| Index: LayoutTests/http/tests/security/contentSecurityPolicy/filesystem-urls-match-self.html
|
| diff --git a/LayoutTests/http/tests/security/contentSecurityPolicy/filesystem-urls-match-self.html b/LayoutTests/http/tests/security/contentSecurityPolicy/filesystem-urls-match-self.html
|
| index 72232c41fb676c9decff0f0cbe43db1ce9532eab..0a7dd9cb2cdbedf77f6c2507179aa1a69e7b10c5 100644
|
| --- a/LayoutTests/http/tests/security/contentSecurityPolicy/filesystem-urls-match-self.html
|
| +++ b/LayoutTests/http/tests/security/contentSecurityPolicy/filesystem-urls-match-self.html
|
| @@ -2,40 +2,37 @@
|
| <html>
|
| <head>
|
| <meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'self'">
|
| - </head>
|
| - <body>
|
| - <p>
|
| - filesystem: URLs are same-origin with the page in which they were
|
| - created, and should therefore match the 'self' source in CSP
|
| - directives.
|
| - </p>
|
| -
|
| + <script src="/resources/testharness.js"></script>
|
| + <script src="/resources/testharnessreport.js"></script>
|
| <script>
|
| - if (window.testRunner) {
|
| - testRunner.dumpAsText();
|
| - testRunner.waitUntilDone();
|
| - }
|
| - function pass() {
|
| - alert("PASS (1/1)!");
|
| - if (window.testRunner)
|
| - testRunner.notifyDone();
|
| - }
|
| + var t = async_test("blob: does not match 'self' (see step 2 of http://www.w3.org/TR/CSP2/#match-source-expression)");
|
|
|
| window.webkitRequestFileSystem(TEMPORARY, 1024*1024 /*1MB*/, function(fs) {
|
| - fs.root.getFile('pass.js', {create: true}, function(fileEntry) {
|
| + fs.root.getFile('fail.js', {create: true}, function(fileEntry) {
|
| fileEntry.createWriter(function(fileWriter) {
|
| fileWriter.onwriteend = function(e) {
|
| var script = document.createElement('script');
|
| - script.src =fileEntry.toURL('application/javascript');
|
| +
|
| + script.addEventListener('load', t.step_func(function () {
|
| + assert_unreached();
|
| + }));
|
| +
|
| + script.addEventListener('error', t.step_func(function () {
|
| + t.done();
|
| + }));
|
| +
|
| + script.src = fileEntry.toURL('application/javascript');
|
| document.body.appendChild(script);
|
| };
|
|
|
| // Create a new Blob and write it to pass.js.
|
| - var b = new Blob(['pass();'], {type: 'application/javascript'});
|
| + var b = new Blob(['assert_unreached();'], {type: 'application/javascript'});
|
| fileWriter.write(b);
|
| });
|
| });
|
| });
|
| </script>
|
| + </head>
|
| + <body>
|
| </body>
|
| </html>
|
|
|
Chromium Code Reviews
Issue 1178373004:
'blob:' URLs should not match 'self' in CSP source expression lists. (Closed)
Base URL: https://chromium.googlesource.com/chromium/blink.git@master