Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(20)

Unified Diff: third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_new_function.html

Issue 2704543002: Import wpt@3bd204d7e86fd81e98e63f4ce59b95d98bad1c54 (Closed)
Patch Set: Created 3 years, 10 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_new_function.html
diff --git a/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_new_function.html b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_new_function.html
new file mode 100644
index 0000000000000000000000000000000000000000..3041db056f2d6a72f420c6a5ec6dd1c2c170d7d9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_new_function.html
@@ -0,0 +1,31 @@
+<!DOCTYPE HTML>
+<html>
+
+<head>
+ <title>Scripts injected via `new Function()` are allowed with `strict-dynamic` with `unsafe-eval`.</title>
+ <script src='/resources/testharness.js' nonce='dummy'></script>
+ <script src='/resources/testharnessreport.js' nonce='dummy'></script>
+
+ <!-- CSP served: script-src 'strict-dynamic' 'nonce-dummy' 'unsafe-eval' -->
+</head>
+
+<body>
+ <h1>Scripts injected via `new Function()` are allowed with `strict-dynamic` with `unsafe-eval`.</h1>
+ <div id='log'></div>
+
+ <script nonce='dummy'>
+ var newFunctionScriptRan = false;
+ async_test(function(t) {
+ window.addEventListener('securitypolicyviolation', t.unreached_func('No CSP violation report has fired.'));
+ try {
+ new Function('newFunctionScriptRan = true;')();
+ } catch (e) {
+ assert_unreached("`new Function()` should be allowed with `strict-dynamic` with `unsafe-eval`.");
+ }
+ assert_true(newFunctionScriptRan);
+ t.done();
+ }, "Script injected via `new Function()` is allowed with `strict-dynamic` with `unsafe-eval`.");
+ </script>
+</body>
+
+</html>

Powered by Google App Engine
This is Rietveld 408576698