third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_meta_tag.html - Issue 2695813009: Import wpt@503f5b5f78ec4e87d144f78609f363f0ed0ea8db

Side by Side Diff: third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_meta_tag.html

Issue 2695813009: Import wpt@503f5b5f78ec4e87d144f78609f363f0ed0ea8db (Closed)

Patch Set: Skip some tests Created 3 years, 10 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

« no previous file with comments | « third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_javascript_uri.html.headers ('k') | third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_meta_tag.html.headers » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
(Empty)
	1 <!DOCTYPE HTML>

	2 <html>

	3

	4 <head>

	5 <title>A `strict-dynamic` policy can be served in a META tag.</title>

	6 <meta http-equiv="Content-Security-Policy" content="script-src 'strict-dynam ic' 'nonce-dummy'">

	7 <script src='/resources/testharness.js' nonce='dummy'></script>

	8 <script src='/resources/testharnessreport.js' nonce='dummy'></script>

	9

	10 <!-- CSP served: script-src 'strict-dynamic' 'nonce-dummy' -->

	11 </head>

	12

	13 <body>

	14 <h1>A `strict-dynamic` policy can be served in a META tag.</h1>

	15 <div id='log'></div>

	16

	17 <script nonce='dummy'>

	18 window.addEventListener('securitypolicyviolation', function(e) {

	19 assert_unreached('No CSP violation report has fired.');

	20 });

	21

	22 async_test(function(t) {

	23 window.addEventListener('message', t.step_func(function(e) {

	24 if (e.data === 'appendChild') {

	25 t.done();

	26 }

	27 }));

	28 var e = document.createElement('script');

	29 e.id = 'appendChild';

	30 e.src = 'simpleSourcedScript.js?' + e.id;

	31 e.onerror = t.unreached_func('Error should not be triggered.');

	32 document.body.appendChild(e);

	33 }, 'Script injected via `appendChild` is allowed with `strict-dynamic`.' );

	34 </script>

	35

	36 <script nonce='dummy'>

	37 async_test(function(t) {

	38 window.addEventListener('message', t.step_func(function(e) {

	39 if (e.data === 'appendChild-incorrectNonce') {

	40 t.done();

	41 }

	42 }));

	43 var e = document.createElement('script');

	44 e.id = 'appendChild-incorrectNonce';

	45 e.src = 'simpleSourcedScript.js?' + e.id;

	46 e.setAttribute('nonce', 'wrong');

	47 e.onerror = t.unreached_func('Error should not be triggered.');

	48 document.body.appendChild(e);

	49 }, 'Script injected via `appendChild` is allowed with `strict-dynamic`, even if it carries an incorrect nonce.');

	50 </script>

	51

	52 <script nonce='dummy'>

	53 async_test(function(t) {

	54 window.appendChildViaTextContent = t.step_func_done();

	55 var e = document.createElement('script');

	56 e.id = 'appendChild-textContent';

	57 e.textContent = "appendChildViaTextContent();";

	58 e.onerror = t.unreached_func('Error should not be triggered.');

	59 document.body.appendChild(e);

	60 }, 'Script injected via `appendChild` populated via `textContent` is all owed with `strict-dynamic`.');

	61 </script>

	62

	63 <script nonce='dummy'>

	64 async_test(function(t) {

	65 window.appendChildViaTextContentIncorrectNonce = t.step_func_done();

	66 var e = document.createElement('script');

	67 e.id = 'appendChild-textContent-incorrectNonce';

	68 e.setAttribute('nonce', 'wrong');

	69 e.textContent = "appendChildViaTextContentIncorrectNonce();";

	70 e.onerror = t.unreached_func('Error should not be triggered.');

	71 document.body.appendChild(e);

	72 }, 'Script injected via `appendChild` populated via `textContent` is all owed with `strict-dynamic`, even if it carries an incorrect nonce.');

	73 </script>

	74 </body>

	75

	76 </html>

OLD	NEW