third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html - Issue 1420483005: CSP: Don't perform NFC normalization prior to hashing

Unified Diff: third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html

Issue 1420483005: CSP: Don't perform NFC normalization prior to hashing (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@nfc-frame

Patch Set: Flip normalization test, leave wtf/text alone Created 5 years, 2 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

« no previous file with comments | « no previous file | third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization-expected.txt » ('j') | third_party/WebKit/Source/core/frame/csp/CSPDirectiveList.cpp » ('J')
Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

Index: third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html

diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html

index b8264b4112298f074664f2e051580d367f601864..96bb6c47ad8b933da10533bb19c3bc4cec5c2c3a 100644

--- a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html

+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/scripthash-unicode-normalization.html

@@ -2,30 +2,32 @@

<html>

<head>

- <meta http-equiv="Content-Security-Policy" content="script-src 'sha1-zv73epHrGLk/k/onuSBPoZAxzaA=' 'sha1-gbGNUiHncUNJ+diPbIoc+x6KrLo='">

+ <meta http-equiv="Content-Security-Policy" content="script-src 'sha1-zv73epHrGLk/k/onuSBPoZAxzaA=' 'sha256-U4Gr+1CJNHI/q8KjKw7YgdNNzwOinyKeRC4leoWXeMU='">

if (window.testRunner)

testRunner.dumpAsText();

</script>

<!-- The following two scripts contain two separate code points (U+00C5

and U+212B, respectively) which, depending on your text editor, might be

- rendered the same. However, their difference is important as they should

- be NFC normalized to the same code point, thus they should hash to the

- same value.-->

+ rendered the same. However, their difference is important as they would

+ be NFC normalized to the same code point, matching the hash. Since NFC

+ normalization should not be performed, the second script should not

+ match the hash and must not be executed. -->

'Å';

- alert('PASS');

+ alert('PASS (1/1)');

jww 2015/10/29 21:22:14 Unfortunately, I don't think this tests what we ac

jsbell 2015/10/29 22:01:46 Oh, duh, thanks. Of course, they started off that

jww 2015/10/29 22:06:46 Looks good!

</script>

'Å';

- alert('PASS');

+ alert('FAIL');

</script>

</head>

<body>

<p>

This tests Unicode normalization. While appearing the same, the

- strings in the scripts are different Unicode points, but through

- normalization, should be the same when the hash is taken.

+ strings in the scripts are different Unicode points. Unicode NFC

+ normalization would make both match the hash, but normalization

+ should not be performed, and so the second script should not run.

</p>

</body>

</html>