Index: third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-resubmission-main-page.html |
diff --git a/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-resubmission-main-page.html b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-resubmission-main-page.html |
new file mode 100644 |
index 0000000000000000000000000000000000000000..8b14e865c2075ff8be1d05e982e9761aac731500 |
--- /dev/null |
+++ b/third_party/WebKit/LayoutTests/http/tests/security/contentSecurityPolicy/1.1/form-action-resubmission-main-page.html |
@@ -0,0 +1,26 @@ |
+<!DOCTYPE html> |
+<!-- |
+ This test documents the current behavior with Content-Security-Policy and |
+ form resubmission. It makes a first navigation with a form submission, then |
+ the next page reloads itself. This is a form resubmission. The thing is that |
+ the second page has set the "form-action 'none'" policy. The reload is |
+ blocked. |
+--> |
+<html> |
+<head> |
+<script src="/resources/testharness.js"></script> |
+<script src="/resources/testharnessreport.js"></script> |
+<script> |
+ async_test(t => { |
+ var w; |
+ window.addEventListener("message", t.step_func_done(e => { |
+ w.close(); |
+ assert_equals(e.data.effectiveDirective, "form-action"); |
+ assert_equals(e.data.documentURI, "http://127.0.0.1:8000/security/contentSecurityPolicy/resources/form-action-resubmission-main-page-callee.html"); |
+ assert_equals(e.data.referrer, "http://127.0.0.1:8000/security/contentSecurityPolicy/resources/form-action-resubmission-main-page-caller.html"); |
+ })); |
+ w = window.open("/security/contentSecurityPolicy/resources/form-action-resubmission-main-page-caller.html"); |
+ }, "A form resubmission in the main frame should be blocked"); |
+</script> |
+</head> |
+</html> |