From 43a97878ce14b72f0981164f87f2e35e14151312 Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 11:22:09 +0200 Subject: Adding upstream version 110.0.1. Signed-off-by: Daniel Baumann --- ...ild-src-about-blank-allowed-by-default.sub.html | 29 ++++++++++ ...hild-src-about-blank-allowed-by-scheme.sub.html | 25 +++++++++ .../child-src/child-src-allowed.sub.html | 64 +++++++++++++++++++++ .../child-src/child-src-blocked.sub.html | 62 +++++++++++++++++++++ .../child-src-conflicting-frame-src.sub.html | 65 ++++++++++++++++++++++ .../child-src/child-src-cross-origin-load.sub.html | 42 ++++++++++++++ .../child-src/child-src-redirect-blocked.sub.html | 65 ++++++++++++++++++++++ .../child-src/child-src-worker-allowed.sub.html | 38 +++++++++++++ .../child-src/child-src-worker-blocked.sub.html | 44 +++++++++++++++ 9 files changed, 434 insertions(+) create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-redirect-blocked.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html (limited to 'testing/web-platform/tests/content-security-policy/child-src') diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html new file mode 100644 index 0000000000..c546a7a27f --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-default.sub.html @@ -0,0 +1,29 @@ + + + + + + + child-src-about-blank-allowed-by-default + + +

These frames should not be blocked by Content-Security-Policy. + It's pointless to block about:blank iframes because + blocking a frame just results in displaying about:blank anyway! +

+ + + + + +
+ + + + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html new file mode 100644 index 0000000000..2de5484c0f --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-about-blank-allowed-by-scheme.sub.html @@ -0,0 +1,25 @@ + + + + + + + child-src-about-blank-allowed-by-scheme + + +

This frame should not be blocked by Content-Security-Policy. +

+ + + +
+ + + + + \ No newline at end of file diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html new file mode 100644 index 0000000000..3d4964e24b --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-allowed.sub.html @@ -0,0 +1,64 @@ + + + + + child-src-allowed + + + + + +

+ This iframe should be allowed. +

+ + + + + +
+ + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html new file mode 100644 index 0000000000..9141aeba46 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-blocked.sub.html @@ -0,0 +1,62 @@ + + + + + + + child-src-blocked + + + + +

+ IFrames blocked by CSP should generate a 'load', not 'error' event, regardless of blocked state. This means they appear to be normal cross-origin loads, thereby not leaking URL information directly to JS. +

+ + + + + +
+ + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html new file mode 100644 index 0000000000..7f6f9294fa --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-conflicting-frame-src.sub.html @@ -0,0 +1,65 @@ + + + + child-src-blocked + + + + + + +

+ A more permissive child-src should not relax restrictions from a less- + permissive frame-src. Directives still combine for least privilege, even when + one obsoletes another. +

+ + + + + +
+ + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html new file mode 100644 index 0000000000..192f69b854 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-cross-origin-load.sub.html @@ -0,0 +1,42 @@ + + + + + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-redirect-blocked.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-redirect-blocked.sub.html new file mode 100644 index 0000000000..d73284e20a --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-redirect-blocked.sub.html @@ -0,0 +1,65 @@ + + + + + + + child-src-blocked + + + + + +

+ IFrames blocked by CSP should generate a 'load', not 'error' event, regardless of blocked state. This means they appear to be normal cross-origin loads, thereby not leaking URL information directly to JS. +

+ + + + + +
+ + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html new file mode 100644 index 0000000000..d02abaef19 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-allowed.sub.html @@ -0,0 +1,38 @@ + + + + + child-src-worker-allowed + + + + + + +

This test used to check the child-src csp controlling worker creation. This behaviour has been deprecated but it's still supported + until the transition is done. This still tests that behaviour but we need to go through extra hoops to make sure 'script-src' + does not affect the result in any way (for instance by allowing 'self'). +

+ +
+ + + diff --git a/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html new file mode 100644 index 0000000000..675cd95ea4 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/child-src/child-src-worker-blocked.sub.html @@ -0,0 +1,44 @@ + + + + + child-src-worker-blocked + + + + + + +

This test used to check the child-src csp controlling worker creation. This behaviour has been deprecated but it's still supported + until the transition is done. This still tests that behaviour but we need to go through extra hoops to make sure 'script-src' + does not affect the result in any way (for instance by allowing 'self'). +

+ +
+ + -- cgit v1.2.3