against XMLHttpRequest Test: event - error
+
+
+
diff --git a/tests/wpt/web-platform-tests/XMLHttpRequest/getallresponseheaders-status.htm b/tests/wpt/web-platform-tests/XMLHttpRequest/getallresponseheaders-status.htm
index b4afc61c469..ec1aa9a8072 100644
--- a/tests/wpt/web-platform-tests/XMLHttpRequest/getallresponseheaders-status.htm
+++ b/tests/wpt/web-platform-tests/XMLHttpRequest/getallresponseheaders-status.htm
@@ -12,6 +12,10 @@
var test = async_test()
test.step(function() {
var client = new XMLHttpRequest()
+ var headersUnsent = client.getAllResponseHeaders();
+ test.step(function() {
+ assert_equals(headersUnsent, "")
+ });
client.onreadystatechange = function() {
test.step(function() {
var headers = client.getAllResponseHeaders().toLowerCase()
diff --git a/tests/wpt/web-platform-tests/XMLHttpRequest/resources/echo-method.py b/tests/wpt/web-platform-tests/XMLHttpRequest/resources/echo-method.py
new file mode 100644
index 00000000000..5351d1961ac
--- /dev/null
+++ b/tests/wpt/web-platform-tests/XMLHttpRequest/resources/echo-method.py
@@ -0,0 +1,6 @@
+def main(request, response):
+ response.send_body_for_head_request = True
+ headers = [("Content-type", "text/plain")]
+ content = request.method
+
+ return headers, content
diff --git a/tests/wpt/web-platform-tests/XMLHttpRequest/response-method.htm b/tests/wpt/web-platform-tests/XMLHttpRequest/response-method.htm
new file mode 100644
index 00000000000..1bf26bac79c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/XMLHttpRequest/response-method.htm
@@ -0,0 +1,21 @@
+
+
+
+ XMLHttpRequest: influence of HTTP method on response
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/XMLHttpRequest/responseText-status.html b/tests/wpt/web-platform-tests/XMLHttpRequest/responseText-status.html
new file mode 100644
index 00000000000..7d575902ddc
--- /dev/null
+++ b/tests/wpt/web-platform-tests/XMLHttpRequest/responseText-status.html
@@ -0,0 +1,33 @@
+
+XMLHttpRequest Test: responseText - status
+
+
+
diff --git a/tests/wpt/web-platform-tests/XMLHttpRequest/responsexml-document-properties.htm b/tests/wpt/web-platform-tests/XMLHttpRequest/responsexml-document-properties.htm
index ef4d5906cf7..ed53996dcec 100644
--- a/tests/wpt/web-platform-tests/XMLHttpRequest/responsexml-document-properties.htm
+++ b/tests/wpt/web-platform-tests/XMLHttpRequest/responsexml-document-properties.htm
@@ -43,7 +43,7 @@
}
test(function() {
- assert_equals((new Date(client.getResponseHeader('Last-Modified'))).getTime(), (new Date(client.responseXML.lastModified)).getTime())
+ assert_true((new Date(client.getResponseHeader('Last-Modified'))).getTime() == (new Date(client.responseXML.lastModified)).getTime(), 'responseXML.lastModified time shoud be equal to time in response Last-Modified header')
}, 'lastModified set according to HTTP header')
test(function() {
diff --git a/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-basic-setrequestheader-existing-session.htm b/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-basic-setrequestheader-existing-session.htm
index 5b8932c2c63..6e68f098cf5 100644
--- a/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-basic-setrequestheader-existing-session.htm
+++ b/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-basic-setrequestheader-existing-session.htm
@@ -25,7 +25,7 @@
client.setRequestHeader('X-User', open_user)
// initial request - this will get a 401 response and re-try with HTTP auth
client.send(null)
- assert_equals(client.responseText, open_user + '\nopen-pass')
+ assert_true(client.responseText == (open_user + '\nopen-pass'), 'responseText should contain the right user and password')
assert_equals(client.status, 200)
assert_equals(client.getResponseHeader('x-challenge'), 'DID')
// Another request, this time user,pass is omitted and an Authorization header set explicitly
diff --git a/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-competing-names-passwords.htm b/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-competing-names-passwords.htm
index 994ebb5a857..ba7ea7e35c5 100644
--- a/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-competing-names-passwords.htm
+++ b/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-competing-names-passwords.htm
@@ -34,7 +34,7 @@
client.open("GET", urlstart + "resources/authentication.py", false, user2, pass2)
client.setRequestHeader("x-user", userwin)
client.send(null)
- assert_equals(client.responseText, (userwin||'') + "\n" + (passwin||''))
+ assert_true(client.responseText == ((userwin||'') + "\n" + (passwin||'')), 'responseText should contain the right user and password')
// We want to send multiple requests to the same realm here, so we try to make the UA forget its (cached) credentials between each test..
// forcing a 401 response to (hopefully) "log out"
diff --git a/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader.htm b/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader.htm
index 6f2eeb734a5..85911d78d9f 100644
--- a/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader.htm
+++ b/tests/wpt/web-platform-tests/XMLHttpRequest/send-authentication-cors-basic-setrequestheader.htm
@@ -25,7 +25,7 @@
client.onreadystatechange = function () {
if (client.readyState < 4) {return}
test.step( function () {
- assert_equals(client.responseText, user + '\npass')
+ assert_true(client.responseText == (user + '\npass'), 'responseText should contain the right user and password')
assert_equals(client.status, 200)
assert_equals(client.getResponseHeader('x-challenge'), 'DID-NOT')
test.done()
diff --git a/tests/wpt/web-platform-tests/XMLHttpRequest/status-basic.htm b/tests/wpt/web-platform-tests/XMLHttpRequest/status-basic.htm
index 5005ceae688..fed7cabec47 100644
--- a/tests/wpt/web-platform-tests/XMLHttpRequest/status-basic.htm
+++ b/tests/wpt/web-platform-tests/XMLHttpRequest/status-basic.htm
@@ -17,7 +17,9 @@
counter++
test(function() {
var client = new XMLHttpRequest()
+ assert_equals(client.status, 0);
client.open(method, "resources/status.py?code=" + code + "&text=" + encodeURIComponent(text) + "&content=" + encodeURIComponent(content) + "&type=" + encodeURIComponent(type), false)
+ assert_equals(client.status, 0);
client.send(null)
assert_equals(client.status, code)
assert_equals(client.statusText, text)
diff --git a/tests/wpt/web-platform-tests/conformance-checkers/html-aria/_functional/tree/js/aria.js b/tests/wpt/web-platform-tests/conformance-checkers/html-aria/_functional/tree/js/aria.js
index e853a3a95f0..bf3bc5399e5 100644
--- a/tests/wpt/web-platform-tests/conformance-checkers/html-aria/_functional/tree/js/aria.js
+++ b/tests/wpt/web-platform-tests/conformance-checkers/html-aria/_functional/tree/js/aria.js
@@ -20,7 +20,6 @@ var Aria = {
Aria.Tree = Class.create();
Aria.Tree.prototype = {
initialize: function(inNode){
- if(!$(inNode) && console.error) console.error('Error from aria.js: Aria.Tree instance initialized with invalid element, '+ inNode);
this.el = $(inNode);
this.index = Aria.Trees.length; // each tree should know its index in the Aria singleton's list, in order to concatenate id strings
this.strActiveDescendant = this.el.getAttribute('aria-activedescendant');
@@ -112,8 +111,7 @@ Aria.Tree.prototype = {
case Event.KEY_UP: this.keyUp(); break;
case Event.KEY_RIGHT: this.keyRight(); break;
case Event.KEY_DOWN: this.keyDown(); break;
- default:
- //console.log(inEvent.keyCode);
+ default:
return;
}
Event.stop(inEvent);
diff --git a/tests/wpt/web-platform-tests/conformance-checkers/messages.json b/tests/wpt/web-platform-tests/conformance-checkers/messages.json
index 34e3a756738..34990c02200 100644
--- a/tests/wpt/web-platform-tests/conformance-checkers/messages.json
+++ b/tests/wpt/web-platform-tests/conformance-checkers/messages.json
@@ -1388,13 +1388,13 @@
"html/elements/kbd/model-novalid.html": "End tag \u201cp\u201d implied, but there were open elements.",
"html/elements/keygen/id-bad-novalid.html": "Any \u201ckeygen\u201d descendant of a \u201clabel\u201d element with a \u201cfor\u201d attribute must have an ID value that matches that \u201cfor\u201d attribute.",
"html/elements/keygen/id-missing-novalid.html": "Any \u201ckeygen\u201d descendant of a \u201clabel\u201d element with a \u201cfor\u201d attribute must have an ID value that matches that \u201cfor\u201d attribute.",
- "html/elements/keygen/id-redundant-novalid.html": "The \u201clabel\u201d element may contain at most one \u201cinput\u201d, \u201cbutton\u201d, \u201cselect\u201d, \u201ctextarea\u201d, or \u201ckeygen\u201d descendant.",
+ "html/elements/keygen/id-redundant-novalid.html": "The \u201clabel\u201d element may contain at most one \u201cbutton\u201d, \u201cinput\u201d, \u201ckeygen\u201d, \u201cmeter\u201d, \u201coutput\u201d, \u201cprogress\u201d, \u201cselect\u201d, or \u201ctextarea\u201d descendant.",
"html/elements/keygen/keytype-bad-value-novalid.html": "Bad value \u201cdsa\u201d for attribute \u201ckeytype\u201d on element \u201ckeygen\u201d.",
"html/elements/keygen/keytype-empty-novalid.html": "Bad value \u201c\u201d for attribute \u201ckeytype\u201d on element \u201ckeygen\u201d.",
"html/elements/keygen/model-novalid.html": "The element \u201ckeygen\u201d must not appear as a descendant of the \u201ca\u201d element.",
"html/elements/keygen/non-void-novalid.html": "Stray end tag \u201ckeygen\u201d.",
"html/elements/label/for-descendant-no-id-novalid.html": "Any \u201cinput\u201d descendant of a \u201clabel\u201d element with a \u201cfor\u201d attribute must have an ID value that matches that \u201cfor\u201d attribute.",
- "html/elements/label/multiple-descendants-novalid.html": "The \u201clabel\u201d element may contain at most one \u201cinput\u201d, \u201cbutton\u201d, \u201cselect\u201d, \u201ctextarea\u201d, or \u201ckeygen\u201d descendant.",
+ "html/elements/label/multiple-descendants-novalid.html": "The \u201clabel\u201d element may contain at most one \u201cbutton\u201d, \u201cinput\u201d, \u201ckeygen\u201d, \u201cmeter\u201d, \u201coutput\u201d, \u201cprogress\u201d, \u201cselect\u201d, or \u201ctextarea\u201d descendant.",
"html/elements/link/href-empty-novalid.html": "Bad value \u201c\u201d for attribute \u201chref\u201d on element \u201clink\u201d: Bad URL: Must be non-empty.",
"html/elements/link/href-missing-novalid.html": "Element \u201clink\u201d is missing required attribute \u201chref\u201d.",
"html/elements/link/href-whitespace-only-novalid.html": "Bad value \u201c\t \n\u201d for attribute \u201chref\u201d on element \u201clink\u201d: Bad URL: Must be non-empty.",
@@ -2167,9 +2167,9 @@
"html/media-queries/022-novalid.html": "Bad value \u201cscreen,\u201d for attribute \u201cmedia\u201d on element \u201clink\u201d: Bad media query: Media query ended prematurely.",
"html/media-queries/023-novalid.html": "Bad value \u201c,screen\u201d for attribute \u201cmedia\u201d on element \u201clink\u201d: Bad media query: Media query ended prematurely.",
"html/media-queries/024-novalid.html": "Bad value \u201cscreen and (min-width: 400)\u201d for attribute \u201cmedia\u201d on element \u201clink\u201d: Bad media query: Non-zero lengths require a unit.",
- "html/media-queries/device-aspect-ratio-novalid.html": "Bad value \u201cscreen and (device-aspect-ratio: 16/9)\u201d for attribute \u201cmedia\u201d on element \u201clink\u201d: Bad media query: Expected a CSS media feature but saw \u201cdevice-aspect-ratio\u201d instead.",
- "html/media-queries/projection-novalid.html": "Bad value \u201cprojection\u201d for attribute \u201cmedia\u201d on element \u201clink\u201d: Bad media query: Expected a CSS media type but the query ended.",
- "html/media-queries/tv-novalid.html": "Bad value \u201ctv and (scan: progressive)\u201d for attribute \u201cmedia\u201d on element \u201clink\u201d: Bad media query: Expected a CSS media type but saw \u201ctv\u201d instead.",
+ "html/media-queries/device-aspect-ratio-novalid.html": "Bad value \u201cscreen and (device-aspect-ratio: 16/9)\u201d for attribute \u201cmedia\u201d on element \u201clink\u201d: Bad media query: Deprecated media feature \u201cdevice-aspect-ratio\u201d. For guidance, see the Deprecated Media Features section in the current Media Queries specification.",
+ "html/media-queries/projection-novalid.html": "Bad value \u201cprojection\u201d for attribute \u201cmedia\u201d on element \u201clink\u201d: Bad media query: Deprecated media type \u201cprojection\u201d. For guidance, see the Media Types section in the current Media Queries specification.",
+ "html/media-queries/tv-novalid.html": "Bad value \u201ctv and (scan: progressive)\u201d for attribute \u201cmedia\u201d on element \u201clink\u201d: Bad media query: Deprecated media type \u201ctv\u201d. For guidance, see the Media Types section in the current Media Queries specification.",
"html/microdata/itemid-scheme-data-contains-fragment-haswarn.html": "Bad value \u201cdata:text/html,test#test\u201d for attribute \u201citemid\u201d on element \u201cdiv\u201d: Bad URL: Fragment is not allowed for data: URIs according to RFC 2397.",
"html/microdata/itemid/fragment-backslash-novalid.html": "Bad value \u201c#\\\u201d for attribute \u201citemid\u201d on element \u201cdiv\u201d: Bad URL: Illegal character in fragment: not a URL code point.",
"html/microdata/itemid/fragment-contains-hash-novalid.html": "Bad value \u201chttp://foo/path#f#g\u201d for attribute \u201citemid\u201d on element \u201cdiv\u201d: Bad URL: Illegal character in fragment: not a URL code point.",
@@ -2370,12 +2370,12 @@
"xhtml/elements/keygen/057-novalid.xhtml": "Bad value \u201c\u201d for attribute \u201ckeytype\u201d on element \u201ckeygen\u201d.",
"xhtml/elements/keygen/058-novalid.xhtml": "Any \u201ckeygen\u201d descendant of a \u201clabel\u201d element with a \u201cfor\u201d attribute must have an ID value that matches that \u201cfor\u201d attribute.",
"xhtml/elements/keygen/059-novalid.xhtml": "Any \u201ckeygen\u201d descendant of a \u201clabel\u201d element with a \u201cfor\u201d attribute must have an ID value that matches that \u201cfor\u201d attribute.",
- "xhtml/elements/keygen/060-novalid.xhtml": "The \u201clabel\u201d element may contain at most one \u201cinput\u201d, \u201cbutton\u201d, \u201cselect\u201d, \u201ctextarea\u201d, or \u201ckeygen\u201d descendant.",
+ "xhtml/elements/keygen/060-novalid.xhtml": "The \u201clabel\u201d element may contain at most one \u201cbutton\u201d, \u201cinput\u201d, \u201ckeygen\u201d, \u201cmeter\u201d, \u201coutput\u201d, \u201cprogress\u201d, \u201cselect\u201d, or \u201ctextarea\u201d descendant.",
"xhtml/elements/keygen/061-novalid.xhtml": "The element \u201ckeygen\u201d must not appear as a descendant of the \u201ca\u201d element.",
"xhtml/elements/keygen/154-novalid.xhtml": "Text not allowed in element \u201ckeygen\u201d in this context.",
"xhtml/elements/keygen/157-novalid.xhtml": "Bad value \u201c\u201d for attribute \u201ckeytype\u201d on element \u201ckeygen\u201d.",
"xhtml/elements/keygen/359-novalid.xhtml": "Any \u201ckeygen\u201d descendant of a \u201clabel\u201d element with a \u201cfor\u201d attribute must have an ID value that matches that \u201cfor\u201d attribute.",
- "xhtml/elements/keygen/360-novalid.xhtml": "The \u201clabel\u201d element may contain at most one \u201cinput\u201d, \u201cbutton\u201d, \u201cselect\u201d, \u201ctextarea\u201d, or \u201ckeygen\u201d descendant.",
+ "xhtml/elements/keygen/360-novalid.xhtml": "The \u201clabel\u201d element may contain at most one \u201cbutton\u201d, \u201cinput\u201d, \u201ckeygen\u201d, \u201cmeter\u201d, \u201coutput\u201d, \u201cprogress\u201d, \u201cselect\u201d, or \u201ctextarea\u201d descendant.",
"xhtml/elements/keygen/361-novalid.xhtml": "The element \u201ckeygen\u201d must not appear as a descendant of the \u201ca\u201d element.",
"xhtml/elements/link/001-novalid.xhtml": "Element \u201clink\u201d is missing required attribute \u201chref\u201d.",
"xhtml/elements/menu/001-haswarn.xhtml": "The \u201cmenu\u201d element is not supported by browsers yet. It would probably be better to wait for implementations.",
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/allowed.css b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/allowed.css
new file mode 100644
index 00000000000..ace54348973
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/allowed.css
@@ -0,0 +1,3 @@
+#test {
+ color: green;
+}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-allow.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-allow.sub.html
new file mode 100644
index 00000000000..1baa22a8291
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-allow.sub.html
@@ -0,0 +1,30 @@
+
+
+
+
+
+ base-uri-allow
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-allow.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-allow.sub.html.sub.headers
new file mode 100644
index 00000000000..e749d723890
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-allow.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: base-uri-allow={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: base-uri http://www1.{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline' http://www1.{{host}}:{{ports[http][0]}}; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-deny.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-deny.sub.html
new file mode 100644
index 00000000000..451bfda90c5
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-deny.sub.html
@@ -0,0 +1,33 @@
+
+
+
+
+
+ base-uri-deny
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-deny.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-deny.sub.html.sub.headers
new file mode 100644
index 00000000000..0312c46d07c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/base-uri-deny.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: base-uri-deny={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: base-uri 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-allowed.sub.html
new file mode 100644
index 00000000000..376a06a180a
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-allowed.sub.html
@@ -0,0 +1,35 @@
+
+
+
+
+
+ form-action-src-allowed
+
+
+
+
+
+
+
+
+
+
+ Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..88cbfda0ef0
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: form-action-src-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: form-action 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-blocked.sub.html
new file mode 100644
index 00000000000..81fe844f1e2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-blocked.sub.html
@@ -0,0 +1,36 @@
+
+
+
+
+
+ form-action-src-blocked
+
+
+
+
+
+
+
+
+
+
+ Tests that blocking form actions works correctly. If this test passes, a CSP violation will be generated, and will not see a page indicating a form was POSTed.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..29351c00843
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: form-action-src-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: form-action 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-default-ignored.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-default-ignored.sub.html
new file mode 100644
index 00000000000..14efac46e75
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-default-ignored.sub.html
@@ -0,0 +1,35 @@
+
+
+
+
+
+ form-action-src-default-ignored
+
+
+
+
+
+
+
+
+
+
+ Tests that default-src does. If this test passes, you will see a page indicating a form was POSTed or a blocked pop-up warning.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-default-ignored.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-default-ignored.sub.html.sub.headers
new file mode 100644
index 00000000000..d8655e27856
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-default-ignored.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: form-action-src-default-ignored={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: default-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; style-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-allowed.sub.html
new file mode 100644
index 00000000000..82a0714dd90
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-allowed.sub.html
@@ -0,0 +1,35 @@
+
+
+
+
+
+ form-action-src-get-allowed
+
+
+
+
+
+
+
+
+
+
+ Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed or a blocked pop-up warning.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..ac8761518c8
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: form-action-src-get-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: form-action 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-blocked.sub.html
new file mode 100644
index 00000000000..9a1b9f5b1a6
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-blocked.sub.html
@@ -0,0 +1,34 @@
+
+
+
+
+
+ form-action-src-get-blocked
+
+
+
+
+
+
+
+
+
+
+ Tests that blocking form actions works correctly. If this test passes, a CSP violation will be generated, and will not see a page indicating a form was POSTed.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..e7a044dbcca
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-get-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: form-action-src-get-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: form-action 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-javascript-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-javascript-blocked.sub.html
new file mode 100644
index 00000000000..7bef874e862
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-javascript-blocked.sub.html
@@ -0,0 +1,35 @@
+
+
+
+
+
+ form-action-src-javascript-blocked
+
+
+
+
+
+
+
+
+
+
+ Tests that blocking form actions works correctly. If this test passes, a CSP violation will be generated, and will not see a JavaScript alert.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-javascript-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-javascript-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..bbdf4a0711e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-javascript-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: form-action-src-javascript-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: form-action 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-redirect-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-redirect-blocked.sub.html
new file mode 100644
index 00000000000..6829a27e585
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-redirect-blocked.sub.html
@@ -0,0 +1,36 @@
+
+
+
+
+
+ form-action-src-redirect-blocked
+
+
+
+
+
+
+
+
+
+
+ Tests that blocking form redirect works correctly. If this test passes, a CSP violation will be generated, and will not see a page indicating a form was POSTed.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-redirect-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-redirect-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..cca14ebb5af
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/form-action-src-redirect-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: form-action-src-redirect-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: form-action 127.0.0.1:8000; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/meta-outside-head.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/meta-outside-head.sub.html
new file mode 100644
index 00000000000..ac103981c3c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/meta-outside-head.sub.html
@@ -0,0 +1,27 @@
+
+
+
+
+
+ meta-outside-head
+
+
+
+
+
+
+
+
+ This test checks that Content Security Policy delivered via a meta element is not enforced if the element is outside the document's head.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/meta-outside-head.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/meta-outside-head.sub.html.sub.headers
new file mode 100644
index 00000000000..3cd33519216
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/meta-outside-head.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: meta-outside-head={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'none'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-data.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-data.sub.html
new file mode 100644
index 00000000000..fe3f95878d2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-data.sub.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+ plugintypes-mismatched-data
+
+
+
+
+
+
+
+
+
+ This tests that plugin content that doesn't match the declared type doesn't load, even if the document's CSP would allow it. This test passes if "FAIL!" isn't logged.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-data.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-data.sub.html.sub.headers
new file mode 100644
index 00000000000..4e5b31b2a6b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-data.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: plugintypes-mismatched-data={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-url.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-url.sub.html
new file mode 100644
index 00000000000..bc60994ad3a
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-url.sub.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+ plugintypes-mismatched-url
+
+
+
+
+
+
+
+
+
+ This tests that plugin content that doesn't match the declared type doesn't load, even if the document's CSP would allow it. This test passes if no iframe is dumped (meaning that no PluginDocument was created).
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-url.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-url.sub.html.sub.headers
new file mode 100644
index 00000000000..38a7450ab72
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-mismatched-url.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: plugintypes-mismatched-url={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-data.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-data.sub.html
new file mode 100644
index 00000000000..59179c71615
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-data.sub.html
@@ -0,0 +1,23 @@
+
+
+
+
+
+ plugintypes-notype-data
+
+
+
+
+
+
+
+
+ Given a `plugin-types` directive, plugins have to declare a type explicitly. No declared type, no load. This test passes if there's a CSP report and "FAIL!" isn't logged.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-data.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-data.sub.html.sub.headers
new file mode 100644
index 00000000000..ea938378afc
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-data.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: plugintypes-notype-data={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-url.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-url.sub.html
new file mode 100644
index 00000000000..e9918941fd3
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-url.sub.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+ plugintypes-notype-url
+
+
+
+
+
+
+
+
+
+ Given a `plugin-types` directive, plugins have to declare a type explicitly. No declared type, no load. This test passes if there's an error report is sent.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-url.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-url.sub.html.sub.headers
new file mode 100644
index 00000000000..ffe26cdf169
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-notype-url.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: plugintypes-notype-url={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-allowed.sub.html
new file mode 100644
index 00000000000..222d6500d1b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-allowed.sub.html
@@ -0,0 +1,23 @@
+
+
+
+
+
+ plugintypes-nourl-allowed
+
+
+
+
+
+
+
+
+ This test passes if there isn't a CSP violation sayingthe plugin was blocked.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..7fef2a5b560
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: plugintypes-nourl-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: plugin-types application/x-webkit-test-netscape; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-blocked.sub.html
new file mode 100644
index 00000000000..b5cc5a5a40f
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-blocked.sub.html
@@ -0,0 +1,23 @@
+
+
+
+
+
+ plugintypes-nourl-blocked
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation sayingthe plugin was blocked.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..709bf90df99
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/plugintypes-nourl-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: plugintypes-nourl-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: plugin-types text/plain; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-allowed.sub.html
new file mode 100644
index 00000000000..6bacdc36e5b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-allowed.sub.html
@@ -0,0 +1,42 @@
+
+
+
+
+
+ scripthash-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+ This tests the effect of a valid script-hash value. It passes if no CSP violation is generated, and the alert_assert() is executed.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..8eaf327858a
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: scripthash-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'sha256-IFmozo9WnnsMXVl_Ka8XzJ3Nd8yzS2zA2ME0mwtd-Ck=' 'sha256-jSpTmJKcrnHttKdYM_wCCDJoQY5tdSxNf7zd2prwFfI=' 'sha256-qbgA2XjB2EZKjn_UmK7v_K77t-fvfxA89QT_K9qPNyE=' 'sha256-K-7X5Ip3msvRvyQzf6fkrWZziuhaUIee1aLnlP5nX10='; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-basic-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-basic-blocked.sub.html
new file mode 100644
index 00000000000..ac7b2c02f9d
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-basic-blocked.sub.html
@@ -0,0 +1,69 @@
+
+
+
+
+
+ scripthash-basic-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ This tests the effect of a valid script-hash value, with one valid script and several invalid ones. It passes if one alert is executed and a CSP violation is reported.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-basic-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-basic-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..740f975a2de
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-basic-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: scripthash-basic-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'sha1-Au4uYFbkf7OYd+ACMnKq96FN3qo='; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-ignore-unsafeinline.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-ignore-unsafeinline.sub.html
new file mode 100644
index 00000000000..545099e080f
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-ignore-unsafeinline.sub.html
@@ -0,0 +1,57 @@
+
+
+
+
+
+ scripthash-ignore-unsafeinline
+
+
+
+
+
+
+
+
+
+
+
+ This tests that a valid hash value disables inline JavaScript, even if 'unsafe-inline' is present.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-ignore-unsafeinline.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-ignore-unsafeinline.sub.html.sub.headers
new file mode 100644
index 00000000000..4fe453debf7
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-ignore-unsafeinline.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: scripthash-ignore-unsafeinline={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'sha1-Au4uYFbkf7OYd+ACMnKq96FN3qo=' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-unicode-normalization.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-unicode-normalization.sub.html
new file mode 100644
index 00000000000..cbf955b10d8
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-unicode-normalization.sub.html
@@ -0,0 +1,42 @@
+
+
+
+
+
+ scripthash-unicode-normalization
+
+
+
+
+
+ This tests Unicode normalization. While appearing the same, the strings in the scripts are different Unicode points, but through normalization, should be the same when the hash is taken.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-unicode-normalization.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-unicode-normalization.sub.html.sub.headers
new file mode 100644
index 00000000000..065234dd7f1
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scripthash-unicode-normalization.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: scripthash-unicode-normalization={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'sha256-xy4iRAvdlFCq-M5-4yu4B7dy0Kc2FfljmZO4Jkj3Yhw='; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-allowed.sub.html
new file mode 100644
index 00000000000..2a1321d2423
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-allowed.sub.html
@@ -0,0 +1,64 @@
+
+
+
+
+
+ scriptnonce-allowed
+
+
+
+
+
+
+
+
+
+
+
+ This tests the effect of a valid script-nonce value. It passes if no CSP violation is generated and the alerts are executed.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..a69c927c906
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: scriptnonce-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'nonce-noncynonce' 'nonce-noncy+/=nonce'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-and-scripthash.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-and-scripthash.sub.html
new file mode 100644
index 00000000000..2b333cbeade
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-and-scripthash.sub.html
@@ -0,0 +1,76 @@
+
+
+
+
+
+ scriptnonce-and-scripthash
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ This tests the combined use of script hash and script nonce. It passes if a CSP violation is generated and the three alerts show PASS.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-and-scripthash.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-and-scripthash.sub.html.sub.headers
new file mode 100644
index 00000000000..afa33e6df18
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-and-scripthash.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: scriptnonce-and-scripthash={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'sha256-LS8v1E1Ff0Hc8FobgWKNKY3sbW4rljPlZNQHyyutfKU=' 'nonce-nonceynonce'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-basic-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-basic-blocked.sub.html
new file mode 100644
index 00000000000..18ad1d4f66c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-basic-blocked.sub.html
@@ -0,0 +1,76 @@
+
+
+
+
+
+ scriptnonce-basic-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ This tests the effect of a valid script-nonce value. It passes if a CSP violation is generated, and the two PASS alerts are executed.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-basic-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-basic-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..ee4e8b3f0b2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-basic-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: scriptnonce-basic-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'nonce-noncynonce'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-ignore-unsafeinline.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-ignore-unsafeinline.sub.html
new file mode 100644
index 00000000000..d1b97dfb920
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-ignore-unsafeinline.sub.html
@@ -0,0 +1,72 @@
+
+
+
+
+
+ scriptnonce-ignore-unsafeinline
+
+
+
+
+
+
+
+
+
+
+
+
+
+ This tests that a valid nonce disables inline JavaScript, even if 'unsafe-inline' is present.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-ignore-unsafeinline.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-ignore-unsafeinline.sub.html.sub.headers
new file mode 100644
index 00000000000..01f7e185a2e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-ignore-unsafeinline.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: scriptnonce-ignore-unsafeinline={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'nonce-noncynonce' 'nonce-noncy+/=nonce' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-redirect.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-redirect.sub.html
new file mode 100644
index 00000000000..a17f1fb5c30
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-redirect.sub.html
@@ -0,0 +1,59 @@
+
+
+
+
+
+ scriptnonce-redirect
+
+
+
+
+
+
+
+
+ This tests whether a deferred script load caused by a redirect is properly allowed by a nonce.
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-redirect.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-redirect.sub.html.sub.headers
new file mode 100644
index 00000000000..8d71f88d55e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/scriptnonce-redirect.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: scriptnonce-redirect={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'nonce-noncynonce'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image-from-script.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image-from-script.sub.html
new file mode 100644
index 00000000000..82cad034796
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image-from-script.sub.html
@@ -0,0 +1,27 @@
+
+
+
+
+
+ securitypolicyviolation-block-cross-origin-image-from-script
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image-from-script.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image-from-script.sub.html.sub.headers
new file mode 100644
index 00000000000..723ed281ffc
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image-from-script.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: securitypolicyviolation-block-cross-origin-image-from-script={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image.sub.html
new file mode 100644
index 00000000000..c805cc57b7f
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image.sub.html
@@ -0,0 +1,29 @@
+
+
+
+
+
+ securitypolicyviolation-block-cross-origin-image
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image.sub.html.sub.headers
new file mode 100644
index 00000000000..d701a476fa4
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-cross-origin-image.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: securitypolicyviolation-block-cross-origin-image={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image-from-script.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image-from-script.sub.html
new file mode 100644
index 00000000000..8c00fdb36d8
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image-from-script.sub.html
@@ -0,0 +1,29 @@
+
+
+
+
+
+ securitypolicyviolation-block-image-from-script
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image-from-script.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image-from-script.sub.html.sub.headers
new file mode 100644
index 00000000000..6b6084dc531
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image-from-script.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: securitypolicyviolation-block-image-from-script={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image.sub.html
new file mode 100644
index 00000000000..31b4492002b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image.sub.html
@@ -0,0 +1,34 @@
+
+
+
+
+
+ securitypolicyviolation-block-image
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image.sub.html.sub.headers
new file mode 100644
index 00000000000..1f4f8457845
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/securitypolicyviolation-block-image.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: securitypolicyviolation-block-image={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-allowed.sub.html
new file mode 100644
index 00000000000..be7ef1a8198
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-allowed.sub.html
@@ -0,0 +1,77 @@
+
+
+
+
+
+ stylehash-allowed
+
+
+
+
+
+
+
+
+ This tests the result of a valid style hash. It passes if this text is green, and a "PASS" alert for p1 is fired.
+ This tests the result of a valid style hash. It passes if this text is green, and a "PASS" alert for p2 is fired.
+ This tests the result of a valid style hash. It passes if this text is green, and a "PASS" alert for p3 is fired.
+ This tests the result of a valid style hash. It passes if this text is green, and a "PASS" alert for p4 is fired.
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..3f0aff7db89
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: stylehash-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: style-src 'self' 'sha1-eYyYGmKWdhpUewohaXk9o8IaLSw=' 'sha256-hndjYvzUzy2Ykuad81Cwsl1FOXX/qYs/aDVyUyNZwBw=' 'sha384-bSVm1i3sjPBRM4TwZtYTDjk9JxZMExYHWbFmP1SxDhJH4ue0Wu9OPOkY5hcqRcSt' 'sha512-440MmBLtj9Kp5Bqloogn9BqGDylY8vFsv5/zXL1zH2fJVssCoskRig4gyM+9KqwvCSapSz5CVoUGHQcxv43UQg=='; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-basic-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-basic-blocked.sub.html
new file mode 100644
index 00000000000..274db01403c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-basic-blocked.sub.html
@@ -0,0 +1,61 @@
+
+
+
+
+
+ stylehash-basic-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
+ This tests the effect of a valid style-hash value, with one valid style and several invalid ones. It passes if the valid style is applied and a CSP violation is generated.
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-basic-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-basic-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..ac9ca4e870c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylehash-basic-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: stylehash-basic-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: style-src 'self' 'sha1-pfeR5wMA6np45oqDTP6Pj3tLpJo='; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-allowed.sub.html
new file mode 100644
index 00000000000..3588a631bb9
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-allowed.sub.html
@@ -0,0 +1,54 @@
+
+
+
+
+
+ stylenonce-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+ This text should be green.
+ This text should also be green.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..28c85c91a94
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: stylenonce-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: style-src 'self' 'nonce-noncynonce' 'nonce-noncy+/=nonce'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-blocked.sub.html
new file mode 100644
index 00000000000..8bf450d74e9
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-blocked.sub.html
@@ -0,0 +1,38 @@
+
+
+
+
+
+ stylenonce-blocked
+
+
+ This text should be green.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..e51a02dd0be
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib-2/stylenonce-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: stylenonce-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
+Content-Security-Policy: style-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-do-not-match-self.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-do-not-match-self.sub.html
new file mode 100644
index 00000000000..3f25b94834f
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-do-not-match-self.sub.html
@@ -0,0 +1,36 @@
+
+
+
+
+
+ blob-urls-do-not-match-self
+
+
+
+
+
+
+
+
+
+ blob: URLs are same-origin with the page in which they were created, but explicitly do not match the 'self' or '*' source in CSP directives because they are more akin to 'unsafe-inline' content.
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-do-not-match-self.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-do-not-match-self.sub.html.sub.headers
new file mode 100644
index 00000000000..41c66413ca0
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-do-not-match-self.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: blob-urls-do-not-match-self={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' '*'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-match-blob.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-match-blob.sub.html
new file mode 100644
index 00000000000..819c1a699f2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-match-blob.sub.html
@@ -0,0 +1,36 @@
+
+
+
+
+
+ blob-urls-match-blob
+
+
+
+
+
+
+
+
+
+ blob: URLs are same-origin with the page in which they were created, but match only if the blob: scheme is specified.
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-match-blob.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-match-blob.sub.html.sub.headers
new file mode 100644
index 00000000000..be74e61a78b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/blob-urls-match-blob.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: blob-urls-match-blob={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' blob:; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/combine-multiple-policies.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/combine-multiple-policies.sub.html
new file mode 100644
index 00000000000..be778e44df0
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/combine-multiple-policies.sub.html
@@ -0,0 +1,50 @@
+
+
+
+
+
+ combine-multiple-policies
+
+
+
+
+
+
+
+
+ This test checks that we enforce all the supplied policies. This test passe if it doesn't alert fail and if the style doesn't apply.
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/combine-multiple-policies.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/combine-multiple-policies.sub.html.sub.headers
new file mode 100644
index 00000000000..eec4b0be352
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/combine-multiple-policies.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: combine-multiple-policies={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline'; connect-src 'self'; style-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
\ No newline at end of file
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-allowed.sub.html
new file mode 100644
index 00000000000..c07fecee8b6
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-allowed.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ connect-src-beacon-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..bd3eda40a86
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-beacon-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self' http://{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-blocked.sub.html
new file mode 100644
index 00000000000..135f69b3e13
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-blocked.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ connect-src-beacon-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..69ded8da7fb
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-beacon-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self'; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-redirect-to-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-redirect-to-blocked.sub.html
new file mode 100644
index 00000000000..0b5c6d8328d
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-redirect-to-blocked.sub.html
@@ -0,0 +1,30 @@
+
+
+
+
+
+ connect-src-beacon-redirect-to-blocked
+
+
+
+
+
+
+
+
+
+ The beacon should not follow the redirect to http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/support/fail.png and send a CSP violation report.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-redirect-to-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-redirect-to-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..2c69d0dc866
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-beacon-redirect-to-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-beacon-redirect-to-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self'; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-allowed.sub.html
new file mode 100644
index 00000000000..f7a90c13d1b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-allowed.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ connect-src-eventsource-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..eff5c546a8f
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-eventsource-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self' http://{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-blocked.sub.html
new file mode 100644
index 00000000000..099b123c2c9
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-blocked.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ connect-src-eventsource-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..ac37816a439
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-eventsource-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self'; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-redirect-to-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-redirect-to-blocked.sub.html
new file mode 100644
index 00000000000..129a2613690
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-redirect-to-blocked.sub.html
@@ -0,0 +1,39 @@
+
+
+
+
+
+ connect-src-eventsource-redirect-to-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-redirect-to-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-redirect-to-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..c63c8a9dea0
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-eventsource-redirect-to-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-eventsource-redirect-to-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self' http://{{host}}:{{ports[http][0]}}/security/contentSecurityPolicy/resources/redir.php; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-allowed.sub.html
new file mode 100644
index 00000000000..a633681542d
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-allowed.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ connect-src-websocket-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..707435174f7
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-websocket-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self' ws://127.0.0.1:8880; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-blocked.sub.html
new file mode 100644
index 00000000000..540ac1ee6bb
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-blocked.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ connect-src-websocket-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..69036f5bdde
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-websocket-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-websocket-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self' ws://127.0.0.1:8880; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-allowed.sub.html
new file mode 100644
index 00000000000..6b2a444fc35
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-allowed.sub.html
@@ -0,0 +1,32 @@
+
+
+
+
+
+ connect-src-xmlhttprequest-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..dbabcad7a02
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-xmlhttprequest-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self' http://{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-blocked.sub.html
new file mode 100644
index 00000000000..b72973b88de
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-blocked.sub.html
@@ -0,0 +1,32 @@
+
+
+
+
+
+ connect-src-xmlhttprequest-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..d338034cfc1
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-xmlhttprequest-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self'; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-redirect-to-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-redirect-to-blocked.sub.html
new file mode 100644
index 00000000000..148f68228c8
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-redirect-to-blocked.sub.html
@@ -0,0 +1,40 @@
+
+
+
+
+
+ connect-src-xmlhttprequest-redirect-to-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-redirect-to-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-redirect-to-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..452104ecd8e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/connect-src-xmlhttprequest-redirect-to-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: connect-src-xmlhttprequest-redirect-to-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: connect-src 'self'; script-src 'self' 'unsafe-inline'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-allowed.sub.html
new file mode 100644
index 00000000000..f5859087a29
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-allowed.sub.html
@@ -0,0 +1,26 @@
+
+
+
+
+
+ default-src-inline-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..f223f066176
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: default-src-inline-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: default-src 'self' about: 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-blocked.sub.html
new file mode 100644
index 00000000000..ad66a9d1f44
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-blocked.sub.html
@@ -0,0 +1,27 @@
+
+
+
+
+
+ default-src-inline-blocked
+
+
+
+
+
+
+ This test passes if the inline scripts don't create failing tests and a CSP report is sent.
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..63ea706f955
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/default-src-inline-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: default-src-inline-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: default-src 'self'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/duplicate-directive.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/duplicate-directive.sub.html
new file mode 100644
index 00000000000..4336b729b28
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/duplicate-directive.sub.html
@@ -0,0 +1,29 @@
+
+
+
+
+
+ duplicate-directive
+
+
+
+
+
+
+
+
+
+
+
+ This tests the effect of duplicated directives. It passes if the alert_assert() is executed.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/duplicate-directive.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/duplicate-directive.sub.html.sub.headers
new file mode 100644
index 00000000000..eefd7197f0f
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/duplicate-directive.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: duplicate-directive={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline'; script-src 'none'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-allowed.sub.html
new file mode 100644
index 00000000000..88da806a895
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-allowed.sub.html
@@ -0,0 +1,29 @@
+
+
+
+
+
+ eval-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..6bf55a116ea
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: eval-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-and-sends-report.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-and-sends-report.sub.html
new file mode 100644
index 00000000000..599b01c3138
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-and-sends-report.sub.html
@@ -0,0 +1,29 @@
+
+
+
+
+
+ eval-blocked-and-sends-report
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-and-sends-report.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-and-sends-report.sub.html.sub.headers
new file mode 100644
index 00000000000..f197e41de3a
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-and-sends-report.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: eval-blocked-and-sends-report={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-in-about-blank-iframe.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-in-about-blank-iframe.sub.html
new file mode 100644
index 00000000000..449f9d1927b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-in-about-blank-iframe.sub.html
@@ -0,0 +1,10 @@
+
+
+Eval should be blocked in the iframe, but inline script should be allowed.
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-in-about-blank-iframe.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-in-about-blank-iframe.sub.html.sub.headers
new file mode 100644
index 00000000000..224f25ba7b5
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked-in-about-blank-iframe.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: eval-blocked-in-about-blank-iframe={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked.sub.html
new file mode 100644
index 00000000000..229667e7d66
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked.sub.html
@@ -0,0 +1,37 @@
+
+
+
+
+
+ eval-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..124f56bfad3
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: eval-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-allowed.sub.html
new file mode 100644
index 00000000000..66fa95d31e2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-allowed.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ eval-scripts-setInterval-allowed
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..f13ba4c644e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: eval-scripts-setInterval-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-blocked.sub.html
new file mode 100644
index 00000000000..45d873c8027
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-blocked.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ eval-scripts-setInterval-blocked
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..1bd6b636db1
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setInterval-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: eval-scripts-setInterval-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-allowed.sub.html
new file mode 100644
index 00000000000..9b2e595e5d4
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-allowed.sub.html
@@ -0,0 +1,30 @@
+
+
+
+
+
+ eval-scripts-setTimeout-allowed
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..4d664d600b9
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: eval-scripts-setTimeout-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-blocked.sub.html
new file mode 100644
index 00000000000..72ed2ce1a37
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-blocked.sub.html
@@ -0,0 +1,30 @@
+
+
+
+
+
+ eval-scripts-setTimeout-blocked
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..81537fe3ebb
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/eval-scripts-setTimeout-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: eval-scripts-setTimeout-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-do-not-match-self.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-do-not-match-self.sub.html
new file mode 100644
index 00000000000..e3ab5ea6dd4
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-do-not-match-self.sub.html
@@ -0,0 +1,48 @@
+
+
+
+
+
+ filesystem-urls-do-not-match-self
+
+
+
+
+
+
+
+
+
+ filesystem: URLs are same-origin with the page in which they were created, but explicitly do not match the 'self' or '*' source in CSP directives because they are more akin to 'unsafe-inline' content..
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-do-not-match-self.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-do-not-match-self.sub.html.sub.headers
new file mode 100644
index 00000000000..fa4fbee48e1
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-do-not-match-self.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: filesystem-urls-do-not-match-self={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' '*'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-match-filesystem.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-match-filesystem.sub.html
new file mode 100644
index 00000000000..e835c95ac87
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-match-filesystem.sub.html
@@ -0,0 +1,48 @@
+
+
+
+
+
+ filesystem-urls-match-filesystem
+
+
+
+
+
+
+
+
+
+ filesystem: URLs are same-origin with the page in which they were created, but explicitly do not match the 'self' or '*' source in CSP directives because they are more akin to 'unsafe-inline' content, but should match filesystem: source.
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-match-filesystem.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-match-filesystem.sub.html.sub.headers
new file mode 100644
index 00000000000..f9956ede828
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/filesystem-urls-match-filesystem.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: filesystem-urls-match-filesystem={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' filesystem:; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-about-blank-allowed-by-default.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-about-blank-allowed-by-default.sub.html
new file mode 100644
index 00000000000..f88b3e57d37
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-about-blank-allowed-by-default.sub.html
@@ -0,0 +1,4 @@
+
+These frames should not be blocked by Content-Security-Policy. It's pointle to block about:blank iframes because blocking a frame just results in displaying about:blank anyway!
+
+frame-src-cross-origin-load
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-cross-origin-load.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-cross-origin-load.sub.html.sub.headers
new file mode 100644
index 00000000000..0970bbebf3a
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-cross-origin-load.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: frame-src-cross-origin-load={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: frame-src 'self' http://www1.{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-redirect-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-redirect-blocked.sub.html
new file mode 100644
index 00000000000..a8d4af4a569
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-redirect-blocked.sub.html
@@ -0,0 +1 @@
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-redirect-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-redirect-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..43a16c21826
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/frame-src-redirect-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: frame-src-redirect-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: frame-src 127.0.0.1:8000; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-allowed.sub.html
new file mode 100644
index 00000000000..92cd088c52f
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-allowed.sub.html
@@ -0,0 +1,25 @@
+
+
+
+
+
+ function-constructor-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..dd80ebaccb4
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: function-constructor-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline' 'unsafe-eval'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-blocked.sub.html
new file mode 100644
index 00000000000..be0c574776e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-blocked.sub.html
@@ -0,0 +1,29 @@
+
+
+
+
+
+ function-constructor-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..eb7da39cb91
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/function-constructor-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: function-constructor-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-allowed.sub.html
new file mode 100644
index 00000000000..8bacdd30594
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-allowed.sub.html
@@ -0,0 +1,19 @@
+
+
+
+Use callbacks to show that favicons are loaded as allowed by CSP when link tags are dynamically added to the page.
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..b7d557b52ed
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: icon-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src http://localhost; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-blocked.sub.html
new file mode 100644
index 00000000000..978f25f63d1
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-blocked.sub.html
@@ -0,0 +1,17 @@
+
+
+
+Use callbacks to show that favicons are not loaded in violation of CSP when link tags are dynamically added to the page.
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..c4dc69985ca
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/icon-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: icon-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/iframe-inside-csp.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/iframe-inside-csp.sub.html
new file mode 100644
index 00000000000..f3d1e142415
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/iframe-inside-csp.sub.html
@@ -0,0 +1 @@
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/iframe-inside-csp.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/iframe-inside-csp.sub.html.sub.headers
new file mode 100644
index 00000000000..2cb1c72149c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/iframe-inside-csp.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: iframe-inside-csp={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'self'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-allowed.sub.html
new file mode 100644
index 00000000000..c087692db9a
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-allowed.sub.html
@@ -0,0 +1,22 @@
+
+
+
+
+
+ image-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..3b85fc689b2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: image-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src *; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-blocked.sub.html
new file mode 100644
index 00000000000..e572070ef6e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-blocked.sub.html
@@ -0,0 +1,23 @@
+
+
+
+
+
+ image-blocked
+
+
+
+
+
+
+
+
+ This test passes if it doesn't alert FAIL and does alert PASS.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..c58bb88bb37
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: image-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-full-host-wildcard-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-full-host-wildcard-allowed.sub.html
new file mode 100644
index 00000000000..6482654cdf3
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-full-host-wildcard-allowed.sub.html
@@ -0,0 +1,22 @@
+
+
+
+
+
+ image-full-host-wildcard-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-full-host-wildcard-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-full-host-wildcard-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..0f384f0931d
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-full-host-wildcard-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: image-full-host-wildcard-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src http://*.{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-allowed.sub.html
new file mode 100644
index 00000000000..5594a761551
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-allowed.sub.html
@@ -0,0 +1,22 @@
+
+
+
+
+
+ injected-inline-script-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..80315fb217f
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: injected-inline-script-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' http://127.0.0.1:* 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-blocked.sub.html
new file mode 100644
index 00000000000..6e910e5eab2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-blocked.sub.html
@@ -0,0 +1,20 @@
+
+
+
+
+
+ injected-inline-script-blocked
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..e90dec673c0
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: injected-inline-script-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-allowed.sub.html
new file mode 100644
index 00000000000..f52289e4964
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-allowed.sub.html
@@ -0,0 +1,35 @@
+
+
+
+
+
+ injected-inline-style-allowed
+
+
+
+
+
+
+
+
+
+ FAIL 1/2
+
+
+ FAIL 2/2
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..8a48dc2487b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: injected-inline-style-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: style-src 'unsafe-inline'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-blocked.sub.html
new file mode 100644
index 00000000000..1ed46cb6532
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-blocked.sub.html
@@ -0,0 +1,32 @@
+
+
+
+
+
+ injected-inline-style-blocked
+
+
+
+
+
+
+
+
+
+ PASS 1/2
+
+
+ PASS 2/2
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..d3f0a5efb85
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-style-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: injected-inline-style-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: style-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed-while-cloning-objects.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed-while-cloning-objects.sub.html
new file mode 100644
index 00000000000..31112b1adc5
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed-while-cloning-objects.sub.html
@@ -0,0 +1,129 @@
+
+
+
+
+
+ inline-style-allowed-while-cloning-objects
+
+
+
+
+
+
+
+
+
+
+
+ This is a div (nodes)
+
This is a div. (node 1 or 2)
+
This is a div. (node 3 or 4)
+
+ Yet another div.
+
+
+ Yet another div.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed-while-cloning-objects.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed-while-cloning-objects.sub.html.sub.headers
new file mode 100644
index 00000000000..963fa175175
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed-while-cloning-objects.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: inline-style-allowed-while-cloning-objects={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: style-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed.sub.html
new file mode 100644
index 00000000000..bf5ac125d25
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ inline-style-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..8ff58f55f2c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: inline-style-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: style-src 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-allowed.sub.html
new file mode 100644
index 00000000000..ab446040a60
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-allowed.sub.html
@@ -0,0 +1,25 @@
+
+
+
+
+
+ inline-style-attribute-allowed
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..7d765e2b698
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: inline-style-attribute-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: style-src 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-blocked.sub.html
new file mode 100644
index 00000000000..90efe9fe7e1
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-blocked.sub.html
@@ -0,0 +1,25 @@
+
+
+
+
+
+ inline-style-attribute-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..0b1ec14c1df
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: inline-style-attribute-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: style-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-on-html.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-on-html.sub.html
new file mode 100644
index 00000000000..b002af987d4
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-on-html.sub.html
@@ -0,0 +1,28 @@
+
+
+
+
+
+ inline-style-attribute-on-html
+
+
+
+
+
+
+
+
+ Even though this page has a CSP policy the blocks inline style, the style attribute on the HTML element still takes effect because it preceeds the meta element.
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-on-html.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-on-html.sub.html.sub.headers
new file mode 100644
index 00000000000..66bf93faa1c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-attribute-on-html.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: inline-style-attribute-on-html={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-blocked.sub.html
new file mode 100644
index 00000000000..3f7756e4498
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-blocked.sub.html
@@ -0,0 +1,31 @@
+
+
+
+
+
+ inline-style-blocked
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..0b83063268d
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/inline-style-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: inline-style-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: style-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/manifest-src-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/manifest-src-allowed.sub.html
new file mode 100644
index 00000000000..fe6d2b1c2c6
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/manifest-src-allowed.sub.html
@@ -0,0 +1,9 @@
+This test passes if it doesn't alert failure.
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/media-src-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/media-src-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..86c56953dbc
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/media-src-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: media-src-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: media-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/media-src-track-block.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/media-src-track-block.sub.html
new file mode 100644
index 00000000000..c8036ce174c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/media-src-track-block.sub.html
@@ -0,0 +1,39 @@
+
+
+
+
+ media-src-track-block
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/media-src-track-block.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/media-src-track-block.sub.html.sub.headers
new file mode 100644
index 00000000000..85c496e74f3
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/media-src-track-block.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: media-src-track-block={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: media-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-in-svg-foreignobject.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-in-svg-foreignobject.sub.html
new file mode 100644
index 00000000000..358b7af1a7e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-in-svg-foreignobject.sub.html
@@ -0,0 +1,28 @@
+
+
+
+
+
+ object-in-svg-foreignobject
+
+
+
+
+
+
+
+
+ This test ensures that objects inside SVG foreignobject elements are beholden to the same policy as the rest of the document. This test passes if there i a CSP violation saying the plugin was blocked.
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-in-svg-foreignobject.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-in-svg-foreignobject.sub.html.sub.headers
new file mode 100644
index 00000000000..a196a15589e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-in-svg-foreignobject.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-in-svg-foreignobject={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive-codebase.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive-codebase.sub.html
new file mode 100644
index 00000000000..45635778216
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive-codebase.sub.html
@@ -0,0 +1,42 @@
+
+
+
+
+
+ object-src-applet-archive-codebase
+
+
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive-codebase.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive-codebase.sub.html.sub.headers
new file mode 100644
index 00000000000..0b71a188bab
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive-codebase.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-applet-archive-codebase={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive.sub.html
new file mode 100644
index 00000000000..06a36ccd24c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive.sub.html
@@ -0,0 +1,42 @@
+
+
+
+
+
+ object-src-applet-archive
+
+
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive.sub.html.sub.headers
new file mode 100644
index 00000000000..4bd5ec149f6
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-archive.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-applet-archive={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code-codebase.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code-codebase.sub.html
new file mode 100644
index 00000000000..62ab2301463
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code-codebase.sub.html
@@ -0,0 +1,42 @@
+
+
+
+
+
+ object-src-applet-archive-code-codebase
+
+
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code-codebase.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code-codebase.sub.html.sub.headers
new file mode 100644
index 00000000000..1ced1a8e2c0
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code-codebase.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-applet-code-codebase={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code.sub.html
new file mode 100644
index 00000000000..9a697b0daf3
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code.sub.html
@@ -0,0 +1,42 @@
+
+
+
+
+
+ object-src-applet-code
+
+
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code.sub.html.sub.headers
new file mode 100644
index 00000000000..44bd725f817
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-applet-code.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-applet-code={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-allowed.sub.html
new file mode 100644
index 00000000000..2e2bef25d3e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-allowed.sub.html
@@ -0,0 +1,23 @@
+
+
+
+
+
+ object-src-no-url-allowed
+
+
+
+
+
+
+
+
+ This test passes if there isn't a CSP violation saying the plugin was blocked.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..3746103fe4a
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-no-url-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-blocked.sub.html
new file mode 100644
index 00000000000..ad3eebcaeb5
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-blocked.sub.html
@@ -0,0 +1,23 @@
+
+
+
+
+
+ object-src-no-url-blocked
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..dba0ece704a
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-no-url-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-no-url-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-code-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-code-blocked.sub.html
new file mode 100644
index 00000000000..ae4bfb71759
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-code-blocked.sub.html
@@ -0,0 +1,27 @@
+
+
+
+
+
+ object-src-param-code-blocked
+
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-code-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-code-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..f7535ffbe93
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-code-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-param-code-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src http://localhost:8080; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-movie-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-movie-blocked.sub.html
new file mode 100644
index 00000000000..289c2c8edd3
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-movie-blocked.sub.html
@@ -0,0 +1,27 @@
+
+
+
+
+
+ object-src-param-movie-blocked
+
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-movie-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-movie-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..3f357a63f4b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-movie-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-param-movie-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src http://localhost:8080; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-src-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-src-blocked.sub.html
new file mode 100644
index 00000000000..9a0d9e0bee4
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-src-blocked.sub.html
@@ -0,0 +1,27 @@
+
+
+
+
+
+ object-src-param-src-blocked
+
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-src-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-src-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..c5a76850345
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-src-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-param-src-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src http://localhost:8080; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-url-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-url-blocked.sub.html
new file mode 100644
index 00000000000..f30550416f8
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-url-blocked.sub.html
@@ -0,0 +1,27 @@
+
+
+
+
+
+ object-src-param-url-blocked
+
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-url-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-url-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..baf227d985a
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-param-url-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-param-url-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src http://localhost:8080; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-allowed.sub.html
new file mode 100644
index 00000000000..dace2c417d6
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-allowed.sub.html
@@ -0,0 +1,23 @@
+
+
+
+
+
+ object-src-url-allowed
+
+
+
+
+
+
+
+
+ This test passes if there is no CSP violation saying the plugin was blocked.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..bce19c1defc
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-url-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-blocked.sub.html
new file mode 100644
index 00000000000..4f12d747b01
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-blocked.sub.html
@@ -0,0 +1,23 @@
+
+
+
+
+
+ object-src-url-blocked
+
+
+
+
+
+
+
+
+ This test passes if there is a CSP violation saying the plugin was blocked.
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-blocked.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-blocked.sub.html.sub.headers
new file mode 100644
index 00000000000..1447fd0fce2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/object-src-url-blocked.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: object-src-url-blocked={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: object-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/policy-does-not-affect-child.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/policy-does-not-affect-child.sub.html
new file mode 100644
index 00000000000..a43e4be27c2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/policy-does-not-affect-child.sub.html
@@ -0,0 +1 @@
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/policy-does-not-affect-child.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/policy-does-not-affect-child.sub.html.sub.headers
new file mode 100644
index 00000000000..ff37e37ee6f
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/policy-does-not-affect-child.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: policy-does-not-affect-child={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'self'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-blocked-data-uri.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-blocked-data-uri.sub.html
new file mode 100644
index 00000000000..dea8a87a31b
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-blocked-data-uri.sub.html
@@ -0,0 +1,22 @@
+
+
+
+
+
+ report-blocked-data-uri
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-blocked-data-uri.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-blocked-data-uri.sub.html.sub.headers
new file mode 100644
index 00000000000..8530a1cc4a1
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-blocked-data-uri.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-blocked-data-uri={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html
new file mode 100644
index 00000000000..ed2cd2a742d
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+ report-cross-origin-no-cookies
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html.sub.headers
new file mode 100644
index 00000000000..5a71229752e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-cross-origin-no-cookies={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline' http://www1.{{host}}:{{ports[http][0]}}; connect-src 'self'; report-uri http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html
new file mode 100644
index 00000000000..cb001a22094
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+ report-disallowed-from-meta
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html.sub.headers
new file mode 100644
index 00000000000..4c620525a37
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html.sub.headers
@@ -0,0 +1,5 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-disallowed-from-meta=5ada7c32-1c46-4b79-a95f-af33fcf95f8e; Path=/content-security-policy/blink-contrib
\ No newline at end of file
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-same-origin-with-cookies.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-same-origin-with-cookies.sub.html
new file mode 100644
index 00000000000..e90cb066b06
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-same-origin-with-cookies.sub.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+ report-cross-origin-no-cookies
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-same-origin-with-cookies.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-same-origin-with-cookies.sub.html.sub.headers
new file mode 100644
index 00000000000..4655de25482
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-same-origin-with-cookies.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-same-origin-with-cookies={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-inline-javascript.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-inline-javascript.sub.html
new file mode 100644
index 00000000000..cf3f72f1e7d
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-inline-javascript.sub.html
@@ -0,0 +1,28 @@
+
+
+
+
+
+ report-uri-from-inline-javascript
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-inline-javascript.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-inline-javascript.sub.html.sub.headers
new file mode 100644
index 00000000000..c37a9ff8d73
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-inline-javascript.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-uri-from-inline-javascript={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-javascript.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-javascript.sub.html
new file mode 100644
index 00000000000..790a75bdad3
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-javascript.sub.html
@@ -0,0 +1,22 @@
+
+
+
+
+
+ report-uri-from-javascript
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-javascript.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-javascript.sub.html.sub.headers
new file mode 100644
index 00000000000..ed6560118b6
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-from-javascript.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-uri-from-javascript={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-scheme-relative.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-scheme-relative.sub.html
new file mode 100644
index 00000000000..c6aba864d68
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-scheme-relative.sub.html
@@ -0,0 +1,5 @@
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-scheme-relative.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-scheme-relative.sub.html.sub.headers
new file mode 100644
index 00000000000..d000f87ec5c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri-scheme-relative.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-uri-scheme-relative={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'self'; report-uri //127.0.0.1:8080/security/contentSecurityPolicy/resources/save-report.php?test=report-uri-scheme-relative.html; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri.sub.html
new file mode 100644
index 00000000000..9ffb835f2bf
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri.sub.html
@@ -0,0 +1,6 @@
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri.sub.html.sub.headers
new file mode 100644
index 00000000000..1416ea7f1d2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-uri.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-uri={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: script-src 'self' 'unsafe-inline' 'self'; report-uri resources/save-report.php?test=report-uri.html; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-fail.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-fail.html
new file mode 100644
index 00000000000..c0fb8173d50
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-fail.html
@@ -0,0 +1,4 @@
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-fail.js b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-fail.js
new file mode 100644
index 00000000000..40d2127b559
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-fail.js
@@ -0,0 +1 @@
+alert_assert('FAIL');
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-pass.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-pass.html
new file mode 100644
index 00000000000..50e753d0d32
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-pass.html
@@ -0,0 +1,4 @@
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-pass.js b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-pass.js
new file mode 100644
index 00000000000..ec2f0076d57
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/alert-pass.js
@@ -0,0 +1 @@
+alert_assert('PASS');
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/blue.css b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/blue.css
new file mode 100644
index 00000000000..54aeecc12f5
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/blue.css
@@ -0,0 +1,3 @@
+.target {
+ background-color: blue;
+}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/child-src-test.js b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/child-src-test.js
new file mode 100644
index 00000000000..fd09f153716
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/child-src-test.js
@@ -0,0 +1,66 @@
+var EXPECT_BLOCK = true;
+var EXPECT_LOAD = false;
+
+window.jsTestIsAsync = true;
+window.wasPostTestScriptParsed = true;
+
+var iframe;
+
+function injectFrame(url, shouldBlock) {
+ window.onload = function() {
+ iframe = document.createElement('iframe');
+ iframe.onload = iframeLoaded(shouldBlock);
+ iframe.src = url;
+ document.body.appendChild(iframe);
+ };
+}
+
+function iframeLoaded(expectBlock) {
+ return function(ev) {
+ var failed = true;
+ try {
+ console.log("IFrame load event fired: the IFrame's location is '" + ev.target.contentWindow.location.href + "'.");
+ if (expectBlock) {
+ testFailed("The IFrame should have been blocked (or cross-origin). It wasn't.");
+ failed = true;
+ } else {
+ testPassed("The IFrame should not have been blocked. It wasn't.");
+ failed = false;
+ }
+ } catch (ex) {
+ debug("IFrame load event fired: the IFrame is cross-origin (or was blocked).");
+ if (expectBlock) {
+ testPassed("The IFrame should have been blocked (or cross-origin). It was.");
+ failed = false;
+ } else {
+ testFailed("The IFrame should not have been blocked. It was.");
+ failed = true;
+ }
+ }
+ finishJSTest();
+ };
+}
+
+function injectFrameRedirectingTo(url, shouldBlock) {
+ injectFrame("/security/contentSecurityPolicy/resources/redir.php?url=" + url, shouldBlock);
+}
+
+function injectWorker(url, expectBlock) {
+ window.onload = function() {
+ if (expectBlock == EXPECT_BLOCK)
+ shouldThrow("var w = new Worker('" + url + "');");
+ else
+ shouldNotThrow("var w = new Worker('" + url + "');");
+ finishJSTest();
+ };
+}
+
+function injectSharedWorker(url, expectBlock) {
+ window.onload = function() {
+ if (expectBlock == EXPECT_BLOCK)
+ shouldThrow("var w = new SharedWorker('" + url + "');");
+ else
+ shouldNotThrow("var w = new SharedWorker('" + url + "');");
+ finishJSTest();
+ };
+}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/document-write-alert-fail.js b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/document-write-alert-fail.js
new file mode 100644
index 00000000000..5e78ca0dac3
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/document-write-alert-fail.js
@@ -0,0 +1 @@
+document.write("");
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/dump-as-text.js b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/dump-as-text.js
new file mode 100644
index 00000000000..a229b1fc75c
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/dump-as-text.js
@@ -0,0 +1,2 @@
+if (window.testRunner)
+ testRunner.dumpAsText();
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/frame-ancestors-test.js b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/frame-ancestors-test.js
new file mode 100644
index 00000000000..e4b12d4faf7
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/frame-ancestors-test.js
@@ -0,0 +1,109 @@
+var SAME_ORIGIN = true;
+var CROSS_ORIGIN = false;
+
+var EXPECT_BLOCK = true;
+var EXPECT_LOAD = false;
+
+var SAMEORIGIN_ORIGIN = "http://127.0.0.1:8000";
+var CROSSORIGIN_ORIGIN = "http://localhost:8080";
+
+window.jsTestIsAsync = true;
+window.wasPostTestScriptParsed = true;
+
+if (window.testRunner)
+ testRunner.dumpChildFramesAsText();
+
+window.addEventListener("message", function(e) {
+ if (window.parent != window) {
+ window.parent.postMessage(e.data, "*");
+ } else {
+ if (e.data)
+ testFailed("The inner IFrame failed.");
+ else
+ testPassed("The inner IFrame passed.");
+
+ finishJSTest();
+ }
+});
+
+function injectNestedIframe(policy, parent, child, expectation) {
+ var iframe = document.createElement("iframe");
+
+ var url = "/security/contentSecurityPolicy/resources/frame-in-frame.pl?" + "policy=" + policy + "&parent=" + parent + "&child=" + child + "&expectation=" + expectation;
+ url = (parent == "same" ? SAMEORIGIN_ORIGIN : CROSSORIGIN_ORIGIN) + url;
+
+ iframe.src = url;
+ document.body.appendChild(iframe);
+}
+
+function injectIFrame(policy, sameOrigin, expectBlock) {
+ var iframe = document.createElement("iframe");
+ iframe.addEventListener("load", iframeLoaded(expectBlock));
+ iframe.addEventListener("error", iframeLoaded(expectBlock));
+
+ var url = "/security/contentSecurityPolicy/resources/frame-ancestors.pl?policy=" + policy;
+ if (!sameOrigin)
+ url = CROSSORIGIN_ORIGIN + url;
+
+ iframe.src = url;
+ document.body.appendChild(iframe);
+}
+
+function iframeLoaded(expectBlock) {
+ return function(ev) {
+ var failed = true;
+ try {
+ console.log("IFrame load event fired: the IFrame's location is '" + ev.target.contentWindow.location.href + "'.");
+ if (expectBlock) {
+ testFailed("The IFrame should have been blocked (or cross-origin). It wasn't.");
+ failed = true;
+ } else {
+ testPassed("The IFrame should not have been blocked. It wasn't.");
+ failed = false;
+ }
+ } catch (ex) {
+ debug("IFrame load event fired: the IFrame is cross-origin (or was blocked).");
+ if (expectBlock) {
+ testPassed("The IFrame should have been blocked (or cross-origin). It was.");
+ failed = false;
+ } else {
+ testFailed("The IFrame should not have been blocked. It was.");
+ failed = true;
+ }
+ }
+ if (window.parent != window)
+ window.parent.postMessage(failed, '*');
+ else
+ finishJSTest();
+ };
+}
+
+function crossOriginFrameShouldBeBlocked(policy) {
+ window.onload = function() {
+ injectIFrame(policy, CROSS_ORIGIN, EXPECT_BLOCK);
+ };
+}
+
+function crossOriginFrameShouldBeAllowed(policy) {
+ window.onload = function() {
+ injectIFrame(policy, CROSS_ORIGIN, EXPECT_LOAD);
+ };
+}
+
+function sameOriginFrameShouldBeBlocked(policy) {
+ window.onload = function() {
+ injectIFrame(policy, SAME_ORIGIN, EXPECT_BLOCK);
+ };
+}
+
+function sameOriginFrameShouldBeAllowed(policy) {
+ window.onload = function() {
+ injectIFrame(policy, SAME_ORIGIN, EXPECT_LOAD);
+ };
+}
+
+function testNestedIFrame(policy, parent, child, expectation) {
+ window.onload = function() {
+ injectNestedIframe(policy, parent == SAME_ORIGIN ? "same" : "cross", child == SAME_ORIGIN ? "same" : "cross", expectation == EXPECT_LOAD ? "Allowed" : "Blocked");
+ };
+}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/generate-csp-report.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/generate-csp-report.html
new file mode 100644
index 00000000000..887f44f48b6
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/resources/generate-csp-report.html
@@ -0,0 +1,7 @@
+ 
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..3b85fc689b2
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: image-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src *; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-blocked.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-blocked.sub.html
new file mode 100644
index 00000000000..e572070ef6e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-blocked.sub.html
@@ -0,0 +1,23 @@
+
+
+
+
+
+ 
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-full-host-wildcard-allowed.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-full-host-wildcard-allowed.sub.html.sub.headers
new file mode 100644
index 00000000000..0f384f0931d
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/image-full-host-wildcard-allowed.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: image-full-host-wildcard-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src http://*.{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-allowed.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-allowed.sub.html
new file mode 100644
index 00000000000..5594a761551
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/injected-inline-script-allowed.sub.html
@@ -0,0 +1,22 @@
+
+
+
+
+
+ 
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-blocked-data-uri.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-blocked-data-uri.sub.html.sub.headers
new file mode 100644
index 00000000000..8530a1cc4a1
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-blocked-data-uri.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-blocked-data-uri={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html
new file mode 100644
index 00000000000..ed2cd2a742d
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+ 
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html.sub.headers
new file mode 100644
index 00000000000..5a71229752e
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-cross-origin-no-cookies.sub.html.sub.headers
@@ -0,0 +1,6 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-cross-origin-no-cookies={{$id:uuid()}}; Path=/content-security-policy/blink-contrib
+Content-Security-Policy: img-src 'none'; script-src 'self' 'unsafe-inline' http://www1.{{host}}:{{ports[http][0]}}; connect-src 'self'; report-uri http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/support/report.py?op=put&reportID={{$id}}
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html
new file mode 100644
index 00000000000..cb001a22094
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+ 
+
+
+
+
+
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html.sub.headers b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html.sub.headers
new file mode 100644
index 00000000000..4c620525a37
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-disallowed-from-meta.sub.html.sub.headers
@@ -0,0 +1,5 @@
+Expires: Mon, 26 Jul 1997 05:00:00 GMT
+Cache-Control: no-store, no-cache, must-revalidate
+Cache-Control: post-check=0, pre-check=0, false
+Pragma: no-cache
+Set-Cookie: report-disallowed-from-meta=5ada7c32-1c46-4b79-a95f-af33fcf95f8e; Path=/content-security-policy/blink-contrib
\ No newline at end of file
diff --git a/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-same-origin-with-cookies.sub.html b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-same-origin-with-cookies.sub.html
new file mode 100644
index 00000000000..e90cb066b06
--- /dev/null
+++ b/tests/wpt/web-platform-tests/content-security-policy/blink-contrib/report-same-origin-with-cookies.sub.html
@@ -0,0 +1,24 @@
+
+
+
+
+
+