diff options
Diffstat (limited to '')
2 files changed, 32 insertions, 0 deletions
diff --git a/testing/web-platform/tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html b/testing/web-platform/tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html new file mode 100644 index 0000000000..ab62f47fb4 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html @@ -0,0 +1,25 @@ +<!DOCTYPE HTML> +<html> +<head> + <title>Test that report-to overrides report-uri. This tests report-uri before report-to in the policy</title> + <script src='/resources/testharness.js'></script> + <script src='/resources/testharnessreport.js'></script> +</head> +<body> + <script> + var t1 = async_test("Test that image does not load"); + async_test(function(t2) { + window.addEventListener("securitypolicyviolation", t2.step_func(function(e) { + assert_equals(e.blockedURI, "{{location[scheme]}}://{{location[host]}}/content-security-policy/support/fail.png"); + assert_equals(e.violatedDirective, "img-src"); + t2.done(); + })); + }, "Event is fired"); + </script> + <img src='/content-security-policy/support/fail.png' + onload='t1.unreached_func("The image should not have loaded");' + onerror='t1.done();'> + <!-- report-to overrides the report-uri so the report goes to a different endpoint and we should not have any reports sent to this endpoint --> + <script async defer src='../support/checkReport.sub.js?reportExists=false'></script> +</body> +</html> diff --git a/testing/web-platform/tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html.sub.headers b/testing/web-platform/tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html.sub.headers new file mode 100644 index 0000000000..dfd3a4ed5a --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html.sub.headers @@ -0,0 +1,7 @@ +Expires: Mon, 26 Jul 1997 05:00:00 GMT +Cache-Control: no-store, no-cache, must-revalidate +Cache-Control: post-check=0, pre-check=0, false +Pragma: no-cache +Set-Cookie: reporting-api-report-to-overrides-report-uri-1={{$id:uuid()}}; Path=/content-security-policy/reporting-api +Content-Security-Policy: script-src 'self' 'unsafe-inline'; img-src 'none'; report-uri "/reporting/resources/report.py?op=put&reportID={{$id}}"; report-to csp-group +Reporting-Endpoints: csp-group="https://{{host}}:{{ports[https][0]}}/reporting/resources/report.py?op=put&reportID={{uuid()}}" |