Mirrors/servo
1
0
Fork 0
mirror of https://github.com/servo/servo.git synced 2025-08-27 16:18:21 +01:00
Code Issues Projects Releases Packages Wiki Activity

Update web-platform-tests to revision be5419e845d39089ba6dc338c1bd0fa279108317

Browse source
This commit is contained in:
Josh Matthews 2018-01-04 13:44:24 -05:00
parent aa199307c8
commit 2b6f573eb5
3440 changed files with 109438 additions and 41750 deletions
Download patch file Download diff file Expand all files Collapse all files

200
tests/wpt/web-platform-tests/worklets/resources/credentials-tests.js
View file

@ -1,106 +1,130 @@
function createCookieValue(settings) {
return settings.credentials + '-' + settings.origin;
}
function createSetCookieURL(settings) {
const params = new URLSearchParams;
params.append('name', 'cookieName');
params.append('value', createCookieValue(settings));
if (settings.origin == 'same') {
return get_host_info().HTTPS_ORIGIN +
'/worklets/resources/set-cookie.py?' + params;
}
if (settings.origin == 'remote') {
return get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/set-cookie.py?' + params;
}
assert_unreached('settings.origin has an invalid value.');
}
function createScriptURL(settings) {
const params = new URLSearchParams;
if (settings.expectCredentialsSent)
params.append('value', createCookieValue(settings));
if (settings.origin == 'same') {
return get_host_info().HTTPS_ORIGIN +
'/worklets/resources/credentials.py?' + params;
}
if (settings.origin == 'remote') {
return get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/credentials.py?' + params;
}
assert_unreached('settings.origin has an invalid value.');
}
function createWorkletOptions(settings) {
if (settings.credentials == '')
return {};
return { credentials: settings.credentials };
}
// Run a credentials test with the given settings.
//
// Example:
// settings = {
// workletType: 'paint',
// credentials: 'include',
// origin: 'same', // 'same' or 'remote'
// expectCredentialsSent: true
// };
function runCredentialsTest(settings) {
const worklet = get_worklet(settings.workletType);
const setCookieURL = createSetCookieURL(settings);
const scriptURL = createScriptURL(settings);
const options = createWorkletOptions(settings);
// { credentials: 'include' } is necessary for configuring document's cookies
// with the Set-Cookie: header of the response.
return fetch(setCookieURL, { mode: 'cors', credentials: 'include' })
.then(response => worklet.addModule(scriptURL, options));
}
// Runs a series of tests related to credentials on a worklet.
//
// Usage:
// runCredentialsTests("paint");
function runCredentialsTests(worklet_type) {
const worklet = get_worklet(worklet_type);
promise_test(() => {
document.cookie = 'cookieName=default';
const kScriptURL = 'resources/credentials.py?mode=default';
return worklet.addModule(kScriptURL).then(undefined_arg => {
assert_equals(undefined_arg, undefined);
});
return runCredentialsTest({ workletType: worklet_type,
credentials: '',
origin: 'same',
expectCredentialsSent: false });
}, 'Importing a same-origin script with the default WorkletOptions should ' +
'omit the credentials');
'not send the credentials');
promise_test(() => {
const kSetCookieURL =
get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/set-cookie.py?name=cookieName';
const kScriptURL = get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/credentials.py?mode=default';
const kOptions = { credentials: 'same-origin' };
// Set a cookie in the remote origin and then start a worklet.
return fetch(kSetCookieURL, { mode: 'cors' })
.then(() => worklet.addModule(kScriptURL, kOptions))
.then(undefined_arg => assert_equals(undefined_arg, undefined));
return runCredentialsTest({ workletType: worklet_type,
credentials: '',
origin: 'remote',
expectCredentialsSent: false });
}, 'Importing a remote-origin script with the default WorkletOptions ' +
'should not include the credentials');
'should not send the credentials');
promise_test(() => {
document.cookie = 'cookieName=omit';
const kScriptURL = 'resources/credentials.py?mode=omit';
const kOptions = { credentials: 'omit' };
return worklet.addModule(kScriptURL, kOptions).then(undefined_arg => {
assert_equals(undefined_arg, undefined);
});
}, 'Importing a same-origin script with credentials=omit should omit the ' +
'credentials');
promise_test(() => {
const kSetCookieURL =
get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/set-cookie.py?name=cookieName';
const kScriptURL = get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/credentials.py?mode=omit';
const kOptions = { credentials: 'omit' };
// Set a cookie in the remote origin and then start a worklet.
return fetch(kSetCookieURL, { mode: 'cors' })
.then(() => worklet.addModule(kScriptURL, kOptions))
.then(undefined_arg => assert_equals(undefined_arg, undefined));
}, 'Importing a remote-origin script with credentials=omit should omit the ' +
'credentials');
promise_test(() => {
document.cookie = 'cookieName=same-origin';
const kScriptURL = 'resources/credentials.py?mode=same-origin';
const kOptions = { credentials: 'same-origin' };
return worklet.addModule(kScriptURL, kOptions).then(undefined_arg => {
assert_equals(undefined_arg, undefined);
});
}, 'Importing a same-origin script with credentials=same-origin should ' +
'include the credentials');
promise_test(() => {
const kSetCookieURL =
get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/set-cookie.py?name=cookieName';
const kScriptURL = get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/credentials.py?mode=same-origin';
const kOptions = { credentials: 'same-origin' };
// Set a cookie in the remote origin and then start a worklet.
return fetch(kSetCookieURL, { mode: 'cors' })
.then(() => worklet.addModule(kScriptURL, kOptions))
.then(undefined_arg => assert_equals(undefined_arg, undefined));
}, 'Importing a remote-origin script with credentials=same-origin should ' +
'not include the credentials');
promise_test(() => {
document.cookie = 'cookieName=include';
const kScriptURL = 'resources/credentials.py?mode=include';
const kOptions = { credentials: 'include' };
return worklet.addModule(kScriptURL, kOptions).then(undefined_arg => {
assert_equals(undefined_arg, undefined);
});
}, 'Importing a same-origin script with credentials=include should include ' +
return runCredentialsTest({ workletType: worklet_type,
credentials: 'omit',
origin: 'same',
expectCredentialsSent: false });
}, 'Importing a same-origin script with credentials=omit should not send ' +
'the credentials');
promise_test(() => {
const kSetCookieURL =
get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/set-cookie.py?name=cookieName';
const kScriptURL = get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/credentials.py?mode=include';
const kOptions = { credentials: 'include' };
return runCredentialsTest({ workletType: worklet_type,
credentials: 'omit',
origin: 'remote',
expectCredentialsSent: false });
}, 'Importing a remote-origin script with credentials=omit should not send ' +
'the credentials');
// Set a cookie in the remote origin and then start a worklet.
return fetch(kSetCookieURL, { mode: 'cors' })
.then(() => worklet.addModule(kScriptURL, kOptions))
.then(undefined_arg => assert_equals(undefined_arg, undefined));
promise_test(() => {
return runCredentialsTest({ workletType: worklet_type,
credentials: 'same-origin',
origin: 'same',
expectCredentialsSent: true });
}, 'Importing a same-origin script with credentials=same-origin should ' +
'send the credentials');
promise_test(() => {
return runCredentialsTest({ workletType: worklet_type,
credentials: 'same-origin',
origin: 'remote',
expectCredentialsSent: false });
}, 'Importing a remote-origin script with credentials=same-origin should ' +
'not send the credentials');
promise_test(() => {
return runCredentialsTest({ workletType: worklet_type,
credentials: 'include',
origin: 'same',
expectCredentialsSent: true });
}, 'Importing a same-origin script with credentials=include should send ' +
'the credentials');
promise_test(() => {
return runCredentialsTest({ workletType: worklet_type,
credentials: 'include',
origin: 'remote',
expectCredentialsSent: true });
}, 'Importing a remote-origin script with credentials=include should ' +
'include the credentials');
'send the credentials');
}

34
tests/wpt/web-platform-tests/worklets/resources/credentials.py
View file

@ -1,32 +1,14 @@
# Returns a valid response when a request has appropriate credentials.
def main(request, response):
credentials_mode = request.GET.first("mode")
cookie = request.cookies.first("cookieName", None)
source_origin = request.headers.get("origin", None);
is_cross_origin = request.GET.first("is_cross_origin", False)
expected_value = request.GET.first("value", None)
source_origin = request.headers.get("origin", None)
# The request with the default WorkletOptions should not include the cookie.
if credentials_mode is "default" and cookie is not None:
return (404)
response_headers = [("Content-Type", "text/javascript"),
("Access-Control-Allow-Origin", source_origin),
("Access-Control-Allow-Credentials", "true")]
# The request with "credentials=omit" should not include the cookie.
if credentials_mode is "omit" and cookie is not None:
return (404)
if cookie == expected_value:
return (200, response_headers, "")
if credentials_mode is "same-origin":
# The cross-origin request with "credentials=same-origin" should not
# include the cookie.
if is_cross_origin and cookie is not None:
return (404)
# The same-origin request with "credentials=same-origin" should include
# the cookie.
if not is_cross_origin and cookie is None:
return (404)
# The request with "credentials=include" should include the cookie.
if credentials_mode is "include" and cookie is None:
return (404)
return (200, [("Content-Type", "text/javascript"),
("Access-Control-Allow-Origin", source_origin),
("Access-Control-Allow-Credentials", "true")], "")
return (404, response_headers)

68
tests/wpt/web-platform-tests/worklets/resources/csp-tests.js
View file

@ -22,16 +22,13 @@ function openWindowAndExpectResult(windowURL, scriptURL, type, expectation) {
// Usage:
// runContentSecurityPolicyTests("paint");
function runContentSecurityPolicyTests(workletType) {
const worklet = get_worklet(workletType);
promise_test(t => {
const kWindowURL =
'resources/addmodule-window.html?pipe=header(' +
'Content-Security-Policy, script-src \'self\' \'unsafe-inline\')';
const kScriptURL =
get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/import-empty-worklet-script.js' +
'?pipe=header(Access-Control-Allow-Origin, *)';
'/worklets/resources/import-empty-worklet-script-with-cors-header.js';
return openWindowAndExpectResult(
kWindowURL, kScriptURL, workletType, 'REJECTED');
}, 'Importing a remote-origin worklet script should be blocked by the ' +
@ -51,9 +48,9 @@ function runContentSecurityPolicyTests(workletType) {
const kWindowURL =
'resources/addmodule-window.html?pipe=header(' +
'Content-Security-Policy, script-src * \'unsafe-inline\')';
const kScriptURL = get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/empty-worklet-script.js' +
'?pipe=header(Access-Control-Allow-Origin, *)';
const kScriptURL =
get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/empty-worklet-script-with-cors-header.js';
return openWindowAndExpectResult(
kWindowURL, kScriptURL, workletType, 'RESOLVED');
}, 'Importing a remote-origin worklet script should not be blocked ' +
@ -65,9 +62,9 @@ function runContentSecurityPolicyTests(workletType) {
'Content-Security-Policy, script-src * \'unsafe-inline\')';
// A worklet on HTTPS_REMOTE_ORIGIN will import a child script on
// HTTPS_REMOTE_ORIGIN.
const kScriptURL = get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/import-empty-worklet-script.js' +
'?pipe=header(Access-Control-Allow-Origin, *)';
const kScriptURL =
get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/import-empty-worklet-script-with-cors-header.js';
return openWindowAndExpectResult(
kWindowURL, kScriptURL, workletType, 'RESOLVED');
}, 'Importing a remote-origin script from a remote-origin worklet script '+
@ -77,12 +74,57 @@ function runContentSecurityPolicyTests(workletType) {
const kWindowURL =
'resources/addmodule-window.html?pipe=header(' +
'Content-Security-Policy, worker-src \'self\' \'unsafe-inline\')';
const kScriptURL = get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/empty-worklet-script.js' +
'?pipe=header(Access-Control-Allow-Origin, *)';
const kScriptURL =
get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/empty-worklet-script-with-cors-header.js';
return openWindowAndExpectResult(
kWindowURL, kScriptURL, workletType, 'RESOLVED');
}, 'Importing a remote-origin worklet script should not be blocked by ' +
'the worker-src directive because worklets obey the script-src ' +
'directive.');
promise_test(t => {
const kWindowURL = 'resources/addmodule-window.html';
const kScriptURL =
get_host_info().HTTP_ORIGIN +
'/worklets/resources/empty-worklet-script.js';
return openWindowAndExpectResult(
kWindowURL, kScriptURL, workletType, 'REJECTED');
}, 'Importing an insecure-origin worklet script should be blocked because ' +
'of mixed contents.');
promise_test(t => {
const kWindowURL = 'resources/addmodule-window.html?pipe=header(' +
'Content-Security-Policy, upgrade-insecure-requests)';
// This test relies on some unintuitive cleverness due to WPT's test setup:
// 'Upgrade-Insecure-Requests' does not upgrade the port number, so we use
// URLs in the form `http://[host]:[https-port]`. If the upgrade fails, the
// load will fail, as we don't serve HTTP over the secure port.
const kHost = get_host_info().ORIGINAL_HOST;
const kPort = get_host_info().HTTPS_PORT;
const kScriptURL =
`http://${kHost}:${kPort}/worklets/resources/empty-worklet-script.js`;
return openWindowAndExpectResult(
kWindowURL, kScriptURL, workletType, 'RESOLVED');
}, 'Importing an insecure-origin worklet script should not be blocked ' +
'because the upgrade-insecure-requests directive translates it as the ' +
'secure origin.');
promise_test(t => {
const kWindowURL = 'resources/addmodule-window.html';
const kScriptURL = 'import-insecure-origin-empty-worklet-script.sub.js';
return openWindowAndExpectResult(
kWindowURL, kScriptURL, workletType, 'REJECTED');
}, 'Importing an insecure-origin script from a secure-origin worklet ' +
'script should be blocked because of mixed contents.');
promise_test(t => {
const kWindowURL = 'resources/addmodule-window.html?pipe=header(' +
'Content-Security-Policy, upgrade-insecure-requests)';
const kScriptURL = 'import-insecure-origin-empty-worklet-script.sub.js';
return openWindowAndExpectResult(
kWindowURL, kScriptURL, workletType, 'RESOLVED');
}, 'Importing an insecure-origin script from a secure-origin worklet ' +
'script should not be blocked because the upgrade-insecure-requests ' +
'directive translates it as the secure origin.');
}

1
tests/wpt/web-platform-tests/worklets/resources/empty-worklet-script-with-cors-header.js Normal file
View file

@ -0,0 +1 @@
// This file is served with "Access-Control-Allow-Origin" header.

1
tests/wpt/web-platform-tests/worklets/resources/empty-worklet-script-with-cors-header.js.headers Normal file
View file

@ -0,0 +1 @@
Access-Control-Allow-Origin: *

3
tests/wpt/web-platform-tests/worklets/resources/import-empty-worklet-script-with-cors-header.js Normal file
View file

@ -0,0 +1,3 @@
// This file and descendant files are served with "Access-Control-Allow-Origin"
// header.
import './empty-worklet-script-with-cors-header.js';

1
tests/wpt/web-platform-tests/worklets/resources/import-empty-worklet-script-with-cors-header.js.headers Normal file
View file

@ -0,0 +1 @@
Access-Control-Allow-Origin: *

3
tests/wpt/web-platform-tests/worklets/resources/import-empty-worklet-script.js
View file

@ -1,3 +0,0 @@
// This script can be imported as a remote-origin script, so the
// Access-Control-Allow-Origin is specified here.
import './empty-worklet-script.js?pipe=header(Access-Control-Allow-Origin, *)';

5
tests/wpt/web-platform-tests/worklets/resources/import-insecure-origin-empty-worklet-script.sub.js Normal file
View file

@ -0,0 +1,5 @@
// Some tests rely on some unintuitive cleverness due to WPT's test setup:
// 'Upgrade-Insecure-Requests' does not upgrade the port number, so we use URLs
// in the form `http://[host]:[https-port]`. If the upgrade fails, the load will
// fail, as we don't serve HTTP over the secure port.
import 'http://{{host}}:{{ports[https][0]}}/worklets/resources/empty-worklet-script.js';

2
tests/wpt/web-platform-tests/worklets/resources/import-referrer-checker-worklet-script.sub.js Normal file
View file

@ -0,0 +1,2 @@
// Forward GET parameters to the server.
import './referrer-checker.py?referrer_policy={{GET[referrer_policy]}}&expected_referrer={{GET[expected_referrer]}}';

1
tests/wpt/web-platform-tests/worklets/resources/import-referrer-checker-worklet-script.sub.js.headers Normal file
View file

@ -0,0 +1 @@
Access-Control-Allow-Origin: *

2
tests/wpt/web-platform-tests/worklets/resources/import-remote-origin-referrer-checker-worklet-script.sub.js Normal file
View file

@ -0,0 +1,2 @@
// Forward GET parameters to the server.
import 'https://{{domains[www1]}}:{{ports[https][0]}}/worklets/resources/referrer-checker.py?referrer_policy={{GET[referrer_policy]}}&expected_referrer={{GET[expected_referrer]}}';

1
tests/wpt/web-platform-tests/worklets/resources/import-remote-origin-referrer-checker-worklet-script.sub.js.headers Normal file
View file

@ -0,0 +1 @@
Access-Control-Allow-Origin: *

26
tests/wpt/web-platform-tests/worklets/resources/referrer-checker.py Normal file
View file

@ -0,0 +1,26 @@
# Returns a valid response when request's |referrer| matches
# |expected_referrer|.
def main(request, response):
referrer = request.headers.get("referer", "")
referrer_policy = request.GET.first("referrer_policy")
expected_referrer = request.GET.first("expected_referrer", "")
response_headers = [("Content-Type", "text/javascript"),
("Access-Control-Allow-Origin", "*")]
if referrer_policy == "no-referrer" or referrer_policy == "origin":
if referrer == expected_referrer:
return (200, response_headers, "")
return (404, response_headers)
if referrer_policy == "same-origin":
if referrer == expected_referrer:
return (200, response_headers, "")
# The expected referrer doesn't contain query params for simplification,
# so we check the referrer by startswith() here.
if (expected_referrer != "" and
referrer.startswith(expected_referrer + "?")):
return (200, response_headers, "")
return (404, response_headers)
return (404, response_headers)

187
tests/wpt/web-platform-tests/worklets/resources/referrer-tests.js
View file

@ -9,88 +9,163 @@ function openWindow(url) {
});
}
// Run a referrer policy test with the given settings.
//
// Example:
// settings = {
// workletType: 'paint',
// fetchType: 'top-level' or 'descendant',
// referrerPolicy: 'no-referrer',
// scriptsOrigins: { topLevel: 'same', descendant: 'remote' }
// };
function runReferrerTest(settings) {
const kWindowURL =
'resources/referrer-window.html' +
`?pipe=header(Referrer-Policy, ${settings.referrerPolicy})`;
return openWindow(kWindowURL).then(win => {
const promise = new Promise(resolve => window.onmessage = resolve);
win.postMessage(settings, '*');
return promise;
}).then(msg_event => assert_equals(msg_event.data, 'RESOLVED'));
}
// Runs a series of tests related to the referrer policy on a worklet.
//
// Usage:
// runReferrerTests("paint");
function runReferrerTests(worklet_type) {
const worklet = get_worklet(worklet_type);
function runReferrerTests(workletType) {
const worklet = get_worklet(workletType);
// Tests for top-level script fetch -----------------------------------------
promise_test(() => {
const kWindowURL = "resources/referrer-window.html" +
"?pipe=header(Referrer-Policy,no-referrer)";
return openWindow(kWindowURL).then(win => {
const promise = new Promise(resolve => window.onmessage = resolve);
win.postMessage({ type: worklet_type,
referrer_policy: 'no-referrer',
is_cross_origin: false }, '*');
return promise;
}).then(msg_event => assert_equals(msg_event.data, 'RESOLVED'));
return runReferrerTest({ workletType: workletType,
fetchType: 'top-level',
referrerPolicy: 'no-referrer',
scriptOrigins: { topLevel: 'same' } });
}, 'Importing a same-origin script from a page that has "no-referrer" ' +
'referrer policy should not send referrer.');
promise_test(() => {
const kWindowURL = "resources/referrer-window.html" +
"?pipe=header(Referrer-Policy,no-referrer)";
return openWindow(kWindowURL).then(win => {
const promise = new Promise(resolve => window.onmessage = resolve);
win.postMessage({ type: worklet_type,
referrer_policy: 'no-referrer',
is_cross_origin: true }, '*');
return promise;
}).then(msg_event => assert_equals(msg_event.data, 'RESOLVED'));
return runReferrerTest({ workletType: workletType,
fetchType: 'top-level',
referrerPolicy: 'no-referrer',
scriptOrigins: { topLevel: 'remote' } });
}, 'Importing a remote-origin script from a page that has "no-referrer" ' +
'referrer policy should not send referrer.');
promise_test(() => {
const kWindowURL = 'resources/referrer-window.html' +
'?pipe=header(Referrer-Policy,origin)';
return openWindow(kWindowURL).then(win => {
const promise = new Promise(resolve => window.onmessage = resolve);
win.postMessage({ type: worklet_type,
referrer_policy: 'origin',
is_cross_origin: false }, '*');
return promise;
}).then(msg_event => assert_equals(msg_event.data, 'RESOLVED'));
return runReferrerTest({ workletType: workletType,
fetchType: 'top-level',
referrerPolicy: 'origin',
scriptOrigins: { topLevel: 'same' } });
}, 'Importing a same-origin script from a page that has "origin" ' +
'referrer policy should send only an origin as referrer.');
promise_test(() => {
const kWindowURL = 'resources/referrer-window.html' +
'?pipe=header(Referrer-Policy,origin)';
return openWindow(kWindowURL).then(win => {
const promise = new Promise(resolve => window.onmessage = resolve);
win.postMessage({ type: worklet_type,
referrer_policy: 'origin',
is_cross_origin: true }, '*');
return promise;
}).then(msg_event => assert_equals(msg_event.data, 'RESOLVED'));
return runReferrerTest({ workletType: workletType,
fetchType: 'top-level',
referrerPolicy: 'origin',
scriptOrigins: { topLevel: 'remote' } });
}, 'Importing a remote-origin script from a page that has "origin" ' +
'referrer policy should send only an origin as referrer.');
promise_test(() => {
const kWindowURL = 'resources/referrer-window.html' +
'?pipe=header(Referrer-Policy,same-origin)';
return openWindow(kWindowURL).then(win => {
const promise = new Promise(resolve => window.onmessage = resolve);
win.postMessage({ type: worklet_type,
referrer_policy: 'same-origin',
is_cross_origin: false }, '*');
return promise;
}).then(msg_event => assert_equals(msg_event.data, 'RESOLVED'));
return runReferrerTest({ workletType: workletType,
fetchType: 'top-level',
referrerPolicy: 'same-origin',
scriptOrigins: { topLevel: 'same' } });
}, 'Importing a same-origin script from a page that has "same-origin" ' +
'referrer policy should send referrer.');
promise_test(() => {
const kWindowURL = 'resources/referrer-window.html' +
'?pipe=header(Referrer-Policy,same-origin)';
return openWindow(kWindowURL).then(win => {
const promise = new Promise(resolve => window.onmessage = resolve);
win.postMessage({ type: worklet_type,
referrer_policy: 'same-origin',
is_cross_origin: true }, '*');
return promise;
}).then(msg_event => assert_equals(msg_event.data, 'RESOLVED'));
return runReferrerTest({ workletType: workletType,
fetchType: 'top-level',
referrerPolicy: 'same-origin',
scriptOrigins: { topLevel: 'remote' } });
}, 'Importing a remote-origin script from a page that has "same-origin" ' +
'referrer policy should not send referrer.');
// Tests for descendant script fetch -----------------------------------------
promise_test(() => {
return runReferrerTest({ workletType: workletType,
fetchType: 'descendant',
referrerPolicy: 'no-referrer',
scriptOrigins: { topLevel: 'same',
descendant: 'same' } });
}, 'Importing a same-origin script from a same-origin worklet script that ' +
'has "no-referrer" referrer policy should not send referrer.');
promise_test(() => {
return runReferrerTest({ workletType: workletType,
fetchType: 'descendant',
referrerPolicy: 'no-referrer',
scriptOrigins: { topLevel: 'same',
descendant: 'remote' } });
}, 'Importing a remote-origin script from a same-origin worklet script ' +
'that has "no-referrer" referrer policy should not send referrer.');
promise_test(() => {
return runReferrerTest({ workletType: workletType,
fetchType: 'descendant',
referrerPolicy: 'no-referrer',
scriptOrigins: { topLevel: 'remote',
descendant: 'remote' } });
}, 'Importing a remote-origin script from a remote-origin worklet script ' +
'that has "no-referrer" referrer policy should not send referrer.');
promise_test(() => {
return runReferrerTest({ workletType: workletType,
fetchType: 'descendant',
referrerPolicy: 'origin',
scriptOrigins: { topLevel: 'same',
descendant: 'same' } });
}, 'Importing a same-origin script from a same-origin worklet script that ' +
'has "origin" referrer policy should send referrer.');
promise_test(() => {
return runReferrerTest({ workletType: workletType,
fetchType: 'descendant',
referrerPolicy: 'origin',
scriptOrigins: { topLevel: 'same',
descendant: 'remote' } });
}, 'Importing a remote-origin script from a same-origin worklet script ' +
'that has "origin" referrer policy should send referrer.');
promise_test(() => {
return runReferrerTest({ workletType: workletType,
fetchType: 'descendant',
referrerPolicy: 'origin',
scriptOrigins: { topLevel: 'remote',
descendant: 'remote' } });
}, 'Importing a remote-origin script from a remote-origin worklet script ' +
'that has "origin" referrer policy should send referrer.');
promise_test(() => {
return runReferrerTest({ workletType: workletType,
fetchType: 'descendant',
referrerPolicy: 'same-origin',
scriptOrigins: { topLevel: 'same',
descendant: 'same' } });
}, 'Importing a same-origin script from a same-origin worklet script that ' +
'has "same-origin" referrer policy should send referrer.');
promise_test(() => {
return runReferrerTest({ workletType: workletType,
fetchType: 'descendant',
referrerPolicy: 'same-origin',
scriptOrigins: { topLevel: 'same',
descendant: 'remote' } });
}, 'Importing a remote-origin script from a same-origin worklet script ' +
'that has "same-origin" referrer policy should not send referrer.');
promise_test(() => {
return runReferrerTest({ workletType: workletType,
fetchType: 'descendant',
referrerPolicy: 'same-origin',
scriptOrigins: { topLevel: 'remote',
descendant: 'remote' } });
}, 'Importing a remote-origin script from a remote-origin worklet script ' +
'that has "same-origin" referrer policy should not send referrer.');
}

91
tests/wpt/web-platform-tests/worklets/resources/referrer-window.html
View file

@ -9,22 +9,89 @@
</head>
<body>
<script>
function createScriptURLForTopLevel(scriptOrigin) {
if (scriptOrigin === 'same')
return new URL('referrer-checker.py', location.href);
if (scriptOrigin === 'remote') {
return new URL(get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/referrer-checker.py');
}
assert_unreached('scriptOrigin should be \'same\' or \'remote\'');
}
function createScriptURLForDecendant(scriptOrigins) {
if (scriptOrigins.topLevel === 'same' &&
scriptOrigins.descendant === 'same') {
return new URL('import-referrer-checker-worklet-script.sub.js',
location.href);
}
if (scriptOrigins.topLevel === 'same' &&
scriptOrigins.descendant === 'remote') {
return new URL(
'import-remote-origin-referrer-checker-worklet-script.sub.js',
location.href);
}
if (scriptOrigins.topLevel === 'remote' &&
scriptOrigins.descendant === 'remote') {
return new URL(
get_host_info().HTTPS_REMOTE_ORIGIN +
'/worklets/resources/import-referrer-checker-worklet-script.sub.js');
}
assert_unreached('scriptOrigins have an invalid origin combination.');
}
function isDestinationCrossOrigin(fetchType, scriptOrigins) {
if (fetchType === 'top-level')
return scriptOrigins.topLevel === 'remote';
if (fetchType === 'descendant')
return scriptOrigins.descendant === 'remote';
assert_unreached('fetchType has an invalid value.');
}
function createExpectedReferrer(
importerURL, fetchType, referrerPolicy, scriptOrigins) {
if (referrerPolicy === 'no-referrer')
return "";
if (referrerPolicy === 'same-origin') {
if (isDestinationCrossOrigin(fetchType, scriptOrigins))
return "";
// Delete query params to make it easier to match with an actual referrer in
// the referrer-checker.py.
const expectedReferrer = new URL(importerURL);
for (var key of expectedReferrer.searchParams.keys())
expectedReferrer.searchParams.delete(key);
return expectedReferrer;
}
if (referrerPolicy === 'origin')
return (new URL(importerURL)).origin + '/';
assert_unreached('referrerPolicy has an invalid value.');
}
window.onmessage = e => {
const worklet_type = e.data.type;
const is_cross_origin = e.data.is_cross_origin;
const workletType = e.data.workletType;
const fetchType = e.data.fetchType;
const referrerPolicy = e.data.referrerPolicy;
const scriptOrigins = e.data.scriptOrigins;
let scriptURL;
let expectedReferrer;
if (fetchType === 'top-level') {
scriptURL = createScriptURLForTopLevel(scriptOrigins.topLevel);
expectedReferrer = createExpectedReferrer(
location.href, fetchType, referrerPolicy, scriptOrigins);
} else if (fetchType === 'descendant') {
scriptURL = createScriptURLForDecendant(scriptOrigins);
expectedReferrer = createExpectedReferrer(
scriptURL, fetchType, referrerPolicy, scriptOrigins);
} else {
assert_unreached('fetchType should be \'top-level\' or \'descendant\'');
}
const params = new URLSearchParams;
params.append('referrer_policy', e.data.referrer_policy)
params.append('source_origin', get_host_info().HTTPS_ORIGIN);
params.append('referrer_policy', referrerPolicy);
params.append('expected_referrer', expectedReferrer);
let script_url = '';
if (is_cross_origin) {
params.append('is_cross_origin', 'true')
script_url = get_host_info().HTTPS_REMOTE_ORIGIN + '/worklets/resources/';
}
script_url += 'referrer.py?' + params;
get_worklet(worklet_type).addModule(script_url)
get_worklet(workletType).addModule(scriptURL + '?' + params)
.then(() => window.opener.postMessage('RESOLVED', '*'))
.catch(e => window.opener.postMessage(e.message, '*'));
};

30
tests/wpt/web-platform-tests/worklets/resources/referrer.py
View file

@ -1,30 +0,0 @@
# Returns a valid response when request's |referrer| matches |referrer_policy|.
def main(request, response):
referrer = request.headers.get("referer", None)
referrer_policy = request.GET.first("referrer_policy")
source_origin = request.GET.first("source_origin")
is_cross_origin = request.GET.first("is_cross_origin", False)
response_headers = [("Content-Type", "text/javascript"),
("Access-Control-Allow-Origin", source_origin)];
# When the referrer policy is "no-referrer", the referrer header shouldn't
# be sent.
if referrer_policy == "no-referrer" and not referrer:
return (200, response_headers, "")
# When the referrer policy is "origin", the referrer header should contain
# only the origin. Note that |referrer| contains a trailing slash, while
# |source_origin| doesn't.
if referrer_policy == "origin" and referrer == source_origin + "/":
return (200, response_headers, "")
# When the referrer policy is "same-origin", the referrer header should be
# sent only for a same-origin request.
if referrer_policy == "same-origin":
if is_cross_origin and not referrer:
return (200, response_headers, "")
if not is_cross_origin and referrer:
return (200, response_headers, "")
return (404)

11
tests/wpt/web-platform-tests/worklets/resources/set-cookie.py
View file

@ -1,6 +1,9 @@
def main(request, response):
name = request.GET.first("name")
source_origin = request.headers.get("origin", None);
response.headers.set("Set-Cookie", name + "=value")
response.headers.set("Access-Control-Allow-Origin", source_origin)
response.headers.set("Access-Control-Allow-Credentials", "true")
value = request.GET.first("value")
source_origin = request.headers.get("origin", None)
response_headers = [("Set-Cookie", name + "=" + value),
("Access-Control-Allow-Origin", source_origin),
("Access-Control-Allow-Credentials", "true")]
return (200, response_headers, "")