| OLD | NEW |
| 1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
| 2 <meta charset=utf-8> | 2 <meta charset=utf-8> |
| 3 <title>Subresource Integrity</title> | 3 <title>Subresource Integrity</title> |
| 4 <script src="../../../resources/testharness.js"></script> | 4 <script src="../../../resources/testharness.js"></script> |
| 5 <script src="../../../resources/testharnessreport.js"></script> | 5 <script src="../../../resources/testharnessreport.js"></script> |
| 6 | 6 |
| 7 <div id="log"></div> | 7 <div id="log"></div> |
| 8 | 8 |
| 9 <div id="container"></div> | 9 <div id="container"></div> |
| 10 <script> | 10 <script> |
| (...skipping 101 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 112 e.addEventListener("error", function() { | 112 e.addEventListener("error", function() { |
| 113 test.step(function(){ assert_unreached("Good load fired error ha
ndler.") }) | 113 test.step(function(){ assert_unreached("Good load fired error ha
ndler.") }) |
| 114 }); | 114 }); |
| 115 } else { | 115 } else { |
| 116 e.addEventListener("load", function() { | 116 e.addEventListener("load", function() { |
| 117 test.step(function() { assert_unreached("Bad load succeeded.")
}) | 117 test.step(function() { assert_unreached("Bad load succeeded.")
}) |
| 118 }); | 118 }); |
| 119 e.addEventListener("error", function() { | 119 e.addEventListener("error", function() { |
| 120 test.step(function() { | 120 test.step(function() { |
| 121 var background = window.getComputedStyle(div, null).getPrope
rtyValue("background-color"); | 121 var background = window.getComputedStyle(div, null).getPrope
rtyValue("background-color"); |
| 122 assert_equals(background, "rgba(0, 0, 0, 0)"); | 122 assert_not_equals(background, that.passValue); |
| 123 test.done(); | 123 test.done(); |
| 124 }); | 124 }); |
| 125 }); | 125 }); |
| 126 } | 126 } |
| 127 container.appendChild(div); | 127 container.appendChild(div); |
| 128 container.appendChild(e); | 128 container.appendChild(e); |
| 129 this.customCallback(e, container); | 129 this.customCallback(e, container); |
| 130 }; | 130 }; |
| 131 | 131 |
| 132 var style_tests = []; | 132 var style_tests = []; |
| (...skipping 25 matching lines...) Expand all Loading... |
| 158 | 158 |
| 159 new SRIScriptTest( | 159 new SRIScriptTest( |
| 160 true, | 160 true, |
| 161 "Same-origin with correct sha512 hash.", | 161 "Same-origin with correct sha512 hash.", |
| 162 "matching-digest.js", | 162 "matching-digest.js", |
| 163 "sha512-geByvIIRspbnUnwooKGNNCb39nvg+EW0O9hDScTXeo/9pVZztLSUYU3LNV6H0lZa
po8bCJUpyPPLAzE9fDzpxg==" | 163 "sha512-geByvIIRspbnUnwooKGNNCb39nvg+EW0O9hDScTXeo/9pVZztLSUYU3LNV6H0lZa
po8bCJUpyPPLAzE9fDzpxg==" |
| 164 ).execute(); | 164 ).execute(); |
| 165 | 165 |
| 166 new SRIScriptTest( | 166 new SRIScriptTest( |
| 167 true, | 167 true, |
| 168 "Smame-origin with empty integrity.", | 168 "Same-origin with empty integrity.", |
| 169 "matching-digest.js", | 169 "matching-digest.js", |
| 170 "" | 170 "" |
| 171 ).execute(); | 171 ).execute(); |
| 172 | 172 |
| 173 new SRIScriptTest( | 173 new SRIScriptTest( |
| 174 false, | 174 false, |
| 175 "Same-origin with incorrect hash.", | 175 "Same-origin with incorrect hash.", |
| 176 "non-matching-digest.js", | 176 "non-matching-digest.js", |
| 177 "sha256-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead" | 177 "sha256-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead" |
| 178 ).execute(); | 178 ).execute(); |
| (...skipping 60 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 239 | 239 |
| 240 new SRIScriptTest( | 240 new SRIScriptTest( |
| 241 false, | 241 false, |
| 242 "<crossorigin='anonymous'> with CORS-ineligible resource", | 242 "<crossorigin='anonymous'> with CORS-ineligible resource", |
| 243 xorigin_ineligible_script, | 243 xorigin_ineligible_script, |
| 244 "sha256-F5fXKTX7SiWjtgybxiBZIo2qhh2WiQnNx372E60XrOo=", | 244 "sha256-F5fXKTX7SiWjtgybxiBZIo2qhh2WiQnNx372E60XrOo=", |
| 245 "anonymous" | 245 "anonymous" |
| 246 ).execute(); | 246 ).execute(); |
| 247 | 247 |
| 248 new SRIScriptTest( | 248 new SRIScriptTest( |
| 249 true, | 249 false, |
| 250 "Cross-origin, not CORS request, with correct hash", | 250 "Cross-origin, not CORS request, with correct hash", |
| 251 xorigin_anon_script, | 251 xorigin_anon_script, |
| 252 "sha256-51AjITq701Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0=" | 252 "sha256-51AjITq701Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0=" |
| 253 ).execute(); | 253 ).execute(); |
| 254 | 254 |
| 255 new SRIScriptTest( | 255 new SRIScriptTest( |
| 256 true, | 256 false, |
| 257 "Cross-origin, not CORS request, with hash masmatch", | 257 "Cross-origin, not CORS request, with hash mismatch", |
| 258 xorigin_anon_script, | 258 xorigin_anon_script, |
| 259 "sha256-deadbeef01Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0=" | 259 "sha256-deadbeef01Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0=" |
| 260 ).execute(); | 260 ).execute(); |
| 261 | 261 |
| 262 new SRIScriptTest( | 262 new SRIScriptTest( |
| 263 true, | 263 true, |
| 264 "Cross-origin, empty integrity", | 264 "Cross-origin, empty integrity", |
| 265 xorigin_anon_script, | 265 xorigin_anon_script, |
| 266 "" | 266 "" |
| 267 ).execute(); | 267 ).execute(); |
| (...skipping 12 matching lines...) Expand all Loading... |
| 280 "foo666-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E=" | 280 "foo666-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E=" |
| 281 ).execute(); | 281 ).execute(); |
| 282 | 282 |
| 283 // Style tests | 283 // Style tests |
| 284 new SRIStyleTest( | 284 new SRIStyleTest( |
| 285 style_tests, | 285 style_tests, |
| 286 true, | 286 true, |
| 287 "Same-origin with correct sha256 hash", | 287 "Same-origin with correct sha256 hash", |
| 288 { | 288 { |
| 289 href: "style.css", | 289 href: "style.css", |
| 290 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F-SPLT7YZk7gyCWUV4=" | 290 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=" |
| 291 } | 291 } |
| 292 ); | 292 ); |
| 293 | 293 |
| 294 new SRIStyleTest( | 294 new SRIStyleTest( |
| 295 style_tests, | 295 style_tests, |
| 296 true, | 296 true, |
| 297 "Same-origin with correct sha384 hash", | 297 "Same-origin with correct sha384 hash", |
| 298 { | 298 { |
| 299 href: "style.css", | 299 href: "style.css", |
| 300 integrity: "sha384-wDAWxH4tOWBwAwHfBn9B7XuNmFxHTMeigAMwn0iVQ0zq3FtmY
MLxihcGnU64CwcX" | 300 integrity: "sha384-wDAWxH4tOWBwAwHfBn9B7XuNmFxHTMeigAMwn0iVQ0zq3FtmY
MLxihcGnU64CwcX" |
| (...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 360 integrity: "sha512-9wXDjd6Wq3H6nPAhI9zOvG7mJkUr03MTxaO+8ztTKnfJif42l
aL93Be/IF6YYZHHF4esitVYxiwpY2HSZX4l6w== sha256-deadbeefdeadbeefdeadbeefdeadbeefd
eadbeefdead" | 360 integrity: "sha512-9wXDjd6Wq3H6nPAhI9zOvG7mJkUr03MTxaO+8ztTKnfJif42l
aL93Be/IF6YYZHHF4esitVYxiwpY2HSZX4l6w== sha256-deadbeefdeadbeefdeadbeefdeadbeefd
eadbeefdead" |
| 361 } | 361 } |
| 362 ); | 362 ); |
| 363 | 363 |
| 364 new SRIStyleTest( | 364 new SRIStyleTest( |
| 365 style_tests, | 365 style_tests, |
| 366 false, | 366 false, |
| 367 "Same-origin with sha256 match, sha512 mismatch", | 367 "Same-origin with sha256 match, sha512 mismatch", |
| 368 { | 368 { |
| 369 href: "style.css", | 369 href: "style.css", |
| 370 integrity: "sha512-deadbeef9wXDjd6Wq3H6nPAhI9zOvG7mJkUr03MTxaO+8ztTK
nfJif42laL93Be/IF6YYZHHF4esitVYxiwpY2== sha256-CzHgdJ7wOccM8L89n4bhcJMz3F-SPLT7Y
Zk7gyCWUV4=" | 370 integrity: "sha512-deadbeef9wXDjd6Wq3H6nPAhI9zOvG7mJkUr03MTxaO+8ztTK
nfJif42laL93Be/IF6YYZHHF4esitVYxiwpY2== sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7Y
Zk7gyCWUV4=" |
| 371 } | 371 } |
| 372 ); | 372 ); |
| 373 | 373 |
| 374 new SRIStyleTest( | 374 new SRIStyleTest( |
| 375 style_tests, | 375 style_tests, |
| 376 true, | 376 true, |
| 377 "<crossorigin='anonymous'> with correct hash, ACAO: *", | 377 "<crossorigin='anonymous'> with correct hash, ACAO: *", |
| 378 { | 378 { |
| 379 href: xorigin_anon_style, | 379 href: xorigin_anon_style, |
| 380 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=", | 380 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=", |
| (...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 421 "<crossorigin='anonymous'> with CORS-ineligible resource", | 421 "<crossorigin='anonymous'> with CORS-ineligible resource", |
| 422 { | 422 { |
| 423 href: xorigin_ineligible_style, | 423 href: xorigin_ineligible_style, |
| 424 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=", | 424 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=", |
| 425 crossorigin: "anonymous" | 425 crossorigin: "anonymous" |
| 426 } | 426 } |
| 427 ); | 427 ); |
| 428 | 428 |
| 429 new SRIStyleTest( | 429 new SRIStyleTest( |
| 430 style_tests, | 430 style_tests, |
| 431 true, | 431 false, |
| 432 "Cross-origin, not CORS request, with correct hash", | 432 "Cross-origin, not CORS request, with correct hash", |
| 433 { | 433 { |
| 434 href: xorigin_anon_style, | 434 href: xorigin_anon_style, |
| 435 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=" | 435 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=" |
| 436 } | 436 } |
| 437 ); | 437 ); |
| 438 | 438 |
| 439 new SRIStyleTest( | 439 new SRIStyleTest( |
| 440 style_tests, | 440 style_tests, |
| 441 true, | 441 false, |
| 442 "Cross-origin, not CORS request, with hash masmatch", | 442 "Cross-origin, not CORS request, with hash mismatch", |
| 443 { | 443 { |
| 444 href: xorigin_anon_style, | 444 href: xorigin_anon_style, |
| 445 integrity: "sha256-deadbeefCzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk=" | 445 integrity: "sha256-deadbeefCzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk=" |
| 446 } | 446 } |
| 447 ); | 447 ); |
| 448 | 448 |
| 449 new SRIStyleTest( | 449 new SRIStyleTest( |
| 450 style_tests, | 450 style_tests, |
| 451 true, | 451 true, |
| 452 "Cross-origin, empty integrity", | 452 "Cross-origin, empty integrity", |
| (...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 536 alternate.disabled = false; | 536 alternate.disabled = false; |
| 537 } | 537 } |
| 538 ); | 538 ); |
| 539 | 539 |
| 540 style_tests.execute(); | 540 style_tests.execute(); |
| 541 | 541 |
| 542 </script> | 542 </script> |
| 543 <!-- TODO check cache-poisoned resources, transfer-encoding, 3xx redirect | 543 <!-- TODO check cache-poisoned resources, transfer-encoding, 3xx redirect |
| 544 to resource with matching hash, and cross-origin leakage test as in sec5.3. | 544 to resource with matching hash, and cross-origin leakage test as in sec5.3. |
| 545 --> | 545 --> |
| OLD | NEW |