + })); +}, 'static-nonce'); + +async_test((t) => { + Promise.resolve().then(async () => { + const link = document.createElement('link'); + link.rel = 'preload'; + const id = token(); + link.href = `/preload/resources/stash-put.py?key=${id}`; + link.as = 'script'; + + document.head.appendChild(link); + await new Promise((resolve, reject) => { + link.addEventListener('load', resolve, {once: true}); + link.addEventListener('error', resolve, {once: true}); + }); + assert_true(await hasArrivedAtServer(id), 'hasArrivedAtServer'); + t.done(); + }).catch(t.step_func((e) => { + throw e; + })); +}, 'dynamic'); +</script> + +<link id="static-no-nonce" href="/preload/resources/stash-put.py?key={{uuid()}}" rel=preload as=script> +<link id="static-nonce" href="/preload/resources/stash-put.py?key={{uuid()}}" rel=preload as=script nonce="123"> +</body> +</html> |