| OLD | NEW |
|---|
| (Empty) | |
| 1 <!DOCTYPE html> |
| 2 <html> |
| 3 <head> |
| 4 <title>script-src disallowed wildcard use</title> |
| 5 <script src="../../../resources/testharness.js"></script> |
| 6 <script src="../../../resources/testharnessreport.js"></script> |
| 7 <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-nonce'
*"> |
| 8 </head> |
| 9 <body> |
| 10 <script nonce="nonce"> |
| 11 var t1 = async_test('data: URIs should not match *'); |
| 12 t1.step(function() { |
| 13 var script = document.createElement("script"); |
| 14 script.src = 'data:application/javascript,'; |
| 15 script.addEventListener('load', t1.step_func(function() { |
| 16 assert_unreached('Should not successfully load data URI.'); |
| 17 })); |
| 18 script.addEventListener('error', t1.step_func(function() { |
| 19 t1.done(); |
| 20 })); |
| 21 document.head.appendChild(script); |
| 22 }); |
| 23 |
| 24 var t2 = async_test('blob: URIs should not match *'); |
| 25 t2.step(function() { |
| 26 var b = new Blob([''], { type: 'application/javascript' }); |
| 27 var script = document.createElement('script'); |
| 28 script.addEventListener('load', t2.step_func(function() { |
| 29 assert_unreached('Should not successfully load blob URI.'); |
| 30 })); |
| 31 script.addEventListener('error', t2.step_func(function() { |
| 32 t2.done(); |
| 33 })); |
| 34 |
| 35 script.src = URL.createObjectURL(b); |
| 36 document.head.appendChild(script); |
| 37 }); |
| 38 |
| 39 if (window.webkitRequestFileSystem) { |
| 40 var t3 = async_test('filesystem URIs should not match *'); |
| 41 window.webkitRequestFileSystem(TEMPORARY, 1024*1024 /*1MB*/, functio
n(fs) { |
| 42 fs.root.getFile('fail.js', {create: true}, function(fileEntry) { |
| 43 fileEntry.createWriter(function(fileWriter) { |
| 44 var script = document.createElement('script'); |
| 45 |
| 46 script.addEventListener('load', t3.step_func(function()
{ |
| 47 assert_unreached('Should not successfully load files
ystem URI.'); |
| 48 })); |
| 49 script.addEventListener('error', t3.step_func(function()
{ |
| 50 t3.done(); |
| 51 })); |
| 52 |
| 53 script.src = fileEntry.toURL('application/javascript'); |
| 54 document.body.appendChild(script); |
| 55 }); |
| 56 }); |
| 57 }); |
| 58 } |
| 59 </script> |
| 60 </body> |
| 61 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 1361763005:
Disallow CSP source * matching of data:, blob:, and filesystem: URLs (Closed)
Base URL: https://chromium.googlesource.com/chromium/src@master