Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(14)

Unified Diff: third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_hashes.html

Issue 2704543002: Import wpt@3bd204d7e86fd81e98e63f4ce59b95d98bad1c54 (Closed)
Patch Set: Created 3 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_hashes.html
diff --git a/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_hashes.html b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_hashes.html
new file mode 100644
index 0000000000000000000000000000000000000000..acb9f00d80809de50132c7a5af761d8bbfd3235a
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_hashes.html
@@ -0,0 +1,52 @@
+<!DOCTYPE HTML>
+<html>
+
+<head>
+ <title>`strict-dynamic` allows scripts matching hashes present in the policy.</title>
+ <script src='/resources/testharness.js' nonce='dummy'></script>
+ <script src='/resources/testharnessreport.js' nonce='dummy'></script>
+
+ <!-- CSP served: script-src 'strict-dynamic' 'nonce-dummy' 'sha256-yU6Q7nD1TCBB9JvY06iIJ8ONLOPU4g8ml5JCDgXkv+M=' 'sha256-IFt1v6itHgqlrtInbPm/y7qyWcAlDbPgZM+92C5EZ5o=' -->
+</head>
+
+<body>
+ <h1>`strict-dynamic` allows scripts matching hashes present in the policy.</h1>
+ <div id='log'></div>
+
+ <script nonce='dummy'>
+ var hashScriptRan = false;
+ window.addEventListener('securitypolicyviolation', function(e) {
+ assert_unreached('No CSP violation report has fired.');
+ });
+ </script>
+
+ <!-- Hash: 'sha256-yU6Q7nD1TCBB9JvY06iIJ8ONLOPU4g8ml5JCDgXkv+M=' -->
+ <script>
+ hashScriptRan = true;
+ </script>
+
+ <script nonce='dummy'>
+ async_test(function(t) {
+ assert_true(hashScriptRan);
+ t.done();
+ }, "Script matching SHA256 hash is allowed with `strict-dynamic`.");
+ </script>
+
+ <!-- Hash: 'sha256-IFt1v6itHgqlrtInbPm/y7qyWcAlDbPgZM+92C5EZ5o=' -->
+ <script>
+ async_test(function(t) {
+ window.addEventListener('message', t.step_func(function(e) {
+ if (e.data === 'hashScript') {
+ t.done();
+ }
+ }));
+ var e = document.createElement('script');
+ e.id = 'hashScript';
+ e.src = 'simpleSourcedScript.js?' + e.id;
+ e.onerror = t.unreached_func('Error should not be triggered.');
+ document.body.appendChild(e);
+ }, 'Script injected via `appendChild` from a script matching SHA256 hash is allowed with `strict-dynamic`.');
+ </script>
+</body>
+
+</html>

Powered by Google App Engine
This is Rietveld 408576698