servo/tests/wpt/web-platform-tests/worklets/resources/csp-tests.js

function openWindow(url) {
  return new Promise(resolve => {
    const win = window.open(url, '_blank');
    add_result_callback(() => win.close());
    window.onmessage = e => {
      assert_equals(e.data, 'LOADED');
      resolve(win);
    };
  });
}

function openWindowAndExpectResult(windowURL, scriptURL, type, expectation) {
  return openWindow(windowURL).then(win => {
    const promise = new Promise(r => window.onmessage = r);
    win.postMessage({ type: type, script_url: scriptURL }, '*');
    return promise;
  }).then(msg_event => assert_equals(msg_event.data, expectation));
}

// Runs a series of tests related to content security policy on a worklet.
//
// Usage:
// runContentSecurityPolicyTests("paint");
function runContentSecurityPolicyTests(workletType) {
  promise_test(t => {
    const kWindowURL =
        'resources/addmodule-window.html?pipe=header(' +
        'Content-Security-Policy, script-src \'self\' \'unsafe-inline\')';
    const kScriptURL =
        get_host_info().HTTPS_REMOTE_ORIGIN +
        '/worklets/resources/import-empty-worklet-script-with-cors-header.js';
    return openWindowAndExpectResult(
        kWindowURL, kScriptURL, workletType, 'REJECTED');
  }, 'Importing a remote-origin worklet script should be blocked by the ' +
     'script-src \'self\' directive.');

  promise_test(t => {
    const kWindowURL =
        'resources/addmodule-window.html?pipe=header(' +
        'Content-Security-Policy, script-src \'self\' \'unsafe-inline\')';
    const kScriptURL = 'import-remote-origin-empty-worklet-script.sub.js';
    return openWindowAndExpectResult(
        kWindowURL, kScriptURL, workletType, 'REJECTED');
  }, 'Importing a remote-origin script from a same-origin worklet script ' +
     'should be blocked by the script-src \'self\' directive.');

  promise_test(t => {
    const kWindowURL =
        'resources/addmodule-window.html?pipe=header(' +
        'Content-Security-Policy, script-src * \'unsafe-inline\')';
    const kScriptURL =
        get_host_info().HTTPS_REMOTE_ORIGIN +
        '/worklets/resources/empty-worklet-script-with-cors-header.js';
    return openWindowAndExpectResult(
        kWindowURL, kScriptURL, workletType, 'RESOLVED');
  }, 'Importing a remote-origin worklet script should not be blocked ' +
     'because the script-src * directive allows it.');

  promise_test(t => {
    const kWindowURL =
        'resources/addmodule-window.html?pipe=header(' +
        'Content-Security-Policy, script-src * \'unsafe-inline\')';
    // A worklet on HTTPS_REMOTE_ORIGIN will import a child script on
    // HTTPS_REMOTE_ORIGIN.
    const kScriptURL =
        get_host_info().HTTPS_REMOTE_ORIGIN +
        '/worklets/resources/import-empty-worklet-script-with-cors-header.js';
    return openWindowAndExpectResult(
        kWindowURL, kScriptURL, workletType, 'RESOLVED');
  }, 'Importing a remote-origin script from a remote-origin worklet script '+
     'should not be blocked because the script-src * directive allows it.');

  promise_test(t => {
    const kWindowURL =
        'resources/addmodule-window.html?pipe=header(' +
        'Content-Security-Policy, worker-src \'self\' \'unsafe-inline\')';
    const kScriptURL =
        get_host_info().HTTPS_REMOTE_ORIGIN +
        '/worklets/resources/empty-worklet-script-with-cors-header.js';
    return openWindowAndExpectResult(
        kWindowURL, kScriptURL, workletType, 'RESOLVED');
  }, 'Importing a remote-origin worklet script should not be blocked by ' +
     'the worker-src directive because worklets obey the script-src ' +
     'directive.');

  promise_test(t => {
    const kWindowURL = 'resources/addmodule-window.html';
    const kScriptURL =
        get_host_info().HTTP_ORIGIN +
        '/worklets/resources/empty-worklet-script.js';
    return openWindowAndExpectResult(
        kWindowURL, kScriptURL, workletType, 'REJECTED');
  }, 'Importing an insecure-origin worklet script should be blocked because ' +
     'of mixed contents.');

  promise_test(t => {
    const kWindowURL = 'resources/addmodule-window.html?pipe=header(' +
                       'Content-Security-Policy, upgrade-insecure-requests)';
    // This test relies on some unintuitive cleverness due to WPT's test setup:
    // 'Upgrade-Insecure-Requests' does not upgrade the port number, so we use
    // URLs in the form `http://[host]:[https-port]`. If the upgrade fails, the
    // load will fail, as we don't serve HTTP over the secure port.
    const kHost = get_host_info().ORIGINAL_HOST;
    const kPort = get_host_info().HTTPS_PORT;
    const kScriptURL =
        `http://${kHost}:${kPort}/worklets/resources/empty-worklet-script.js`;
    return openWindowAndExpectResult(
        kWindowURL, kScriptURL, workletType, 'RESOLVED');
  }, 'Importing an insecure-origin worklet script should not be blocked ' +
     'because the upgrade-insecure-requests directive translates it as the ' +
     'secure origin.');

  promise_test(t => {
    const kWindowURL = 'resources/addmodule-window.html';
    const kScriptURL = 'import-insecure-origin-empty-worklet-script.sub.js';
    return openWindowAndExpectResult(
        kWindowURL, kScriptURL, workletType, 'REJECTED');
  }, 'Importing an insecure-origin script from a secure-origin worklet ' +
     'script should be blocked because of mixed contents.');

  promise_test(t => {
    const kWindowURL = 'resources/addmodule-window.html?pipe=header(' +
                       'Content-Security-Policy, upgrade-insecure-requests)';
    const kScriptURL = 'import-insecure-origin-empty-worklet-script.sub.js';
    return openWindowAndExpectResult(
        kWindowURL, kScriptURL, workletType, 'RESOLVED');
  }, 'Importing an insecure-origin script from a secure-origin worklet ' +
     'script should not be blocked because the upgrade-insecure-requests ' +
     'directive translates it as the secure origin.');
}