diff options
Diffstat (limited to 'dom/security/test/https-first/test_referrer_policy.html')
| -rw-r--r-- | dom/security/test/https-first/test_referrer_policy.html | 237 |
1 files changed, 237 insertions, 0 deletions
diff --git a/dom/security/test/https-first/test_referrer_policy.html b/dom/security/test/https-first/test_referrer_policy.html new file mode 100644 index 0000000000..61521e2351 --- /dev/null +++ b/dom/security/test/https-first/test_referrer_policy.html @@ -0,0 +1,237 @@ +<!DOCTYPE HTML> +<html> +<head> +<title>Bug 1716706 : Write referrer-policy tests for https-first </title> +<script src="/tests/SimpleTest/SimpleTest.js"></script> +<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> +</head> +<body> + +<script class="testbody" type="text/javascript"> +"use strict"; +/* + * Description of the test: + * We perform each test with 8 different settings. + * The first is a same origin request from an http site to an https site. + * The second is a same origin request from an https -> https. + * The third is a cross-origin request from an http -> https. + * The fourth is a cross-origin request from an https -> https. + * The fifth is a same origin request from an http -> http site. + * The sixth is a same origin request from an https -> http. + * The seventh is a cross-origin request from an http -> http. + * The last is a cross-origin request from an https -> http. + */ + +SimpleTest.waitForExplicitFinish(); +// This test performs a lot of requests and checks (64 requests). +// So to prevent to get a timeout before executing all test request longer timeout. +SimpleTest.requestLongerTimeout(2); +const SAME_ORIGIN = + "http://example.com/tests/dom/security/test/https-first/file_referrer_policy.sjs?"; +// SAME ORIGIN with "https" instead of "http" +const SAME_ORIGIN_HTTPS = SAME_ORIGIN.replace("http", "https"); + +const CROSS_ORIGIN = + "http://example.org/tests/dom/security/test/https-first/file_referrer_policy.sjs?"; +// CROSS ORIGIN with "https" instead of "http" +const CROSS_ORIGIN_HTTPS = CROSS_ORIGIN.replace("http", "https"); + +// Define test cases. Query equals the test case referrer policy. +// We will set in the final request the url parameters such that 'rp=' equals the referrer policy +//and 'upgrade=' equals '1' if the request should be https. +// For a 'upgrade=0' url parameter the server lead to a timeout such that https-first downgrades +// the request to http. +const testCases = [ + { + query: "no-referrer", + expectedResultSameOriginDownUp: "", + expectedResultSameOriginUpUp: "", + expectedResultCrossOriginDownUp:"", + expectedResultCrossOriginUpUp:"", + expectedResultSameOriginDownDown: "", + expectedResultSameOriginUpDown: "", + expectedResultCrossOriginDownDown:"", + expectedResultCrossOriginUpDown: "", + }, + { + query: "no-referrer-when-downgrade", + expectedResultSameOriginDownUp: SAME_ORIGIN + "rp=no-referrer-when-downgrade&upgrade=http-https", + expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=no-referrer-when-downgrade&upgrade=https-https", + expectedResultCrossOriginDownUp: CROSS_ORIGIN + "rp=no-referrer-when-downgrade&upgrade=http-https", + expectedResultCrossOriginUpUp: CROSS_ORIGIN_HTTPS + "rp=no-referrer-when-downgrade&upgrade=https-https", + expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=no-referrer-when-downgrade&upgrade=http-http", + expectedResultSameOriginUpDown: "", + expectedResultCrossOriginDownDown: CROSS_ORIGIN + "rp=no-referrer-when-downgrade&upgrade=http-http", + expectedResultCrossOriginUpDown:"", + }, + { + query: "origin", + expectedResultSameOriginDownUp: "http://example.com/", + expectedResultSameOriginUpUp: "https://example.com/", + expectedResultCrossOriginDownUp:"http://example.org/", + expectedResultCrossOriginUpUp:"https://example.org/", + expectedResultSameOriginDownDown: "http://example.com/", + expectedResultSameOriginUpDown: "https://example.com/", + expectedResultCrossOriginDownDown:"http://example.org/", + expectedResultCrossOriginUpDown:"https://example.org/", + }, + { + query: "origin-when-cross-origin", + expectedResultSameOriginDownUp: "http://example.com/", + expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=origin-when-cross-origin&upgrade=https-https", + expectedResultCrossOriginDownUp:"http://example.org/", + expectedResultCrossOriginUpUp:"https://example.org/", + expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=origin-when-cross-origin&upgrade=http-http", + expectedResultSameOriginUpDown: "https://example.com/", + expectedResultCrossOriginDownDown:"http://example.org/", + expectedResultCrossOriginUpDown:"https://example.org/", + }, + { + query: "same-origin", + expectedResultSameOriginDownUp: "", + expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=same-origin&upgrade=https-https", + expectedResultCrossOriginDownUp:"", + expectedResultCrossOriginUpUp:"", + expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=same-origin&upgrade=http-http", + expectedResultSameOriginUpDown: "", + expectedResultCrossOriginDownDown: "", + expectedResultCrossOriginUpDown:"", + }, + { + query: "strict-origin", + expectedResultSameOriginDownUp: "http://example.com/", + expectedResultSameOriginUpUp: "https://example.com/", + expectedResultCrossOriginDownUp:"http://example.org/", + expectedResultCrossOriginUpUp:"https://example.org/", + expectedResultSameOriginDownDown: "http://example.com/", + expectedResultSameOriginUpDown: "", + expectedResultCrossOriginDownDown:"http://example.org/", + expectedResultCrossOriginUpDown:"", + }, + { + query: "strict-origin-when-cross-origin", + expectedResultSameOriginDownUp: "http://example.com/", + expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=strict-origin-when-cross-origin&upgrade=https-https", + expectedResultCrossOriginDownUp:"http://example.org/", + expectedResultCrossOriginUpUp:"https://example.org/", + expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=strict-origin-when-cross-origin&upgrade=http-http", + expectedResultSameOriginUpDown: "", + expectedResultCrossOriginDownDown:"http://example.org/", + expectedResultCrossOriginUpDown:"", + }, + { + query: "unsafe-url", + expectedResultSameOriginDownUp: SAME_ORIGIN + "rp=unsafe-url&upgrade=http-https", + expectedResultSameOriginUpUp: SAME_ORIGIN_HTTPS + "rp=unsafe-url&upgrade=https-https", + expectedResultCrossOriginDownUp: CROSS_ORIGIN + "rp=unsafe-url&upgrade=http-https", + expectedResultCrossOriginUpUp: CROSS_ORIGIN_HTTPS + "rp=unsafe-url&upgrade=https-https", + expectedResultSameOriginDownDown: SAME_ORIGIN + "rp=unsafe-url&upgrade=http-http", + expectedResultSameOriginUpDown: SAME_ORIGIN_HTTPS + "rp=unsafe-url&upgrade=https-http", + expectedResultCrossOriginDownDown:CROSS_ORIGIN + "rp=unsafe-url&upgrade=http-http", + expectedResultCrossOriginUpDown:CROSS_ORIGIN_HTTPS + "rp=unsafe-url&upgrade=https-http", + }, +]; + + +let currentTest = 0; +let sameOriginRequest = true; +let testWin; +let currentQuery; +window.addEventListener("message", receiveMessage); +let currentRun = 0; +// All combinations, HTTP -> HTTPS, HTTPS -> HTTPS, HTTP -> HTTP, HTTPS -> HTTP +const ALL_COMB = ["http-https", "https-https" ,"http-http", "https-http"]; + +// Receive message and verify that we receive the expected referrer header +async function receiveMessage(event) { + let data = event.data; + currentQuery = testCases[currentTest].query; + let currentComb = ALL_COMB[currentRun]; + // if request was http -> https + if (currentComb === "http-https") { + if (sameOriginRequest){ + is(data.result, testCases[currentTest].expectedResultSameOriginDownUp , + "We received for the downgraded same site request with referrer policy: " + currentQuery + " the correct referrer"); + is(data.location, SAME_ORIGIN_HTTPS + "sendMe","Opened correct location"); + } else { + is(data.result, testCases[currentTest].expectedResultCrossOriginDownUp , + "We received for the downgraded cross site request with referrer policy: " + currentQuery + " the correct referrer"); + is(data.location, SAME_ORIGIN_HTTPS + "sendMe", "Opened correct location"); + } + // if request was https -> https + } else if (currentComb === "https-https") { + if (sameOriginRequest){ + is(data.result, testCases[currentTest].expectedResultSameOriginUpUp , + "We received for the upgraded same site request with referrer policy: " + currentQuery + " the correct referrer"); + is(data.location, SAME_ORIGIN_HTTPS + "sendMe", "Opened correct location"); + } else { + is(data.result, testCases[currentTest].expectedResultCrossOriginUpUp, + "We received for the upgraded cross site request with referrer policy: " + currentQuery + " the correct referrer"); + is(data.location, SAME_ORIGIN_HTTPS + "sendMe", "Opened correct location"); + } + } else if (currentComb === "http-http") { + if (sameOriginRequest){ + is(data.result, testCases[currentTest].expectedResultSameOriginDownDown , + "We received for the upgraded same site request with referrer policy: " + currentQuery + " the correct referrer"); + is(data.location, SAME_ORIGIN + "sendMe2","Opened correct location for" + currentQuery + currentComb); + } else { + is(data.result, testCases[currentTest].expectedResultCrossOriginDownDown, + "We received for the upgraded cross site request with referrer policy: " + currentQuery + " the correct referrer"); + is(data.location, SAME_ORIGIN + "sendMe2", "Opened correct location " + currentQuery + currentComb); + } + } else if (currentComb === "https-http") { + if (sameOriginRequest){ + is(data.result, testCases[currentTest].expectedResultSameOriginUpDown , + "We received for the upgraded same site request with referrer policy: " + currentQuery + " the correct referrer"); + is(data.location, SAME_ORIGIN + "sendMe2","Opened correct location " + currentQuery + currentComb); + } else { + is(data.result, testCases[currentTest].expectedResultCrossOriginUpDown, + "We received for the upgraded cross site request with referrer policy: " + currentQuery + " the correct referrer"); + is(data.location, SAME_ORIGIN + "sendMe2", "Opened correct location " + currentQuery + currentComb); + } + } + testWin.close(); + currentRun++; + if (currentTest >= testCases.length -1 && currentRun === ALL_COMB.length && !sameOriginRequest) { + window.removeEventListener("message", receiveMessage); + SimpleTest.finish(); + return; + } + runTest(); +} + +async function runTest() { + currentQuery = testCases[currentTest].query; + // send same origin request + if (sameOriginRequest && currentRun < ALL_COMB.length) { + // if upgrade = 0 downgrade request, else upgrade + testWin = window.open(SAME_ORIGIN + "rp=" +currentQuery + "&upgrade=" + ALL_COMB[currentRun], "_blank"); + } else { + // if same origin isn't set, check if we need to send cross origin requests + // eslint-disable-next-line no-lonely-if + if (!sameOriginRequest && currentRun < ALL_COMB.length ) { + // if upgrade = 0 downgrade request, else upgrade + testWin = window.open(CROSS_ORIGIN + "rp=" +currentQuery + "&upgrade=" + ALL_COMB[currentRun], "_blank"); + } // else we completed all test case of the current query for the current origin. Prepare and call next test + else { + // reset currentRun and go to next query + currentRun = 0; + if(!sameOriginRequest){ + currentTest++; + } + // run same test again for crossOrigin or start new test with sameOrigin + sameOriginRequest = !sameOriginRequest; + currentQuery = testCases[currentTest].query; + runTest(); + } + } +} + +SpecialPowers.pushPrefEnv({ set: [ + ["dom.security.https_first", true], + ["network.http.referer.disallowCrossSiteRelaxingDefault", false], + ]}, runTest); + +</script> +</body> +</html> |