mirror of
https://github.com/servo/servo.git
synced 2025-10-04 02:29:12 +01:00
Update web-platform-tests to revision 155daf0c385420faf208b8bd5e319e244ec7f9cc
This commit is contained in:
WPT Sync Bot
Josh Matthews
parent
4e6b100c7e
commit
e9bdf87a27
768 changed files with 5782 additions and 26218 deletions
|
|
@ -5,7 +5,7 @@
|
|||
<script src='/resources/testharness.js'></script>
|
||||
<script src='/resources/testharnessreport.js'></script>
|
||||
<!-- if base is used for resolving the URL to report to then we will not get a report -->
|
||||
<base href="http://nonexistent.web-platform.test">
|
||||
<base href="http://nonexistent.{{domains[]}}">
|
||||
</head>
|
||||
<body>
|
||||
<script>
|
||||
|
|
|
|||
|
|
@ -0,0 +1,144 @@
|
|||
<!DOCTYPE html>
|
||||
<html>
|
||||
<head>
|
||||
<title>Embedded Enforcement: Sec-Required-CSP header.</title>
|
||||
<script src="/resources/testharness.js"></script>
|
||||
<script src="/resources/testharnessreport.js"></script>
|
||||
<script src="support/testharness-helper.sub.js"></script>
|
||||
</head>
|
||||
<body>
|
||||
<script>
|
||||
var tests = [
|
||||
// CRLF characters
|
||||
{ "name": "\\r\\n character after directive name",
|
||||
"csp": "script-src\r\n'unsafe-inline'",
|
||||
"expected": null },
|
||||
{ "name": "\\r\\n character in directive value",
|
||||
"csp": "script-src 'unsafe-inline'\r\n'unsafe-eval'",
|
||||
"expected": null },
|
||||
{ "name": "\\n character after directive name",
|
||||
"csp": "script-src\n'unsafe-inline'",
|
||||
"expected": null },
|
||||
{ "name": "\\n character in directive value",
|
||||
"csp": "script-src 'unsafe-inline'\n'unsafe-eval'",
|
||||
"expected": null },
|
||||
{ "name": "\\r character after directive name",
|
||||
"csp": "script-src\r'unsafe-inline'",
|
||||
"expected": null },
|
||||
{ "name": "\\r character in directive value",
|
||||
"csp": "script-src 'unsafe-inline'\r'unsafe-eval'",
|
||||
"expected": null },
|
||||
|
||||
// HTML encoded CRLF characters
|
||||
{ "name": "%0D%0A character after directive name",
|
||||
"csp": "script-src%0D%0A'unsafe-inline'",
|
||||
"expected": null },
|
||||
{ "name": "%0D%0A character in directive value",
|
||||
"csp": "script-src 'unsafe-inline'%0D%0A'unsafe-eval'",
|
||||
"expected": null },
|
||||
{ "name": "%0A character after directive name",
|
||||
"csp": "script-src%0A'unsafe-inline'",
|
||||
"expected": null },
|
||||
{ "name": "%0A character in directive value",
|
||||
"csp": "script-src 'unsafe-inline'%0A'unsafe-eval'",
|
||||
"expected": null },
|
||||
{ "name": "%0D character after directive name",
|
||||
"csp": "script-src%0D'unsafe-inline'",
|
||||
"expected": null },
|
||||
{ "name": "%0D character in directive value",
|
||||
"csp": "script-src 'unsafe-inline'%0D'unsafe-eval'",
|
||||
"expected": null },
|
||||
|
||||
// Attempt HTTP Header injection
|
||||
{ "name": "Attempt injecting after directive name using \\r\\n",
|
||||
"csp": "script-src\r\nTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after directive name using \\r",
|
||||
"csp": "script-src\rTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after directive name using \\n",
|
||||
"csp": "script-src\nTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
|
||||
{ "name": "Attempt injecting after directive value using \\r\\n",
|
||||
"csp": "script-src example.com\r\nTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after directive value using \\r",
|
||||
"csp": "script-src example.com\rTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after directive value using \\n",
|
||||
"csp": "script-src example.com\nTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
|
||||
{ "name": "Attempt injecting after semicolon using \\r\\n",
|
||||
"csp": "script-src example.com;\r\nTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after semicolon using \\r",
|
||||
"csp": "script-src example.com;\rTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after semicolon using \\n",
|
||||
"csp": "script-src example.com;\nTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
|
||||
{ "name": "Attempt injecting after space between name and value using \\r\\n",
|
||||
"csp": "script-src \r\nTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after space between name and value using \\r",
|
||||
"csp": "script-src \rTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after space between name and value using \\n",
|
||||
"csp": "script-src \nTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
|
||||
// Attempt HTTP Header injection using URL encoded characters
|
||||
{ "name": "Attempt injecting after directive name using %0D%0A",
|
||||
"csp": "script-src%0D%0ATest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after directive name using %0D",
|
||||
"csp": "script-src%0DTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after directive name using %0A",
|
||||
"csp": "script-src%0ATest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
|
||||
{ "name": "Attempt injecting after directive value using %0D%0A",
|
||||
"csp": "script-src example.com%0D%0ATest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after directive value using %0D",
|
||||
"csp": "script-src example.com%0DTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after directive value using %0A",
|
||||
"csp": "script-src example.com%0ATest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
|
||||
{ "name": "Attempt injecting after semicolon using %0D%0A",
|
||||
"csp": "script-src example.com;%0D%0ATest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after semicolon using %0D",
|
||||
"csp": "script-src example.com;%0DTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after semicolon using %0A",
|
||||
"csp": "script-src example.com;%0ATest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
|
||||
{ "name": "Attempt injecting after space between name and value using %0D%0A",
|
||||
"csp": "script-src %0D%0ATest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after space between name and value using %0D",
|
||||
"csp": "script-src %0DTest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
{ "name": "Attempt injecting after space between name and value using %0A",
|
||||
"csp": "script-src %0ATest-Header-Injection: dummy",
|
||||
"expected": null },
|
||||
|
||||
];
|
||||
|
||||
tests.forEach(test => {
|
||||
async_test(t => {
|
||||
var url = generateURLString(Host.SAME_ORIGIN, PolicyHeader.REQUIRED_CSP);
|
||||
assert_required_csp(t, url, test.csp, [test.expected]);
|
||||
}, "Test CRLF: " + test.name);
|
||||
});
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -1,8 +1,13 @@
|
|||
import json
|
||||
def main(request, response):
|
||||
header = request.headers.get("Sec-Required-CSP");
|
||||
message = {}
|
||||
|
||||
header = request.headers.get("Test-Header-Injection");
|
||||
message['test_header_injection'] = header if header else None
|
||||
|
||||
header = request.headers.get("Sec-Required-CSP");
|
||||
message['required_csp'] = header if header else None
|
||||
|
||||
second_level_iframe_code = ""
|
||||
if "include_second_level_iframe" in request.GET:
|
||||
if "second_level_iframe_csp" in request.GET and request.GET["second_level_iframe_csp"] <> "":
|
||||
|
|
|
|||
|
|
@ -91,6 +91,10 @@ function assert_required_csp(t, url, csp, expected) {
|
|||
assert_unreached('Child iframes have unexpected csp:"' + e.data['required_csp'] + '"');
|
||||
|
||||
expected.splice(expected.indexOf(e.data['required_csp']), 1);
|
||||
|
||||
if (e.data['test_header_injection'] != null)
|
||||
assert_unreached('HTTP header injection was successful');
|
||||
|
||||
if (expected.length == 0)
|
||||
t.done();
|
||||
}));
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<title>test wildcard host name matching (*.web-platform.test is good)</title>
|
||||
<title>test wildcard host name matching (asterisk as a subdomain of the current domain)</title>
|
||||
<meta http-equiv="Content-Security-Policy" content="script-src 'self' *.{{host}}:{{ports[http][0]}} 'unsafe-inline';">
|
||||
<script src='/resources/testharness.js'></script>
|
||||
<script src='/resources/testharnessreport.js'></script>
|
||||
|
|
@ -22,7 +22,7 @@
|
|||
</script>
|
||||
</head>
|
||||
<body>
|
||||
<h1>test wildcard host name matching (*.web-platform.test is good)</h1>
|
||||
<h1>test wildcard host name matching (asterisk as a subdomain of the current domain)</h1>
|
||||
<div id='log'></div>
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<title>test wildcard host name matching (www*.web-platform.test is bad, *www.web-platform.test is bad)</title>
|
||||
<title>test wildcard host name matching (asterisk as part of a subdomain is not accepted)</title>
|
||||
<meta http-equiv="Content-Security-Policy" content="script-src 'self' *w.{{host}}:{{ports[http][0]}} w*.{{host}}:{{ports[http][0]}} 'unsafe-inline';">
|
||||
<script src='/resources/testharness.js'></script>
|
||||
<script src='/resources/testharnessreport.js'></script>
|
||||
|
|
@ -20,7 +20,7 @@
|
|||
</script>
|
||||
</head>
|
||||
<body>
|
||||
<h1>test wildcard host name matching (www*.web-platform.test is bad, *www.web-platform.test is bad)</h1>
|
||||
<h1>test wildcard host name matching (asterisk as part of a subdomain is not accepted)</h1>
|
||||
<div id='log'></div>
|
||||
</body>
|
||||
</html>
|
||||
|
|
|
|||
|
|
@ -124,7 +124,7 @@
|
|||
var script = document.querySelector('#cssTest');
|
||||
var style = getComputedStyle(script);
|
||||
assert_equals(style['display'], 'block');
|
||||
assert_equals(style['background-image'], "url(\"http://web-platform.test:8001/security/resources/abe.png\")");
|
||||
assert_equals(style['background-image'], "url(\"http://{{domains[]}}:{{ports[http][0]}}/security/resources/abe.png\")");
|
||||
}));
|
||||
}, "Nonces leak via CSS side-channels.");
|
||||
</script>
|
||||
|
|
@ -109,7 +109,7 @@
|
|||
var script = document.querySelector('#cssTest');
|
||||
var style = getComputedStyle(script);
|
||||
assert_equals(style['display'], 'block');
|
||||
assert_equals(style['background-image'], "url(\"http://web-platform.test:8001/security/resources/abe.png\")");
|
||||
assert_equals(style['background-image'], "url(\"http://{{domains[]}}:{{ports[http][0]}}/security/resources/abe.png\")");
|
||||
}));
|
||||
}, "Nonces don't leak via CSS side-channels.");
|
||||
</script>
|
||||
Loading…
Add table
Add a link
Reference in a new issue