From 6bf0a5cb5034a7e684dcc3500e841785237ce2dd Mon Sep 17 00:00:00 2001 From: Daniel Baumann Date: Sun, 7 Apr 2024 19:32:43 +0200 Subject: Adding upstream version 1:115.7.0. Signed-off-by: Daniel Baumann --- .../web-platform/tests/secure-contexts/META.yml | 3 + .../secure-contexts/basic-dedicated-worker.html | 104 +++++++ .../basic-dedicated-worker.https.html | 104 +++++++ .../basic-popup-and-iframe-tests.html | 25 ++ .../basic-popup-and-iframe-tests.https.html | 16 ++ .../basic-popup-and-iframe-tests.https.js | 299 +++++++++++++++++++++ .../tests/secure-contexts/basic-shared-worker.html | 84 ++++++ .../secure-contexts/basic-shared-worker.https.html | 82 ++++++ .../tests/secure-contexts/postMessage-helper.html | 1 + .../secure-contexts/postMessage-helper.https.html | 1 + .../tests/secure-contexts/server-locations.sub.js | 17 ++ .../shared-worker-insecure-first.https.html | 111 ++++++++ .../shared-worker-secure-first.https.html | 111 ++++++++ .../support/dedicated-worker-script.js | 1 + .../support/https-subframe-dedicated.html | 33 +++ .../support/https-subframe-shared.html | 32 +++ .../support/parent-dedicated-worker-script.js | 9 + .../support/parent-shared-worker-script.js | 13 + .../support/shared-worker-insecure-popup.html | 15 ++ .../support/shared-worker-script.js | 5 + 20 files changed, 1066 insertions(+) create mode 100644 testing/web-platform/tests/secure-contexts/META.yml create mode 100644 testing/web-platform/tests/secure-contexts/basic-dedicated-worker.html create mode 100644 testing/web-platform/tests/secure-contexts/basic-dedicated-worker.https.html create mode 100644 testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.html create mode 100644 testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.https.html create mode 100644 testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.https.js create mode 100644 testing/web-platform/tests/secure-contexts/basic-shared-worker.html create mode 100644 testing/web-platform/tests/secure-contexts/basic-shared-worker.https.html create mode 100644 testing/web-platform/tests/secure-contexts/postMessage-helper.html create mode 100644 testing/web-platform/tests/secure-contexts/postMessage-helper.https.html create mode 100644 testing/web-platform/tests/secure-contexts/server-locations.sub.js create mode 100644 testing/web-platform/tests/secure-contexts/shared-worker-insecure-first.https.html create mode 100644 testing/web-platform/tests/secure-contexts/shared-worker-secure-first.https.html create mode 100644 testing/web-platform/tests/secure-contexts/support/dedicated-worker-script.js create mode 100644 testing/web-platform/tests/secure-contexts/support/https-subframe-dedicated.html create mode 100644 testing/web-platform/tests/secure-contexts/support/https-subframe-shared.html create mode 100644 testing/web-platform/tests/secure-contexts/support/parent-dedicated-worker-script.js create mode 100644 testing/web-platform/tests/secure-contexts/support/parent-shared-worker-script.js create mode 100644 testing/web-platform/tests/secure-contexts/support/shared-worker-insecure-popup.html create mode 100644 testing/web-platform/tests/secure-contexts/support/shared-worker-script.js (limited to 'testing/web-platform/tests/secure-contexts') diff --git a/testing/web-platform/tests/secure-contexts/META.yml b/testing/web-platform/tests/secure-contexts/META.yml new file mode 100644 index 0000000000..e653716628 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/META.yml @@ -0,0 +1,3 @@ +spec: https://w3c.github.io/webappsec-secure-contexts/ +suggested_reviewers: + - mikewest diff --git a/testing/web-platform/tests/secure-contexts/basic-dedicated-worker.html b/testing/web-platform/tests/secure-contexts/basic-dedicated-worker.html new file mode 100644 index 0000000000..043b5b8dd6 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/basic-dedicated-worker.html @@ -0,0 +1,104 @@ + + + + + Test WorkerGlobalScope.isSecureContext for HTTP creator + + + + + + + + + + diff --git a/testing/web-platform/tests/secure-contexts/basic-dedicated-worker.https.html b/testing/web-platform/tests/secure-contexts/basic-dedicated-worker.https.html new file mode 100644 index 0000000000..17c9345146 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/basic-dedicated-worker.https.html @@ -0,0 +1,104 @@ + + + + + Test WorkerGlobalScope.isSecureContext for HTTPS creator + + + + + + + + + + diff --git a/testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.html b/testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.html new file mode 100644 index 0000000000..ab3c443678 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.html @@ -0,0 +1,25 @@ + + + + + Test Window.isSecureContext for HTTP creator + + + + + + + + + + + diff --git a/testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.https.html b/testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.https.html new file mode 100644 index 0000000000..a9c7f3c883 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.https.html @@ -0,0 +1,16 @@ + + + + + Test Window.isSecureContext for HTTPS creator + + + + + + + + + + + diff --git a/testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.https.js b/testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.https.js new file mode 100644 index 0000000000..661595c4d9 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/basic-popup-and-iframe-tests.https.js @@ -0,0 +1,299 @@ + +/** + * This test checks the Secure Context state of documents for various + * permutations of document URI types and loading methods. + * + * The hierarchy that is tested is: + * + * creator-doc > createe-doc + * + * The creator-doc is one of: + * + * http: + * https: + * + * The createe-doc is loaded as either a: + * + * popup + * iframe + * sandboxed-iframe + * + * into which we load and test: + * + * http: + * https: + * blob: + * javascript: + * about:blank + * initial about:blank + * srcdoc + * + * TODO once web-platform-tests supports it: + * - test http://localhost + * - test file: + */ + + +setup({explicit_done:true}); + + +const host_and_dirname = location.host + + location.pathname.substr(0, location.pathname.lastIndexOf("/") + 1); + + +// Flags to indicate where document types should be loaded for testing: +const eLoadInPopup = (1 << 0); +const eLoadInUnsandboxedIframe = (1 << 1); +const eLoadInSandboxedIframe = (1 << 2); +const eLoadInEverything = eLoadInPopup | eLoadInUnsandboxedIframe | eLoadInSandboxedIframe; + +// Flags indicating if a document type is expected to be a Secure Context: +const eSecureNo = 1; +const eSecureIfNewWindow = 2; +const eSecureIfCreatorSecure = 3; + +// Flags indicating how the result of a test is obtained: +const eResultFromPostMessage = 1; +const eResultFromExaminationOnLoad = 2; +const eResultFromExaminationSync = 3; + + +const loadTypes = [ + new LoadType("an http: URI", + eLoadInEverything, + http_dir + "postMessage-helper.html", + eSecureNo, + eResultFromPostMessage), + new LoadType("an https: URI", + eLoadInEverything, + https_dir + "postMessage-helper.https.html", + eSecureIfNewWindow, + eResultFromPostMessage), + new LoadType("a blob: URI", + eLoadInEverything, + URL.createObjectURL(new Blob([""], {type: "text/html"})), + eSecureIfCreatorSecure, + eResultFromPostMessage), + new LoadType("a srcdoc", + // popup not relevant: + eLoadInUnsandboxedIframe | eLoadInSandboxedIframe, + "", + eSecureIfNewWindow, + eResultFromPostMessage), + new LoadType("a javascript: URI", + // can't load in sandbox: + eLoadInUnsandboxedIframe | eLoadInPopup, + "javascript:(opener||parent).postMessage(isSecureContext, '*')", + eSecureIfCreatorSecure, + eResultFromPostMessage), + new LoadType("about:blank", + // can't obtain state if sandboxed: + eLoadInUnsandboxedIframe | eLoadInPopup, + "about:blank", + eSecureIfCreatorSecure, + eResultFromExaminationOnLoad), + new LoadType("initial about:blank", + // can't obtain state if sandboxed: + eLoadInUnsandboxedIframe | eLoadInPopup, + "about:blank", // we don't wait for this to load, so whatever + eSecureIfCreatorSecure, + eResultFromExaminationSync), + new LoadType("a data: URL", + // can't load in a top-level browsing context + eLoadInUnsandboxedIframe | eLoadInSandboxedIframe, + "data:text/html,", + eSecureIfCreatorSecure, + eResultFromPostMessage), +]; + +const loadTargets = [ + new LoadTarget("an iframe", eLoadInUnsandboxedIframe), + new LoadTarget("a sandboxed iframe", eLoadInSandboxedIframe), + new LoadTarget("a popup", eLoadInPopup), +]; + + +function LoadType(description, loadInFlags, uri, expectedSecureFlag, resultFrom) { + this.desc = description; + this.loadInFlags = loadInFlags; + this.uri = uri; + this.expectedSecureFlag = expectedSecureFlag; + this.resultFrom = resultFrom; +} + + +function LoadTarget(description, loadInFlag) { + this.desc = description; + this.loadInFlag = loadInFlag; +} + +LoadTarget.prototype.open = function(loadType) { + let loadTarget = this; + this.currentTest.step(function() { + assert_true((loadTarget.loadInFlag & loadType.loadInFlags) != 0, + loadType.desc + " cannot be tested in " + loadTarget.desc); + }); + if (this.loadInFlag == eLoadInUnsandboxedIframe) { + let iframe = document.createElement("iframe"); + document.body.appendChild(iframe); + iframe[loadType.desc == "a srcdoc" ? "srcdoc" : "src"] = loadType.uri; + return iframe; + } + if (this.loadInFlag == eLoadInSandboxedIframe) { + let iframe = document.body.appendChild(document.createElement("iframe")); + iframe.setAttribute("sandbox", "allow-scripts"); + iframe[loadType.desc == "a srcdoc" ? "srcdoc" : "src"] = loadType.uri; + return iframe; + } + if (this.loadInFlag == eLoadInPopup) { + return window.open(loadType.uri); + } + this.currentTest.step(function() { + assert_unreached("Unknown load type flag: " + loadInFlags); + }); + return null; +} + +LoadTarget.prototype.close = function(domTarget) { + if (this.loadInFlag == eLoadInUnsandboxedIframe || + this.loadInFlag == eLoadInSandboxedIframe) { + domTarget.remove(); + return; + } + if (this.loadInFlag == eLoadInPopup) { + domTarget.close(); + return; + } + this.currentTest.step(function() { + assert_unreached("Unknown load type flag: " + loadInFlags); + }); +} + +LoadTarget.prototype.load_and_get_result_for = function(loadType) { + if (!(loadType.loadInFlags & this.loadInFlag)) { + return Promise.reject("not applicable"); + } + if (!(this.loadInFlag & eLoadInPopup) && + location.protocol == "https:" && + loadType.uri.substr(0,5) == "http:") { + // Mixed content blocker will prevent this load + return Promise.reject("not applicable"); + } + this.currentTest = async_test("Test Window.isSecureContext in " + this.desc + + " loading " + loadType.desc) + if (loadType.resultFrom == eResultFromExaminationSync) { + let domTarget = this.open(loadType); + let isFrame = domTarget instanceof HTMLIFrameElement; + let result = !isFrame ? + domTarget.isSecureContext : domTarget.contentWindow.isSecureContext; + this.close(domTarget); + return Promise.resolve({ result: result, isFrame: isFrame}); + } + let target = this; + if (loadType.resultFrom == eResultFromExaminationOnLoad) { + return new Promise(function(resolve, reject) { + function handleLoad(event) { + clearTimeout(timer); + let isFrame = domTarget instanceof HTMLIFrameElement; + let result = !isFrame ? + domTarget.isSecureContext : domTarget.contentWindow.isSecureContext; + domTarget.removeEventListener("load", handleLoad); + target.close(domTarget); + resolve({ result: result, isFrame: isFrame}); + } + let domTarget = target.open(loadType); + domTarget.addEventListener("load", handleLoad, false); + + // Some browsers don't fire `load` events for `about:blank`. That's weird, but it also + // isn't what we're testing here. + let timer = setTimeout(handleLoad, 500); + }); + } + if (loadType.resultFrom == eResultFromPostMessage) { + return new Promise(function(resolve, reject) { + function handleMessage(event) { + let isFrame = domTarget instanceof HTMLIFrameElement; + window.removeEventListener("message", handleMessage); + target.close(domTarget); + resolve({ result: event.data, isFrame: isFrame}); + } + window.addEventListener("message", handleMessage, false); + let domTarget = target.open(loadType); + }); + } + return Promise.reject("unexpected 'result from' type"); +} + + +let current_type_index = -1; +let current_target_index = 0; + +function run_next_test() { + current_type_index++; + if (current_type_index >= loadTypes.length) { + current_type_index = 0; + current_target_index++; + if (current_target_index >= loadTargets.length) { + done(); + return; // all test permutations complete + } + } + let loadTarget = loadTargets[current_target_index]; + let loadType = loadTypes[current_type_index]; + loadTarget.load_and_get_result_for(loadType).then( + function(value) { + run_next_test_soon(); + loadTarget.currentTest.step(function() { + // If the new context is always non-secure, the assertion is straightforward. + if (loadType.expectedSecureFlag == eSecureNo) { + assert_false(value.result, loadType.desc + " in " + loadTarget.desc + " should not create a Secure Context"); + // If the new context is always secure if opened in a new window, and it's + // been opened in a new window, the assertion is likewise straightforward. + } else if (loadType.expectedSecureFlag == eSecureIfNewWindow && !value.isFrame) { + assert_true(value.result, loadType.desc + " in " + loadTarget.desc + " should create a secure context regardless of its creator's state."); + // Otherwise, we're either dealing with a context that's secure if and only + // if its creator context (e.g. this window) is secure. + } else if ((loadType.expectedSecureFlag == eSecureIfNewWindow && value.isFrame) || + (loadType.expectedSecureFlag == eSecureIfCreatorSecure)) { + if (!window.isSecureContext) { + assert_false(value.result, loadType.desc + " in " + loadTarget.desc + " should not create a Secure Context when its creator is not a Secure Context."); + } else { + assert_true(value.result, loadType.desc + " in " + loadTarget.desc + " should create a Secure Context when its creator is a Secure Context"); + } + } else { + assert_unreached(loadType.desc + " - unknown expected secure flag: " + expectedSecureFlag); + } + loadTarget.currentTest.done(); + }); + }, + function(failReason) { + run_next_test_soon(); + if (failReason == "not applicable") { + return; + } + loadTarget.currentTest.step(function() { + assert_unreached(loadType.desc + " - got unexpected rejected promise"); + }); + } + ); +} + +function run_next_test_soon() { + setTimeout(run_next_test, 0); +} + +function begin() { + test(function() { + if (location.protocol == "http:") { + assert_false(isSecureContext, + "http: creator should not be a Secure Context"); + } else if (location.protocol == "https:") { + assert_true(isSecureContext, + "https: creator should be a Secure Context"); + } else { + assert_unreached("Unknown location.protocol"); + } + }); + run_next_test(); +} + diff --git a/testing/web-platform/tests/secure-contexts/basic-shared-worker.html b/testing/web-platform/tests/secure-contexts/basic-shared-worker.html new file mode 100644 index 0000000000..7f421b0523 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/basic-shared-worker.html @@ -0,0 +1,84 @@ + + + + + Test SharedWorkerGlobalScope.isSecureContext for HTTP creator + + + + + + + + + diff --git a/testing/web-platform/tests/secure-contexts/basic-shared-worker.https.html b/testing/web-platform/tests/secure-contexts/basic-shared-worker.https.html new file mode 100644 index 0000000000..7c43cd965f --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/basic-shared-worker.https.html @@ -0,0 +1,82 @@ + + + + + Test SharedWorkerGlobalScope.isSecureContext for HTTP creator + + + + + + + + + diff --git a/testing/web-platform/tests/secure-contexts/postMessage-helper.html b/testing/web-platform/tests/secure-contexts/postMessage-helper.html new file mode 100644 index 0000000000..8971c86b27 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/postMessage-helper.html @@ -0,0 +1 @@ + diff --git a/testing/web-platform/tests/secure-contexts/postMessage-helper.https.html b/testing/web-platform/tests/secure-contexts/postMessage-helper.https.html new file mode 100644 index 0000000000..8971c86b27 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/postMessage-helper.https.html @@ -0,0 +1 @@ + diff --git a/testing/web-platform/tests/secure-contexts/server-locations.sub.js b/testing/web-platform/tests/secure-contexts/server-locations.sub.js new file mode 100644 index 0000000000..6b29c5328c --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/server-locations.sub.js @@ -0,0 +1,17 @@ +var https_dir = "https://{{location[hostname]}}:{{ports[https][0]}}{{location[path]}}"; +https_dir = https_dir.substr(0, https_dir.lastIndexOf("/") + 1); + +var http_dir = "http://{{location[hostname]}}:{{ports[http][0]}}{{location[path]}}"; +http_dir = http_dir.substr(0, http_dir.lastIndexOf("/") + 1); + +var https_dir2 = "https://{{domains[www]}}:{{ports[https][0]}}{{location[path]}}"; +https_dir2 = https_dir2.substr(0, https_dir2.lastIndexOf("/") + 1); + +var https_dir3 = "https://{{domains[www1]}}:{{ports[https][0]}}{{location[path]}}"; +https_dir3 = https_dir3.substr(0, https_dir3.lastIndexOf("/") + 1); + +var https_dir4 = "https://{{domains[www2]}}:{{ports[https][0]}}{{location[path]}}"; +https_dir4 = https_dir4.substr(0, https_dir4.lastIndexOf("/") + 1); + +var https_dir5 = "https://{{domains[élève]}}:{{ports[https][0]}}{{location[path]}}"; +https_dir5 = https_dir5.substr(0, https_dir5.lastIndexOf("/") + 1); diff --git a/testing/web-platform/tests/secure-contexts/shared-worker-insecure-first.https.html b/testing/web-platform/tests/secure-contexts/shared-worker-insecure-first.https.html new file mode 100644 index 0000000000..00db9517d0 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/shared-worker-insecure-first.https.html @@ -0,0 +1,111 @@ + + + + + Test SharedWorkerGlobalScope.isSecureContext for HTTP creator + + + + + + + + + diff --git a/testing/web-platform/tests/secure-contexts/shared-worker-secure-first.https.html b/testing/web-platform/tests/secure-contexts/shared-worker-secure-first.https.html new file mode 100644 index 0000000000..ce97a628a0 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/shared-worker-secure-first.https.html @@ -0,0 +1,111 @@ + + + + + Test SharedWorkerGlobalScope.isSecureContext for HTTP creator + + + + + + + + + diff --git a/testing/web-platform/tests/secure-contexts/support/dedicated-worker-script.js b/testing/web-platform/tests/secure-contexts/support/dedicated-worker-script.js new file mode 100644 index 0000000000..69ffdf3442 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/support/dedicated-worker-script.js @@ -0,0 +1 @@ +postMessage(isSecureContext); diff --git a/testing/web-platform/tests/secure-contexts/support/https-subframe-dedicated.html b/testing/web-platform/tests/secure-contexts/support/https-subframe-dedicated.html new file mode 100644 index 0000000000..bcf27879e8 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/support/https-subframe-dedicated.html @@ -0,0 +1,33 @@ + + + diff --git a/testing/web-platform/tests/secure-contexts/support/https-subframe-shared.html b/testing/web-platform/tests/secure-contexts/support/https-subframe-shared.html new file mode 100644 index 0000000000..5ae7cde5b0 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/support/https-subframe-shared.html @@ -0,0 +1,32 @@ + + diff --git a/testing/web-platform/tests/secure-contexts/support/parent-dedicated-worker-script.js b/testing/web-platform/tests/secure-contexts/support/parent-dedicated-worker-script.js new file mode 100644 index 0000000000..2b67432384 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/support/parent-dedicated-worker-script.js @@ -0,0 +1,9 @@ +// If nested workers aren't supported, punt: +if (typeof Worker != "undefined") { + var w = new Worker("dedicated-worker-script.js"); + w.onmessage = function (e) { + postMessage(e.data); + } +} else { + postMessage("Nested workers not supported."); +} diff --git a/testing/web-platform/tests/secure-contexts/support/parent-shared-worker-script.js b/testing/web-platform/tests/secure-contexts/support/parent-shared-worker-script.js new file mode 100644 index 0000000000..083564a054 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/support/parent-shared-worker-script.js @@ -0,0 +1,13 @@ +addEventListener("connect", function (e) { + var port = e.ports[0]; + port.start(); + // If nested workers aren't supported, punt: + if (typeof Worker != "undefined") { + var w = new Worker("dedicated-worker-script.js"); + w.onmessage = function (e) { + port.postMessage(e.data); + } + } else { + port.postMessage("Nested workers not supported."); + } +}); diff --git a/testing/web-platform/tests/secure-contexts/support/shared-worker-insecure-popup.html b/testing/web-platform/tests/secure-contexts/support/shared-worker-insecure-popup.html new file mode 100644 index 0000000000..740679dc4f --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/support/shared-worker-insecure-popup.html @@ -0,0 +1,15 @@ + + + + + diff --git a/testing/web-platform/tests/secure-contexts/support/shared-worker-script.js b/testing/web-platform/tests/secure-contexts/support/shared-worker-script.js new file mode 100644 index 0000000000..faed70a5c8 --- /dev/null +++ b/testing/web-platform/tests/secure-contexts/support/shared-worker-script.js @@ -0,0 +1,5 @@ +addEventListener("connect", function (e) { + var port = e.ports[0]; + port.start(); + port.postMessage(isSecureContext); +}); -- cgit v1.2.3