From 6bf0a5cb5034a7e684dcc3500e841785237ce2dd Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 19:32:43 +0200 Subject: Adding upstream version 1:115.7.0. Signed-off-by: Daniel Baumann --- .../blob/blob-urls-do-not-match-self.sub.html | 36 ++++++++++++++++ .../blob/blob-urls-match-blob.sub.html | 37 ++++++++++++++++ .../blob/self-doesnt-match-blob.sub.html | 49 ++++++++++++++++++++++ .../blob/star-doesnt-match-blob.sub.html | 49 ++++++++++++++++++++++ 4 files changed, 171 insertions(+) create mode 100644 testing/web-platform/tests/content-security-policy/blob/blob-urls-do-not-match-self.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/blob/blob-urls-match-blob.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/blob/self-doesnt-match-blob.sub.html create mode 100644 testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html (limited to 'testing/web-platform/tests/content-security-policy/blob') diff --git a/testing/web-platform/tests/content-security-policy/blob/blob-urls-do-not-match-self.sub.html b/testing/web-platform/tests/content-security-policy/blob/blob-urls-do-not-match-self.sub.html new file mode 100644 index 0000000000..cafa1e3660 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/blob/blob-urls-do-not-match-self.sub.html @@ -0,0 +1,36 @@ + + + + + + + blob-urls-do-not-match-self + + + + + + + +

+ blob: URLs are same-origin with the page in which they were created, but explicitly do not match the 'self' or '*' source in CSP directives because they are more akin to 'unsafe-inline' content. +

+ +
+ + + diff --git a/testing/web-platform/tests/content-security-policy/blob/blob-urls-match-blob.sub.html b/testing/web-platform/tests/content-security-policy/blob/blob-urls-match-blob.sub.html new file mode 100644 index 0000000000..2b8db3a99f --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/blob/blob-urls-match-blob.sub.html @@ -0,0 +1,37 @@ + + + + + + + blob-urls-match-blob + + + + + + + +

+ blob: URLs are same-origin with the page in which they were created, but match only if the blob: scheme is specified. +

+ +
+ + + diff --git a/testing/web-platform/tests/content-security-policy/blob/self-doesnt-match-blob.sub.html b/testing/web-platform/tests/content-security-policy/blob/self-doesnt-match-blob.sub.html new file mode 100644 index 0000000000..c7002aba19 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/blob/self-doesnt-match-blob.sub.html @@ -0,0 +1,49 @@ + + + + + + + worker-connect-src-blocked + + + + + +

This test loads a worker, from a guid. + The worker should be blocked from loading with a child-src policy of 'self' + as the blob: scheme must be specified explicitly. + A report should be sent to the report-uri specified + with this resource.

+ + +
+ + + diff --git a/testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html b/testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html new file mode 100644 index 0000000000..f2fd01f827 --- /dev/null +++ b/testing/web-platform/tests/content-security-policy/blob/star-doesnt-match-blob.sub.html @@ -0,0 +1,49 @@ + + + + + + + worker-connect-src-blocked + + + + + +

This test loads a worker, from a guid. + The worker should be blocked from loading with a child-src policy of * + as the blob: scheme must be specified explicitly. + A report should be sent to the report-uri specified + with this resource.

+ + +
+ + + -- cgit v1.2.3