Update web-platform-tests to revision 0a518aaff73532a26e175789f7e75fa99593ac64

This commit is contained in:
Ms2ger 2016-04-21 11:33:07 +02:00
parent 9c172f49d0
commit abcd4b654f
92 changed files with 2869 additions and 642 deletions

View file

@ -32,7 +32,7 @@ form-action 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self';
<input type="text" name="fieldname" value="fieldvalue">
<input type="submit" id="submit" value="submit">
</form>
<p>Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed.</p>
<p>Tests that allowed form actions work correctly.</p>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
</body>

View file

@ -31,7 +31,7 @@ form-action 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self';
<input type="text" name="fieldname" value="fieldvalue">
<input type="submit" id="submit" value="submit">
</form>
<p>Tests that blocking form actions works correctly. If this test passes, a CSP violation will be generated, and will not see a page indicating a form was POSTed.</p>
<p>Tests that blocking form actions works correctly.</p>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=form-action%20&apos;none&apos;"></script>

View file

@ -33,7 +33,8 @@ form-action 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self';
<input type="text" name="fieldname" value="fieldvalue">
<input type="submit" id="submit" value="submit">
</form>
<p>Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed.</p>
<p>Tests that allowed form actions work correctly
with GET and a redirect.</p>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
</body>

View file

@ -33,7 +33,8 @@ form-action 'none'; script-src 'self' 'unsafe-inline'; connect-src 'self';
<input type="text" name="fieldname" value="fieldvalue">
<input type="submit" id="submit" value="submit">
</form>
<p>Tests that allowed form actions work correctly. If this test passes, you will see a page indicating a form was POSTed.</p>
<p>Tests that disallowed form actions are blocked
with GET and redirects.</p>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=form-action%20&apos;none&apos;
"></script>

View file

@ -33,7 +33,7 @@ form-action 'self'; script-src 'self' 'unsafe-inline'; connect-src 'self';
<input type="text" name="fieldname" value="fieldvalue">
<input type="submit" id="submit" value="submit">
</form>
<p>Tests that blocking form redirect works correctly. If this test passes, a CSP violation will be generated, and will not see a page indicating a form was POSTed.</p>
<p>Tests that blocking a POST form with a redirect works correctly. If this test passes, a CSP violation will be generated.</p>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=form-action%20'self'"></script>
</body>

View file

@ -14,14 +14,14 @@ script-src 'self' 'unsafe-inline' 'none'; connect-src 'self';
</head>
<body>
<meta http-equiv="Content-Security-Policy" content="script-src 'none'">
<meta http-equiv="Content-Security-Policy" content="script-src 'self'">
<p>This test checks that Content Security Policy delivered via a meta element is not enforced if the element is outside the document&apos;s head.</p>
<script>
alert_assert("PASS (1/1)");
var aa = "PASS (1/1)";
</script>
<script src="metaHelper.js"></script>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
<script src="../support/checkReport.sub.js?reportExists=false"></script>
</body>
</html>

View file

@ -0,0 +1,5 @@
if (typeof aa != 'undefined') {
alert_assert(aa);
} else {
alert_assert("Failed - allowed inline script blocked by meta policy outside head.");
}

View file

@ -6,7 +6,7 @@
<title>plugintypes-notype-data</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src='../support/logTest.sub.js?logs=["PASS"]'></script>
<script src='../support/logTest.sub.js?logs=["PASS: object tag onerror handler fired"]'></script>
<script src="../support/alertAssert.sub.js?alerts=[]"></script>
<!-- enforcing policy:
plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline'; connect-src 'self';
@ -15,7 +15,7 @@ plugin-types application/x-invalid-type; script-src 'self' 'unsafe-inline'; conn
<body>
Given a `plugin-types` directive, plugins have to declare a type explicitly. No declared type, no load. This test passes if there&apos;s a CSP report and &quot;FAIL!&quot; isn&apos;t logged.
<object data="data:application/x-webkit-test-netscape" onload="log('FAIL');" onerror="log('PASS');"></object>
<object data="data:application/x-webkit-test-netscape" onload="log('FAIL');" onerror="log('PASS: object tag onerror handler fired');"></object>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=plugin-types+application/x-invalid-type"></script>
</body>

View file

@ -7,7 +7,6 @@
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
</script>
<!-- enforcing policy:
script-src 'self' 'nonce-nonceynonce' 'sha256-dWTP4Di8KBjaiXvQ5mRquI9OoBSo921ahYxLfYSiuT8='; connect-src 'self';
-->
@ -34,12 +33,9 @@ script-src 'self' 'nonce-nonceynonce' 'sha256-dWTP4Di8KBjaiXvQ5mRquI9OoBSo921ahY
var scriptContent2 = "window.finish('" + nonMatchingContent + "');";
var script1 = document.createElement('script');
script1.innerHTML = scriptContent1;
var script2 = document.createElement('script');
script2.innerHTML = scriptContent2;
script1.test = async_test("Inline script with hash in CSP");
script2.test = async_test("Inline script without hash in CSP");
script1.test = async_test("Only matching content runs even with NFC normalization.");
var failure = function() {
assert_unreached();
@ -51,16 +47,18 @@ script-src 'self' 'nonce-nonceynonce' 'sha256-dWTP4Di8KBjaiXvQ5mRquI9OoBSo921ahY
script1.test.done();
});
} else {
assert_unreached();
script1.test.step(function() {
assert_unreached("nonMatchingContent script ran");
});
}
}
script1.onerror = failure;
script2.onerror = script2.test.step_func(function() {
script2.test.done();
});
document.body.appendChild(script1);
document.body.appendChild(script2);
script2.textContent = scriptContent2;
document.body.appendChild(script1);
script1.textContent = scriptContent1;
</script>
<p>

View file

@ -6,49 +6,16 @@
<title>scriptnonce-basic-blocked</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script nonce='noncynonce'>
function log(msg) {
test(function() {
assert_unreached(msg)
});
}
</script>
<script nonce='noncynonce'>
var t_alert = async_test('Expecting alerts: ["PASS (1/2)","PASS (2/2)"]');
var expected_alerts = ["PASS (1/2)", "PASS (2/2)"];
function alert_assert(msg) {
t_alert.step(function() {
if (msg.match(/^FAIL/i)) {
assert_unreached(msg);
t_alert.done();
}
for (var i = 0; i < expected_alerts.length; i++) {
if (expected_alerts[i] == msg) {
assert_true(expected_alerts[i] == msg);
expected_alerts.splice(i, 1);
if (expected_alerts.length == 0) {
t_alert.done();
}
return;
}
}
assert_unreached('unexpected alert: ' + msg);
t_log.done();
});
}
</script>
<script src='../support/alertAssert.sub.js?alerts=["PASS (closely-quoted nonce)","PASS (nonce w/whitespace)"]'></script>
<!-- enforcing policy:
script-src 'self' 'unsafe-inline' 'nonce-noncynonce'; connect-src 'self';
-->
<script nonce="noncynonce">
alert_assert('PASS (1/2)');
alert_assert('PASS (closely-quoted nonce)');
</script>
<script nonce=" noncynonce ">
alert_assert('PASS (2/2)');
alert_assert('PASS (nonce w/whitespace)');
</script>
<script nonce="noncynonce noncynonce">

View file

@ -34,7 +34,7 @@
</script>
<!-- enforcing policy:
style-src 'sha1-eYyYGmKWdhpUewohaXk9o8IaLSw=' 'sha256-hndjYvzUzy2Ykuad81Cwsl1FOXX/qYs/aDVyUyNZwBw=' 'sha384-bSVm1i3sjPBRM4TwZtYTDjk9JxZMExYHWbFmP1SxDhJH4ue0Wu9OPOkY5hcqRcSt' 'sha512-440MmBLtj9Kp5Bqloogn9BqGDylY8vFsv5/zXL1zH2fJVssCoskRig4gyM+9KqwvCSapSz5CVoUGHQcxv43UQg=='; script-src 'self' 'unsafe-inline'; connect-src 'self';
style-src 'sha256-pAKi9r4/WB7fHydbE3F3t8i8602ij2JN8zHJpL2T5BM=' 'sha256-hndjYvzUzy2Ykuad81Cwsl1FOXX/qYs/aDVyUyNZwBw=' 'sha384-bSVm1i3sjPBRM4TwZtYTDjk9JxZMExYHWbFmP1SxDhJH4ue0Wu9OPOkY5hcqRcSt' 'sha512-440MmBLtj9Kp5Bqloogn9BqGDylY8vFsv5/zXL1zH2fJVssCoskRig4gyM+9KqwvCSapSz5CVoUGHQcxv43UQg=='; script-src 'self' 'unsafe-inline'; connect-src 'self';
-->
</head>

View file

@ -3,4 +3,4 @@ Cache-Control: no-store, no-cache, must-revalidate
Cache-Control: post-check=0, pre-check=0, false
Pragma: no-cache
Set-Cookie: stylehash-allowed={{$id:uuid()}}; Path=/content-security-policy/blink-contrib-2
Content-Security-Policy: style-src 'self' 'sha1-eYyYGmKWdhpUewohaXk9o8IaLSw=' 'sha256-hndjYvzUzy2Ykuad81Cwsl1FOXX/qYs/aDVyUyNZwBw=' 'sha384-bSVm1i3sjPBRM4TwZtYTDjk9JxZMExYHWbFmP1SxDhJH4ue0Wu9OPOkY5hcqRcSt' 'sha512-440MmBLtj9Kp5Bqloogn9BqGDylY8vFsv5/zXL1zH2fJVssCoskRig4gyM+9KqwvCSapSz5CVoUGHQcxv43UQg=='; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}
Content-Security-Policy: style-src 'self' 'sha256-pAKi9r4/WB7fHydbE3F3t8i8602ij2JN8zHJpL2T5BM=' 'sha256-hndjYvzUzy2Ykuad81Cwsl1FOXX/qYs/aDVyUyNZwBw=' 'sha384-bSVm1i3sjPBRM4TwZtYTDjk9JxZMExYHWbFmP1SxDhJH4ue0Wu9OPOkY5hcqRcSt' 'sha512-440MmBLtj9Kp5Bqloogn9BqGDylY8vFsv5/zXL1zH2fJVssCoskRig4gyM+9KqwvCSapSz5CVoUGHQcxv43UQg=='; script-src 'self' 'unsafe-inline'; connect-src 'self'; report-uri /content-security-policy/support/report.py?op=put&reportID={{$id}}

View file

@ -15,16 +15,27 @@ connect-src 'self' http://{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe
<body>
<script>
try {
var es = navigator.sendBeacon("http://{{host}}:{{ports[http][0]}}/cors/resources/status.py");
log("Pass");
} catch (e) {
log("Fail");
}
if (typeof navigator.sendBeacon != 'function') {
t_log.set_status(t_log.NOTRUN, "No navigator.sendBeacon, cannot run test.");
t_log.phase = t_log.phases.HAS_RESULT;
t_log.done();
} else {
try {
var es = navigator.sendBeacon("http://{{host}}:{{ports[http][0]}}/cors/resources/status.py");
log("Pass");
} catch (e) {
log("Fail");
}
var report = document.createElement("script");
report.src = "../support/checkReport.sub.js?reportExists=false";
report.async = true;
report.defer = true;
document.body.appendChild(report);
}
</script>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
</body>
</html>

View file

@ -15,16 +15,26 @@ connect-src 'self' http://{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe
<body>
<script>
try {
var es = navigator.sendBeacon("http://www1.{{host}}:{{ports[http][0]}}/security/contentSecurityPolicy/echo-report.php");
log("Fail");
} catch (e) {
log("Pass");
}
if (typeof navigator.sendBeacon != 'function') {
t_log.set_status(t_log.NOTRUN, "No navigator.sendBeacon, cannot run test.");
t_log.phase = t_log.phases.HAS_RESULT;
t_log.done();
} else {
try {
var es = navigator.sendBeacon("http://www1.{{host}}:{{ports[http][0]}}/security/contentSecurityPolicy/echo-report.php");
log("Fail");
} catch (e) {
log("Pass");
}
var report = document.createElement("script");
report.src = "../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=connect-src%20&apos;self&apos;";
report.async = true;
report.defer = true;
document.body.appendChild(report);
}
</script>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=connect-src%20&apos;self&apos;"></script>
</body>
</html>

View file

@ -18,13 +18,24 @@ connect-src 'self'; script-src 'self' 'unsafe-inline';
<p>The beacon should not follow the redirect to http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/support/fail.png and send a CSP violation report.</p>
<p>Verify that a CSP connect-src directive blocks redirects.</p>
<script>
navigator.sendBeacon(
"/common/redirect.py?location=http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/support/fail.png",
"ping");
if (typeof navigator.sendBeacon != 'function') {
var t = async_test();
t.set_status(t.NOTRUN, "No navigator.sendBeacon, cannot run test.");
t.phase = t.phases.HAS_RESULT;
t.done();
} else {
navigator.sendBeacon(
"/common/redirect.py?location=http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/support/fail.png",
"ping");
var report = document.createElement("script");
report.src = "../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=connect-src%20&apos;self&apos;";
report.async = true;
report.defer = true;
document.body.appendChild(report);
}
</script>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=true&amp;reportField=violated-directive&amp;reportValue=connect-src%20&apos;self&apos;"></script>
</body>
</html>

View file

@ -2,5 +2,5 @@ try {
importScripts("/content-security-policy/blink-contrib/resources/post-message.js");
postMessage("importScripts allowed");
} catch (e) {
postMessage("importScripts blocked: " + e);
postMessage("importScripts blocked");
}

View file

@ -16,6 +16,11 @@ connect-src 'self' http://{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe
<body>
<script>
if(typeof SharedWorker != 'function') {
t_alert.set_status(t_alert.NOTRUN, "No SharedWorker, cannot run test.");
t_alert.phase = t_alert.phases.HAS_RESULT;
t_alert.done();
} else {
try {
var worker = new SharedWorker('http://{{host}}:{{ports[http][0]}}/content-security-policy/blink-contrib/resources/shared-worker-make-xhr-allowed.sub.js');
worker.port.onmessage = function(event) {
@ -24,10 +29,15 @@ connect-src 'self' http://{{host}}:{{ports[http][0]}}; script-src 'self' 'unsafe
} catch (e) {
alert_assert(e);
}
var report = document.createElement("script");
report.src = "../support/checkReport.sub.js?reportExists=false";
report.async = true;
report.defer = true;
document.body.appendChild(report);
}
</script>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
</body>
</html>

View file

@ -22,6 +22,11 @@ connect-src *; script-src 'self' 'unsafe-inline';
should be sent since the worker's policy doesn't specify
a report-uri.</p>
<script>
if(typeof SharedWorker != 'function') {
t_alert.set_status(t_alert.NOTRUN, "No SharedWorker, cannot run test.");
t_alert.phase = t_alert.phases.HAS_RESULT;
t_alert.done();
} else {
try {
var worker = new SharedWorker('http://{{host}}:{{ports[http][0]}}/content-security-policy/blink-contrib/resources/shared-worker-make-xhr-blocked.sub.js');
worker.port.onmessage = function(event) {
@ -30,10 +35,16 @@ connect-src *; script-src 'self' 'unsafe-inline';
} catch (e) {
alert_assert(e);
}
var report = document.createElement("script");
report.src = "../support/checkReport.sub.js?reportExists=false";
report.async = true;
report.defer = true;
document.body.appendChild(report);
}
</script>
<div id="log"></div>
<script async defer src="../support/checkReport.sub.js?reportExists=false"></script>
</body>
</html>

View file

@ -23,7 +23,7 @@ script-src 'self' 'unsafe-inline' 'unsafe-eval' 'unsafe-inline' 127.0.0.1:8000;
worker.onmessage = function(event) {
result = event.data;
test(function() {
assert_equals(result, 'importScripts blocked: NetworkError: Failed to execute \'importScripts\' on \'WorkerGlobalScope\': The script at \'http://{{host}}:{{ports[http][0]}}/content-security-policy/blink-contrib/resources/post-message.js\' failed to load.')
assert_equals(result, 'importScripts blocked')
});
log("TEST COMPLETE");
};

View file

@ -17,6 +17,10 @@ child-src 'none'; script-src 'self' 'unsafe-inline' 'unsafe-inline'; connect-src
<script>
try {
var foo = new Worker('http://{{host}}:{{ports[http][0]}}/content-security-policy/blink-contrib/resources/post-message.js');
foo.onerror = function(event) {
event.preventDefault();
alert_assert("PASS");
}
foo.onmessage = function(event) {
alert_assert("FAIL");
};

View file

@ -52,10 +52,17 @@
source_test.step(function() {
source_test.set_status(source_test.FAIL);
});
setTimeout(function() {
if(source_test.phase != source_test.phases.COMPLETE) {
source_test.step( function () { assert_unreached("Onerror event never fired for track element."); });
source_test.done();
}
}, 2 * 1000);
</script>
<script async defer src="../support/checkReport.sub.js?reportField=violated-directive&reportValue=media-src%20%27self%27">
</script>
</body>
</html>
</html>

View file

@ -55,8 +55,8 @@
</video>
<video id="videoObject2" width="320" height="240" controls
onerror="media_error_handler(src_test)"
onloadeddata="media_loaded(src_test)"
onerror="media_error_handler(src_redir_test)"
onloadeddata="media_loaded(src_redir_test)"
src="/common/redirect.py?location=http://www2.{{host}}:{{ports[http][0]}}/media/white.mp4">
<script async defer src="../support/checkReport.sub.js?reportExists=false">

View file

@ -1,5 +1,9 @@
// note, this template substitution is XSS, but no way to avoid it in this framework
var expected_alerts = {{GET[alerts]}};
var timeout= "{{GET[timeout]}}";
if (timeout == "") {
timeout = 2;
}
if(expected_alerts.length == 0) {
function alert_assert(msg) {
@ -7,7 +11,13 @@ if(expected_alerts.length == 0) {
}
} else {
var t_alert = async_test('Expecting alerts: {{GET[alerts]}}');
function alert_assert(msg) {
setTimeout(function() {
if(t_alert.phase != t_alert.phases.COMPLETE) {
t_alert.step(function() { assert_unreached('Alert timeout, expected alerts ' + expected_alerts + ' not fired.') });
t_alert.done();
}
}, timeout * 100);
var alert_assert = function (msg) {
t_alert.step(function () {
if(msg && msg instanceof Error) {
msg = msg.message;
@ -29,5 +39,5 @@ if(expected_alerts.length == 0) {
assert_unreached('unexpected alert: ' + msg);
t_log.done();
});
}
}.bind(this);
}

View file

@ -1,5 +1,9 @@
// note, this template substitution is XSS, but no way to avoid it in this framework
var expected_logs = {{GET[logs]}};
var timeout = "{{GET[timeout]}}";
if (timeout == "") {
timeout = 2;
}
if (expected_logs.length == 0) {
function log_assert(msg) {
@ -7,6 +11,12 @@ if (expected_logs.length == 0) {
}
} else {
var t_log = async_test('Expecting logs: {{GET[logs]}}');
setTimeout(function() {
if(t_log.phase != t_log.phases.COMPLETE){
t_log.step(function () { assert_unreached('Logging timeout, expected logs ' + expected_logs + ' not sent.') });
t_log.done();
}
}, timeout * 1000);
function log(msg) {
//cons/**/ole.log(msg);
t_log.step(function () {