| OLD | NEW |
|---|
| (Empty) | |
| 1 <!DOCTYPE html> |
| 2 <html> |
| 3 <head> |
| 4 <title>script-src disallowed wildcard use</title> |
| 5 <script src="/resources/testharness.js"></script> |
| 6 <script src="/resources/testharnessreport.js"></script> |
| 7 </head> |
| 8 <body> |
| 9 <!-- enforcing policy: |
| 10 script-src 'nonce-nonce' *; connect-src 'self'; |
| 11 --> |
| 12 <script nonce="nonce"> |
| 13 var t1 = async_test('data: URIs should not match *'); |
| 14 t1.step(function() { |
| 15 var script = document.createElement("script"); |
| 16 script.src = 'data:application/javascript,'; |
| 17 script.addEventListener('load', t1.step_func(function() { |
| 18 assert_unreached('Should not successfully load data URI.'); |
| 19 })); |
| 20 script.addEventListener('error', t1.step_func(function() { |
| 21 t1.done(); |
| 22 })); |
| 23 document.head.appendChild(script); |
| 24 }); |
| 25 |
| 26 var t2 = async_test('blob: URIs should not match *'); |
| 27 t2.step(function() { |
| 28 var b = new Blob([''], { type: 'application/javascript' }); |
| 29 var script = document.createElement('script'); |
| 30 script.addEventListener('load', t2.step_func(function() { |
| 31 assert_unreached('Should not successfully load blob URI.'); |
| 32 })); |
| 33 script.addEventListener('error', t2.step_func(function() { |
| 34 t2.done(); |
| 35 })); |
| 36 |
| 37 script.src = URL.createObjectURL(b); |
| 38 document.head.appendChild(script); |
| 39 }); |
| 40 |
| 41 var t3 = async_test('filesystem URIs should not match *'); |
| 42 if (window.webkitRequestFileSystem) { |
| 43 window.webkitRequestFileSystem(TEMPORARY, 1024*1024 /*1MB*/, functio
n(fs) { |
| 44 fs.root.getFile('fail.js', {create: true}, function(fileEntry) { |
| 45 fileEntry.createWriter(function(fileWriter) { |
| 46 var script = document.createElement('script'); |
| 47 |
| 48 script.addEventListener('load', t3.step_func(function()
{ |
| 49 assert_unreached('Should not successfully load files
ystem URI.'); |
| 50 })); |
| 51 script.addEventListener('error', t3.step_func(function()
{ |
| 52 t3.done(); |
| 53 })); |
| 54 |
| 55 script.src = fileEntry.toURL('application/javascript'); |
| 56 document.body.appendChild(script); |
| 57 }); |
| 58 }); |
| 59 }); |
| 60 } else { |
| 61 t3.done(); |
| 62 } |
| 63 </script> |
| 64 </body> |
| 65 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2695813009:
Import wpt@503f5b5f78ec4e87d144f78609f363f0ed0ea8db (Closed)
