third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-sri_hash.html - Issue 2784753003: CSP: Enable whitelisting of external JavaScript via hashes

Side by Side Diff: third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-sri_hash.html

Issue 2784753003: CSP: Enable whitelisting of external JavaScript via hashes (Closed)

Patch Set: review Created 3 years, 8 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

« no previous file with comments | « third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/externalScript.js ('k') | third_party/WebKit/LayoutTests/external/wpt/content-security-policy/script-src/script-src-sri_hash.html.headers » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
(Empty)
	1 <!DOCTYPE HTML>

	2 <html>

	3

	4 <head>

	5 <title>External scripts with matching SRI hash should be allowed.</title>

	6 <script src='/resources/testharness.js' nonce='dummy'></script>

	7 <script src='/resources/testharnessreport.js' nonce='dummy'></script>

	8

	9 <!-- CSP served: script-src 'nonce-dummy' 'sha256-wIc3KtqOuTFEu6t17sIBuOswgk V406VJvhSk79Gw6U0=' 'sha256-L7/UQ9VWpyG7C9RDEC4ctS5hI3Zcw+ta+haPGlByG9c=' 'sha51 2-rYCVMxWV5nq8IsMo+UZNObWtEiWGok/vDN8BMoEQi41s0znSes6E1Q2aag3Lw3u2J1w2rqH7uF2ws6 FpQhfSOA=' -->

	10 </head>

	11

	12 <body>

	13 <h1>External scripts with matching SRI hash should be allowed.</h1>

	14 <div id='log'></div>

	15

	16 <script nonce='dummy'>

	17 // Test name, integrity, expected to run.

	18 var test_cases = [

	19 [ 'matching integrity',

	20 'sha256-L7/UQ9VWpyG7C9RDEC4ctS5hI3Zcw+ta+haPGlByG9c=',

	21 true ],

	22 [ 'multiple matching integrity',

	23 'sha256-L7/UQ9VWpyG7C9RDEC4ctS5hI3Zcw+ta+haPGlByG9c= sha512-rYCVMxWV 5nq8IsMo+UZNObWtEiWGok/vDN8BMoEQi41s0znSes6E1Q2aag3Lw3u2J1w2rqH7uF2ws6FpQhfSOA=' ,

	24 true ],

	25 [ 'no integrity', '', false ],

	26 [ 'matching plus unsupported integrity',

	27 'sha256-L7/UQ9VWpyG7C9RDEC4ctS5hI3Zcw+ta+haPGlByG9c= sha999-xyz',

	28 true ],

	29 [ 'mismatched integrity', 'sha256-xyz', false ],

	30 [ 'multiple mismatched intgerity', 'sha256-xyz sha256-zyx', false ],

	31 [ 'partially matching integrity',

	32 'sha256-L7/UQ9VWpyG7C9RDEC4ctS5hI3Zcw+ta+haPGlByG9c= sha256-xyz',

	33 false ],

	34 ];

	35

	36 test(_ => {

	37 for (item of test_cases) {

	38 async_test(t => {

	39 var s = document.createElement('script');

	40 s.id = item[0].replace(' ', '-');

	41 s.src = './simpleSourcedScript.js';

	42 s.integrity = item[1];

	43

	44 if (item[2]) {

	45 s.onerror = t.unreached_func("Script should load!");

	46 window.addEventListener('message', t.step_func(e => {

	47 if (e.data == s.id)

	48 t.done();

	49 }));

	50 } else {

	51 s.onerror = t.step_func_done();

	52 window.addEventListener('message', t.step_func(e => {

	53 if (e.data == s.id)

	54 assert_unreached("Script should not execute!");

	55 }));

	56 }

	57

	58 document.body.appendChild(s);

	59 }, item[0]);

	60 }

	61 }, "Load all the tests.");

	62 </script>

	63

	64 <script nonce='dummy'>
	Marc Treib 2017/04/06 12:26:30 This is the new attempt for the parser-inserted-sc This is the new attempt for the parser-inserted-script-tag test, with postMessage. I don't know how to properly detect failure here; if something's wrong, the test would just time out.
	65 async_test(t => {

	66 window.addEventListener('message', t.step_func(e => {

	67 if (e.data == 'external-script')

	68 t.done();

	69 }));

	70 }, 'v2: External script in a script tag with matching SRI hash should ru n.');

	71 </script>

	72 <script id='external-script' src='./simpleSourcedScript.js'

	73 integrity="sha256-L7/UQ9VWpyG7C9RDEC4ctS5hI3Zcw+ta+haPGlByG9c="></script >

	74

	75 <script nonce='dummy'>
	Marc Treib 2017/04/06 12:26:30 This is the previous version of the parser-inserte This is the previous version of the parser-inserted-script-tag test, with the global variable. But it's now the only test that uses that variable.
	76 var externalRan = false;

	77 </script>

	78 <script src='./externalScript.js'

	79 integrity="sha256-wIc3KtqOuTFEu6t17sIBuOswgkV406VJvhSk79Gw6U0="></script >

	80 <script nonce='dummy'>

	81 test(function() {

	82 assert_true(externalRan, 'External script ran.');

	83 }, 'v1: External script in a script tag with matching SRI hash should ru n.');

	84 </script>

	85

	86 </body>

	87

	88 </html>

OLD	NEW