Chromium Code Reviews Chromium Code Reviews
Issue 2436003002:
CSP: Add 'script-sample' to violation reports. (Closed)
| Index: third_party/WebKit/LayoutTests/external/wpt/content-security-policy/securitypolicyviolation/script-sample-no-opt-in.html |
| diff --git a/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/securitypolicyviolation/script-sample-no-opt-in.html b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/securitypolicyviolation/script-sample-no-opt-in.html |
| new file mode 100644 |
| index 0000000000000000000000000000000000000000..f604b5ae1d9f8b110f0f36ea1a1e725de3e13d13 |
| --- /dev/null |
| +++ b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/securitypolicyviolation/script-sample-no-opt-in.html |
| @@ -0,0 +1,67 @@ |
| +<!doctype html> |
| +<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc'; style-src 'self'; img-src 'none'"> |
| +<script nonce="abc" src="/resources/testharness.js"></script> |
| +<script nonce="abc" src="/resources/testharnessreport.js"></script> |
| +<body> |
| +<script nonce="abc"> |
| + function waitForViolation(el) { |
| + return new Promise(resolve => { |
| + el.addEventListener('securitypolicyviolation', e => resolve(e)); |
| + }); |
| + } |
| + |
| + async_test(t => { |
| + var s = document.createElement('script'); |
| + s.innerText = "assert_unreached('inline script block')"; |
| + |
| + waitForViolation(s) |
| + .then(t.step_func_done(e => { |
| + assert_equals(e.blockedURI, "inline"); |
| + assert_equals(e.sample, ""); |
| + })); |
| + |
| + document.head.append(s); |
| + }, "Inline script should not have a sample."); |
| + |
| + async_test(t => { |
| + var a = document.createElement("a"); |
| + a.setAttribute("onclick", "assert_unreached('inline event handler')"); |
| + |
| + waitForViolation(a) |
| + .then(t.step_func_done(e => { |
| + assert_equals(e.blockedURI, "inline"); |
| + assert_equals(e.sample, ""); |
| + })); |
| + |
| + document.body.append(a); |
| + a.click(); |
| + }, "Inline event handlers should not have a sample."); |
| + |
| + async_test(t => { |
| + var i = document.createElement("iframe"); |
| + i.src = "javascript:'inline url'"; |
| + |
| + waitForViolation(i) |
| + .then(t.step_func_done(e => { |
| + assert_equals(e.blockedURI, "inline"); |
| + assert_equals(e.sample, ""); |
| + })); |
| + |
| + document.body.append(i); |
| + }, "JavaScript URLs in iframes should not have a sample."); |
| + |
| + async_test(t => { |
| + document.addEventListener('securitypolicyviolation', t.step_func(e => { |
| + if (e.blockedURI != "eval") |
| + return; |
| + |
| + assert_equals(e.sample, ""); |
| + t.done(); |
| + })); |
| + try { |
| + eval("assert_unreached('eval')"); |
| + assert_ureached('eval'); |
|
andypaicu
2017/02/24 09:45:49
The typo is elusive and finds its way back in.
|
| + } catch (e) { |
| + } |
| + }, "eval() should not have a sample."); |
| +</script> |
