OLD | NEW |
1 <!DOCTYPE html> | 1 <!DOCTYPE html> |
2 <meta charset=utf-8> | 2 <meta charset=utf-8> |
3 <title>Subresource Integrity</title> | 3 <title>Subresource Integrity</title> |
4 <script src="../../../resources/testharness.js"></script> | 4 <script src="../../../resources/testharness.js"></script> |
5 <script src="../../../resources/testharnessreport.js"></script> | 5 <script src="../../../resources/testharnessreport.js"></script> |
6 | 6 |
7 <div id="log"></div> | 7 <div id="log"></div> |
8 | 8 |
9 <div id="container"></div> | 9 <div id="container"></div> |
10 <script> | 10 <script> |
(...skipping 101 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
112 e.addEventListener("error", function() { | 112 e.addEventListener("error", function() { |
113 test.step(function(){ assert_unreached("Good load fired error ha
ndler.") }) | 113 test.step(function(){ assert_unreached("Good load fired error ha
ndler.") }) |
114 }); | 114 }); |
115 } else { | 115 } else { |
116 e.addEventListener("load", function() { | 116 e.addEventListener("load", function() { |
117 test.step(function() { assert_unreached("Bad load succeeded.")
}) | 117 test.step(function() { assert_unreached("Bad load succeeded.")
}) |
118 }); | 118 }); |
119 e.addEventListener("error", function() { | 119 e.addEventListener("error", function() { |
120 test.step(function() { | 120 test.step(function() { |
121 var background = window.getComputedStyle(div, null).getPrope
rtyValue("background-color"); | 121 var background = window.getComputedStyle(div, null).getPrope
rtyValue("background-color"); |
122 assert_equals(background, "rgba(0, 0, 0, 0)"); | 122 assert_not_equals(background, that.passValue); |
123 test.done(); | 123 test.done(); |
124 }); | 124 }); |
125 }); | 125 }); |
126 } | 126 } |
127 container.appendChild(div); | 127 container.appendChild(div); |
128 container.appendChild(e); | 128 container.appendChild(e); |
129 this.customCallback(e, container); | 129 this.customCallback(e, container); |
130 }; | 130 }; |
131 | 131 |
132 var style_tests = []; | 132 var style_tests = []; |
(...skipping 25 matching lines...) Expand all Loading... |
158 | 158 |
159 new SRIScriptTest( | 159 new SRIScriptTest( |
160 true, | 160 true, |
161 "Same-origin with correct sha512 hash.", | 161 "Same-origin with correct sha512 hash.", |
162 "matching-digest.js", | 162 "matching-digest.js", |
163 "sha512-geByvIIRspbnUnwooKGNNCb39nvg+EW0O9hDScTXeo/9pVZztLSUYU3LNV6H0lZa
po8bCJUpyPPLAzE9fDzpxg==" | 163 "sha512-geByvIIRspbnUnwooKGNNCb39nvg+EW0O9hDScTXeo/9pVZztLSUYU3LNV6H0lZa
po8bCJUpyPPLAzE9fDzpxg==" |
164 ).execute(); | 164 ).execute(); |
165 | 165 |
166 new SRIScriptTest( | 166 new SRIScriptTest( |
167 true, | 167 true, |
168 "Smame-origin with empty integrity.", | 168 "Same-origin with empty integrity.", |
169 "matching-digest.js", | 169 "matching-digest.js", |
170 "" | 170 "" |
171 ).execute(); | 171 ).execute(); |
172 | 172 |
173 new SRIScriptTest( | 173 new SRIScriptTest( |
174 false, | 174 false, |
175 "Same-origin with incorrect hash.", | 175 "Same-origin with incorrect hash.", |
176 "non-matching-digest.js", | 176 "non-matching-digest.js", |
177 "sha256-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead" | 177 "sha256-deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdead" |
178 ).execute(); | 178 ).execute(); |
(...skipping 60 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
239 | 239 |
240 new SRIScriptTest( | 240 new SRIScriptTest( |
241 false, | 241 false, |
242 "<crossorigin='anonymous'> with CORS-ineligible resource", | 242 "<crossorigin='anonymous'> with CORS-ineligible resource", |
243 xorigin_ineligible_script, | 243 xorigin_ineligible_script, |
244 "sha256-F5fXKTX7SiWjtgybxiBZIo2qhh2WiQnNx372E60XrOo=", | 244 "sha256-F5fXKTX7SiWjtgybxiBZIo2qhh2WiQnNx372E60XrOo=", |
245 "anonymous" | 245 "anonymous" |
246 ).execute(); | 246 ).execute(); |
247 | 247 |
248 new SRIScriptTest( | 248 new SRIScriptTest( |
249 true, | 249 false, |
250 "Cross-origin, not CORS request, with correct hash", | 250 "Cross-origin, not CORS request, with correct hash", |
251 xorigin_anon_script, | 251 xorigin_anon_script, |
252 "sha256-51AjITq701Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0=" | 252 "sha256-51AjITq701Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0=" |
253 ).execute(); | 253 ).execute(); |
254 | 254 |
255 new SRIScriptTest( | 255 new SRIScriptTest( |
256 true, | 256 false, |
257 "Cross-origin, not CORS request, with hash masmatch", | 257 "Cross-origin, not CORS request, with hash mismatch", |
258 xorigin_anon_script, | 258 xorigin_anon_script, |
259 "sha256-deadbeef01Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0=" | 259 "sha256-deadbeef01Y0yKSx3/UoIKtIY2UQ9+H8WGyyMuOWOC0=" |
260 ).execute(); | 260 ).execute(); |
261 | 261 |
262 new SRIScriptTest( | 262 new SRIScriptTest( |
263 true, | 263 true, |
264 "Cross-origin, empty integrity", | 264 "Cross-origin, empty integrity", |
265 xorigin_anon_script, | 265 xorigin_anon_script, |
266 "" | 266 "" |
267 ).execute(); | 267 ).execute(); |
(...skipping 12 matching lines...) Expand all Loading... |
280 "foo666-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E=" | 280 "foo666-U9WYDtBWkcHx13+9UKk/3Q5eoqDc4YGxYb07EPWzb9E=" |
281 ).execute(); | 281 ).execute(); |
282 | 282 |
283 // Style tests | 283 // Style tests |
284 new SRIStyleTest( | 284 new SRIStyleTest( |
285 style_tests, | 285 style_tests, |
286 true, | 286 true, |
287 "Same-origin with correct sha256 hash", | 287 "Same-origin with correct sha256 hash", |
288 { | 288 { |
289 href: "style.css", | 289 href: "style.css", |
290 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F-SPLT7YZk7gyCWUV4=" | 290 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=" |
291 } | 291 } |
292 ); | 292 ); |
293 | 293 |
294 new SRIStyleTest( | 294 new SRIStyleTest( |
295 style_tests, | 295 style_tests, |
296 true, | 296 true, |
297 "Same-origin with correct sha384 hash", | 297 "Same-origin with correct sha384 hash", |
298 { | 298 { |
299 href: "style.css", | 299 href: "style.css", |
300 integrity: "sha384-wDAWxH4tOWBwAwHfBn9B7XuNmFxHTMeigAMwn0iVQ0zq3FtmY
MLxihcGnU64CwcX" | 300 integrity: "sha384-wDAWxH4tOWBwAwHfBn9B7XuNmFxHTMeigAMwn0iVQ0zq3FtmY
MLxihcGnU64CwcX" |
(...skipping 59 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
360 integrity: "sha512-9wXDjd6Wq3H6nPAhI9zOvG7mJkUr03MTxaO+8ztTKnfJif42l
aL93Be/IF6YYZHHF4esitVYxiwpY2HSZX4l6w== sha256-deadbeefdeadbeefdeadbeefdeadbeefd
eadbeefdead" | 360 integrity: "sha512-9wXDjd6Wq3H6nPAhI9zOvG7mJkUr03MTxaO+8ztTKnfJif42l
aL93Be/IF6YYZHHF4esitVYxiwpY2HSZX4l6w== sha256-deadbeefdeadbeefdeadbeefdeadbeefd
eadbeefdead" |
361 } | 361 } |
362 ); | 362 ); |
363 | 363 |
364 new SRIStyleTest( | 364 new SRIStyleTest( |
365 style_tests, | 365 style_tests, |
366 false, | 366 false, |
367 "Same-origin with sha256 match, sha512 mismatch", | 367 "Same-origin with sha256 match, sha512 mismatch", |
368 { | 368 { |
369 href: "style.css", | 369 href: "style.css", |
370 integrity: "sha512-deadbeef9wXDjd6Wq3H6nPAhI9zOvG7mJkUr03MTxaO+8ztTK
nfJif42laL93Be/IF6YYZHHF4esitVYxiwpY2== sha256-CzHgdJ7wOccM8L89n4bhcJMz3F-SPLT7Y
Zk7gyCWUV4=" | 370 integrity: "sha512-deadbeef9wXDjd6Wq3H6nPAhI9zOvG7mJkUr03MTxaO+8ztTK
nfJif42laL93Be/IF6YYZHHF4esitVYxiwpY2== sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7Y
Zk7gyCWUV4=" |
371 } | 371 } |
372 ); | 372 ); |
373 | 373 |
374 new SRIStyleTest( | 374 new SRIStyleTest( |
375 style_tests, | 375 style_tests, |
376 true, | 376 true, |
377 "<crossorigin='anonymous'> with correct hash, ACAO: *", | 377 "<crossorigin='anonymous'> with correct hash, ACAO: *", |
378 { | 378 { |
379 href: xorigin_anon_style, | 379 href: xorigin_anon_style, |
380 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=", | 380 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=", |
(...skipping 40 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
421 "<crossorigin='anonymous'> with CORS-ineligible resource", | 421 "<crossorigin='anonymous'> with CORS-ineligible resource", |
422 { | 422 { |
423 href: xorigin_ineligible_style, | 423 href: xorigin_ineligible_style, |
424 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=", | 424 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=", |
425 crossorigin: "anonymous" | 425 crossorigin: "anonymous" |
426 } | 426 } |
427 ); | 427 ); |
428 | 428 |
429 new SRIStyleTest( | 429 new SRIStyleTest( |
430 style_tests, | 430 style_tests, |
431 true, | 431 false, |
432 "Cross-origin, not CORS request, with correct hash", | 432 "Cross-origin, not CORS request, with correct hash", |
433 { | 433 { |
434 href: xorigin_anon_style, | 434 href: xorigin_anon_style, |
435 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=" | 435 integrity: "sha256-CzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk7gyCWUV4=" |
436 } | 436 } |
437 ); | 437 ); |
438 | 438 |
439 new SRIStyleTest( | 439 new SRIStyleTest( |
440 style_tests, | 440 style_tests, |
441 true, | 441 false, |
442 "Cross-origin, not CORS request, with hash masmatch", | 442 "Cross-origin, not CORS request, with hash mismatch", |
443 { | 443 { |
444 href: xorigin_anon_style, | 444 href: xorigin_anon_style, |
445 integrity: "sha256-deadbeefCzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk=" | 445 integrity: "sha256-deadbeefCzHgdJ7wOccM8L89n4bhcJMz3F+SPLT7YZk=" |
446 } | 446 } |
447 ); | 447 ); |
448 | 448 |
449 new SRIStyleTest( | 449 new SRIStyleTest( |
450 style_tests, | 450 style_tests, |
451 true, | 451 true, |
452 "Cross-origin, empty integrity", | 452 "Cross-origin, empty integrity", |
(...skipping 83 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
536 alternate.disabled = false; | 536 alternate.disabled = false; |
537 } | 537 } |
538 ); | 538 ); |
539 | 539 |
540 style_tests.execute(); | 540 style_tests.execute(); |
541 | 541 |
542 </script> | 542 </script> |
543 <!-- TODO check cache-poisoned resources, transfer-encoding, 3xx redirect | 543 <!-- TODO check cache-poisoned resources, transfer-encoding, 3xx redirect |
544 to resource with matching hash, and cross-origin leakage test as in sec5.3. | 544 to resource with matching hash, and cross-origin leakage test as in sec5.3. |
545 --> | 545 --> |
OLD | NEW |