1 files changed, 78 insertions, 0 deletions
diff --git a/testing/web-platform/meta/worklets/paint-worklet-csp.https.html.ini b/testing/web-platform/meta/worklets/paint-worklet-csp.https.html.ini
new file mode 100644
index 0000000000..37bdf838c4
--- /dev/null
+++ b/testing/web-platform/meta/worklets/paint-worklet-csp.https.html.ini
@@ -0,0 +1,78 @@
+[paint-worklet-csp.https.html]
+  expected:
+    if (os == "linux") and not fission and not debug: [OK, TIMEOUT]
+    if (os == "mac") and not debug: [OK, TIMEOUT]
+    if (os == "android") and fission: [OK, TIMEOUT]
+  [A same-origin worklet importing a remote-origin-redirected script should not be blocked by the worker-src directive because worklets obey the script-src directive.]
+    expected: FAIL
+
+  [A remote-origin worklet should not be blocked by the worker-src directive because worklets obey the script-src directive.]
+    expected: FAIL
+
+  [A remote-origin worklet importing a remote-origin script should be blocked by the script-src 'self' directive.]
+    expected: FAIL
+
+  [A remote-origin-redirected worklet should not be blocked because the script-src * directive allows it.]
+    expected: FAIL
+
+  [A same-origin worklet importing an insecure-origin-redirected script should be blocked because of mixed contents.]
+    expected:
+      if (os == "linux") and not fission and not debug: [FAIL, TIMEOUT]
+      FAIL
+
+  [An insecure-origin-redirected worklet should be blocked because of mixed contents.]
+    expected: FAIL
+
+  [A same-origin worklet importing a remote-origin script should be blocked by the script-src 'self' directive.]
+    expected: FAIL
+
+  [A same-origin worklet importing a remote-origin script should not be blocked by the worker-src directive because worklets obey the script-src directive.]
+    expected: FAIL
+
+  [A remote-origin worklet importing a remote-origin script should not be blocked because the script-src * directive allows it.]
+    expected: FAIL
+
+  [A same-origin worklet importing a remote-origin-redirected script should be blocked by the script-src 'self' directive.]
+    expected: FAIL
+
+  [A remote-origin-redirected worklet should be blocked by the script-src 'self' directive.]
+    expected: FAIL
+
+  [A remote-origin worklet importing a remote-origin script should not be blocked by the worker-src directive because worklets obey the script-src directive.]
+    expected: FAIL
+
+  [A same-origin worklet importing a remote-origin script should not be blocked because the script-src * directive allows it.]
+    expected: FAIL
+
+  [A same-origin worklet importing an insecure-origin script should be blocked because of mixed contents.]
+    expected: FAIL
+
+  [An insecure-origin worklet should be blocked because of mixed contents.]
+    expected: FAIL
+
+  [A remote-origin worklet should be blocked by the script-src 'self' directive.]
+    expected: FAIL
+
+  [A remote-origin worklet should not be blocked because the script-src * directive allows it.]
+    expected: FAIL
+
+  [A same-origin worklet importing a remote-origin-redirected script should not be blocked because the script-src * directive allows it.]
+    expected: FAIL
+
+  [A remote-origin-redirected worklet should not be blocked by the worker-src directive because worklets obey the script-src directive.]
+    expected: FAIL
+
+  [A remote-origin worklet should not be blocked because the script-src directive specifying the origin allows it.]
+    expected: FAIL
+
+  [A same-origin worklet importing a remote-origin script should not be blocked because the script-src directive specifying the origin allows it.]
+    expected: FAIL
+
+  [A remote-origin-redirected worklet should not be blocked because the script-src directive specifying the origin allows it.]
+    expected: FAIL
+
+  [A same-origin worklet importing a remote-origin-redirected script should not be blocked because the script-src directive specifying the origin allows it.]
+    expected: FAIL
+
+  [A remote-origin worklet importing a remote-origin script should not be blocked because the script-src directive specifying the origin allows it.]
+    expected: FAIL