Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(185)

Issues Search
    My Issues | Starred     Open | Closed | All

Unified Diff: third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-strict-dynamic.html

Issue 2421473004: CSP: Fire 'SecurityPolicyViolation' on the offending element. (Closed)
Patch Set: Test. Created 4 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-multiple-allowed.php ('k') | third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-strict-dynamic-whitelist.html » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-strict-dynamic.html
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-strict-dynamic.html b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-strict-dynamic.html
index 81e21f8cf22a96402c805693d45bb722962b413a..6c484e414e4a9ff413ae3ccb7daf13062e85c4a9 100644
--- a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-strict-dynamic.html
+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-strict-dynamic.html
@@ -4,34 +4,16 @@
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abcdefg' 'strict-dynamic'">
<script src="/resources/testharness.js" nonce="abcdefg"></script>
<script src="/resources/testharnessreport.js" nonce="abcdefg"></script>
+ <script src="../resources/securitypolicyviolation-helper.js" nonce="abcdefg"></script>
</head>
<body>
- <script nonce="abcdefg">
- function generateURL(type) {
- return 'http://localhost:8000/security/contentSecurityPolicy/resources/loaded.js?' + type;
- }
-
- var loaded = {};
- var blocked = {};
- window.addEventListener("message", function (e) {
- loaded[e.data] = true;
- });
- document.addEventListener("securitypolicyviolation", function (e) {
- blocked[e.lineNumber] = true;
- });
- </script>
<!-- Need to individually wrap test cases in script blocks. Violation reports triggered by document.write() calls while the parser is waiting on blocking scipts are missing line numbers. See: https://crbug.com/649085. -->
<script nonce="abcdefg">
async_test(function (t) {
var e = document.createElement('script');
e.src = generateURL("append");
- e.onload = t.step_func(function () {
- // Delay the check until after the postMessage has a chance to execute.
- setTimeout(t.step_func_done(function () {
- assert_true(loaded[generateURL("append")]);
- }), 1);
- });
e.onerror = t.unreached_func("Error should not be triggered.");
+ assert_script_loads(t, generateURL("append"), 17);
document.body.appendChild(e);
}, "Script injected via 'appendChild' is allowed with 'strict-dynamic'.");
</script>
@@ -40,13 +22,8 @@
var e = document.createElement('script');
e.src = generateURL("append-async");
e.async = true;
- e.onload = t.step_func(function () {
- // Delay the check until after the postMessage has a chance to execute.
- setTimeout(t.step_func_done(function () {
- assert_true(loaded[generateURL("append-async")]);
- }), 1);
- });
e.onerror = t.unreached_func("Error should not be triggered.");
+ assert_script_loads(t, generateURL("append-async"), 27);
document.body.appendChild(e);
}, "Async script injected via 'appendChild' is allowed with 'strict-dynamic'.");
</script>
@@ -55,55 +32,35 @@
var e = document.createElement('script');
e.src = generateURL("append-defer");
e.defer = true;
- e.onload = t.step_func(function () {
- // Delay the check until after the postMessage has a chance to execute.
- setTimeout(t.step_func_done(function () {
- assert_true(loaded[generateURL("append-defer")]);
- }), 1);
- });
e.onerror = t.unreached_func("Error should not be triggered.");
+ assert_script_loads(t, generateURL("append-defer"), 37);
document.body.appendChild(e);
}, "Deferred script injected via 'appendChild' is allowed with 'strict-dynamic'.");
</script>
<script nonce="abcdefg">
async_test(function (t) {
+ assert_script_failed(t, generateURL("write"), 43);
document.write("<scr" + "ipt src='" + generateURL("write") + "'></scr" + "ipt>");
- setTimeout(t.step_func_done(function () {
- assert_equals(loaded[generateURL("write")], undefined);
- assert_true(blocked[70]);
- }), 1);
}, "Script injected via 'document.write' is not allowed with 'strict-dynamic'.");
</script>
<script nonce="abcdefg">
async_test(function (t) {
+ assert_script_failed(t, generateURL("write-defer"), 49);
document.write("<scr" + "ipt defer src='" + generateURL("write-defer") + "'></scr" + "ipt>");
- setTimeout(t.step_func_done(function () {
- assert_equals(loaded[generateURL("write-defer")], undefined);
- assert_true(blocked[79]);
- }), 1);
}, "Deferred script injected via 'document.write' is not allowed with 'strict-dynamic'.");
</script>
<script nonce="abcdefg">
async_test(function (t) {
+ assert_script_failed(t, generateURL("write-async"), 55);
document.write("<scr" + "ipt async src='" + generateURL("write-async") + "'></scr" + "ipt>");
- setTimeout(t.step_func_done(function () {
- assert_equals(loaded[generateURL("write-async")], undefined);
- assert_true(blocked[88]);
- }), 1);
}, "Async script injected via 'document.write' is not allowed with 'strict-dynamic'.");
</script>
<script nonce="abcdefg" defer>
async_test(function (t) {
var e = document.createElement('script');
e.src = generateURL("defer-append");
- e.onload = t.step_func(function () {
- // Delay the check until after the postMessage has a chance to execute.
- setTimeout(t.step_func_done(function () {
- assert_true(loaded[generateURL("defer-append")]);
- assert_equals(blocked[generateURL("defer-append")], undefined);
- }), 1);
- });
e.onerror = t.unreached_func("Error should not be triggered.");
+ assert_script_loads(t, generateURL("defer-append"), 64);
document.body.appendChild(e);
}, "Script injected via deferred 'appendChild' is allowed with 'strict-dynamic'.");
</script>
@@ -112,14 +69,8 @@
var e = document.createElement('script');
e.src = generateURL("defer-append-async");
e.async = true;
- e.onload = t.step_func(function () {
- // Delay the check until after the postMessage has a chance to execute.
- setTimeout(t.step_func_done(function () {
- assert_true(loaded[generateURL("defer-append-async")]);
- assert_equals(blocked[generateURL("defer-append-async")], undefined);
- }), 1);
- });
e.onerror = t.unreached_func("Error should not be triggered.");
+ assert_script_loads(t, generateURL("defer-append-async"), 74);
document.body.appendChild(e);
}, "Async script injected via deferred 'appendChild' is allowed with 'strict-dynamic'.");
</script>
@@ -128,42 +79,27 @@
var e = document.createElement('script');
e.src = generateURL("defer-append-defer");
e.defer = true;
- e.onload = t.step_func(function () {
- // Delay the check until after the postMessage has a chance to execute.
- setTimeout(t.step_func_done(function () {
- assert_true(loaded[generateURL("defer-append-defer")]);
- assert_equals(blocked[generateURL("defer-append-defer")], undefined);
- }), 1);
- });
e.onerror = t.unreached_func("Error should not be triggered.");
+ assert_script_loads(t, generateURL("defer-append-defer"), 84);
document.body.appendChild(e);
}, "Deferred script injected via deferred 'appendChild' is allowed with 'strict-dynamic'.");
</script>
<script nonce="abcdefg" defer>
async_test(function (t) {
+ assert_script_failed(t, generateURL("defer-write"), 90);
document.write("<scr" + "ipt src='" + generateURL("defer-write") + "'></scr" + "ipt>");
- setTimeout(t.step_func_done(function () {
- assert_equals(loaded[generateURL("defer-write")], undefined);
- assert_true(blocked[144]);
- }), 1);
}, "Script injected via deferred 'document.write' is not allowed with 'strict-dynamic'.");
</script>
<script nonce="abcdefg" defer>
async_test(function (t) {
+ assert_script_failed(t, generateURL("defer-write-defer"), 96);
document.write("<scr" + "ipt defer src='" + generateURL("defer-write-defer") + "'></scr" + "ipt>");
- setTimeout(t.step_func_done(function () {
- assert_equals(loaded[generateURL("defer-write-defer")], undefined);
- assert_true(blocked[153]);
- }), 1);
}, "Deferred script injected via deferred 'document.write' is not allowed with 'strict-dynamic'.");
</script>
<script nonce="abcdefg" defer>
async_test(function (t) {
+ assert_script_failed(t, generateURL("defer-write-async"), 102);
document.write("<scr" + "ipt async src='" + generateURL("defer-write-async") + "'></scr" + "ipt>");
- setTimeout(t.step_func_done(function () {
- assert_equals(loaded[generateURL("defer-write-async")], undefined);
- assert_true(blocked[162]);
- }), 1);
}, "Async script injected via deferred 'document.write' is not allowed with 'strict-dynamic'.");
</script>
</body>
« no previous file with comments | « third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-multiple-allowed.php ('k') | third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/strict-dynamic/script-src-strict-dynamic-whitelist.html » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698