Block scripts with text/csv, audio/*, video/* and image/* mime types

This commit is contained in:
Fernando Jiménez Moreno 2017-03-24 19:47:56 +01:00
parent c31ee6e300
commit 29a56c4d1a
4 changed files with 83 additions and 1 deletions

View file

@ -0,0 +1,39 @@
<!doctype html>
<meta charset="utf-8">
<title>Block mime type as script</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<div></div>
<script>
var noop = function() {};
["text/csv",
"audio/aiff",
"audio/midi",
"audio/whatever",
"video/avi",
"video/fli",
"video/whatever",
"image/jpeg",
"image/gif",
"image/whatever"].forEach(function(test_case) {
async_test(function(t) {
var script = document.createElement("script");
script.onerror = t.step_func_done(noop);
script.onload = t.unreached_func("Unexpected load event");
script.src = "../resources/script-with-header.py?mime=" + test_case;
document.body.appendChild(script);
}, "Should fail loading script with " + test_case + " MIME type");
});
["html", "plain"].forEach(function(test_case) {
async_test(function(t) {
var script = document.createElement("script");
script.onerror = t.unreached_func("Unexpected error event");
script.onload = t.step_func_done(noop);
script.src = "../resources/script-with-header.py?mime=text/" + test_case;
document.body.appendChild(script);
}, "Should load script with text/" + test_case + " MIME type");
});
</script>