summaryrefslogtreecommitdiffstats
path: root/testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html
diff options
context:
space:
mode:
Diffstat (limited to 'testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html')
-rw-r--r--testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html49
1 files changed, 49 insertions, 0 deletions
diff --git a/testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html b/testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html
new file mode 100644
index 0000000000..f2fd01f827
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html
@@ -0,0 +1,49 @@
+<!DOCTYPE html>
+<html>
+
+<head>
+ <!-- Programmatically converted from a WebKit Reftest, please forgive resulting idiosyncracies.-->
+ <meta http-equiv="Content-Security-Policy" content="connect-src 'self'; script-src 'self' 'unsafe-inline'; child-src *;">
+ <title>worker-connect-src-blocked</title>
+ <script src="/resources/testharness.js"></script>
+ <script src="/resources/testharnessreport.js"></script>
+ <script src='../support/logTest.sub.js?logs=["violated-directive=worker-src","TEST COMPLETE"]'></script>
+
+</head>
+<p>This test loads a worker, from a guid.
+ The worker should be blocked from loading with a child-src policy of *
+ as the blob: scheme must be specified explicitly.
+ A report should be sent to the report-uri specified
+ with this resource.</p>
+<body>
+ <script>
+ window.addEventListener('securitypolicyviolation', function(e) {
+ log("violated-directive=" + e.violatedDirective);
+ });
+
+ try {
+ var blob = new Blob([
+ "postMessage('FAIL');" +
+ "postMessage('TEST COMPLETE');"
+ ],
+ {type : 'application/javascript'});
+ var url = URL.createObjectURL(blob);
+ var worker = new Worker(url);
+ worker.onmessage = function(event) {
+ log(event.data);
+ };
+ worker.onerror = function(event) {
+ event.preventDefault();
+ log('TEST COMPLETE');
+ }
+ } catch (e) {
+ log('TEST COMPLETE');
+ }
+ function timeout() {
+ log('TEST COMPLETE');
+ }
+ </script>
+ <div id="log"></div>
+</body>
+
+</html>