third_party/WebKit/LayoutTests/external/wpt/content-security-policy/blink-contrib/blob-urls-do-not-match-self.sub.html - Issue 2704543002: Import wpt@3bd204d7e86fd81e98e63f4ce59b95d98bad1c54

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: third_party/WebKit/LayoutTests/external/wpt/content-security-policy/blink-contrib/blob-urls-do-not-match-self.sub.html

Issue 2704543002: Import wpt@3bd204d7e86fd81e98e63f4ce59b95d98bad1c54 (Closed)

Patch Set: Created 3 years, 10 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

OLD	NEW
(Empty)
	1 <!DOCTYPE html>

	2 <html>

	3

	4 <head>

	5 <!-- Programmatically converted from a WebKit Reftest, please forgive result ing idiosyncracies.-->

	6 <title>blob-urls-do-not-match-self</title>

	7 <script src="/resources/testharness.js"></script>

	8 <script src="/resources/testharnessreport.js"></script>

	9 <script src="../support/logTest.sub.js?logs=[]"></script>

	10 <script src="../support/alertAssert.sub.js?alerts=[]"></script>

	11 <!-- enforcing policy:

	12 script-src 'self' 'unsafe-inline'; connect-src 'self'; child-src 'self';

	13 -->

	14 </head>

	15

	16 <body>

	17 <p>

	18 blob: URLs are same-origin with the page in which they were created, but explicitly do not match the 'self' or '*' source in CSP directives be cause they are more akin to 'unsafe-inline' content.

	19 </p>

	20 <script>

	21 function fail() {

	22 alert_assert("FAIL!");

	23 }

	24 var b = new Blob(['fail();'], {

	25 type: 'application/javascript'

	26 });

	27 var script = document.createElement('script');

	28 script.src = URL.createObjectURL(b);

	29 document.body.appendChild(script);

	30

	31 </script>

	32 <div id="log"></div>

	33 <script async defer src="../support/checkReport.sub.js?reportExists=true&amp ;reportField=violated-directive&reportValue=script-src%20'self'%20 'unsafe-inline'%20''"></script>

	34 </body>

	35

	36 </html>

OLD	NEW