| Index: third_party/WebKit/LayoutTests/external/wpt/content-security-policy/_unapproved/script-nonces-hidden.html
|
| diff --git a/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/_unapproved/script-nonces-hidden.html b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/_unapproved/script-nonces-hidden.html
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..41636331bbf82bbc7815dcae9e444ceb80af1a6b
|
| --- /dev/null
|
| +++ b/third_party/WebKit/LayoutTests/external/wpt/content-security-policy/_unapproved/script-nonces-hidden.html
|
| @@ -0,0 +1,114 @@
|
| +<!DOCTYPE html>
|
| +<script src="/resources/testharness.js" nonce="abc"></script>
|
| +<script src="/resources/testharnessreport.js" nonce="abc"></script>
|
| +
|
| +<!-- `Content-Security-Policy: script-src 'nonce-abc'; img-src 'none'` delivered via headers -->
|
| +
|
| +<body>
|
| +<!-- Basics -->
|
| +<script nonce="abc" id="testScript">
|
| + document.currentScript.setAttribute('executed', 'yay');
|
| +</script>
|
| +
|
| +<script nonce="abc">
|
| + var script = document.querySelector('#testScript');
|
| +
|
| + test(t => {
|
| + // Query Selector
|
| + assert_equals(document.querySelector('body [nonce]'), script);
|
| + assert_equals(document.querySelector('body [nonce=""]'), script);
|
| + assert_equals(document.querySelector('body [nonce=abc]'), null);
|
| +
|
| + assert_equals(script.getAttribute('nonce'), '');
|
| + assert_equals(script.nonce, 'abc');
|
| + }, "Reading 'nonce' content attribute and IDL attribute.");
|
| +
|
| + // Clone node.
|
| + test(t => {
|
| + script.setAttribute('executed', 'boo');
|
| + var s2 = script.cloneNode();
|
| + assert_equals(s2.nonce, 'abc', 'IDL attribute');
|
| + assert_equals(s2.getAttribute('nonce'), '');
|
| + }, "Cloned node retains nonce.");
|
| +
|
| + async_test(t => {
|
| + var s2 = script.cloneNode();
|
| + document.head.appendChild(s2);
|
| + window.addEventListener('load', t.step_func_done(_ => {
|
| + assert_equals(s2.nonce, 'abc');
|
| + assert_equals(s2.getAttribute('nonce'), '');
|
| +
|
| + // The cloned script won't execute, as its 'already started' flag is set.
|
| + assert_equals(s2.getAttribute('executed'), 'boo');
|
| + }));
|
| + }, "Cloned node retains nonce when inserted.");
|
| +
|
| + // Set the content attribute to 'foo'
|
| + test(t => {
|
| + script.setAttribute('nonce', 'foo');
|
| + assert_equals(script.getAttribute('nonce'), 'foo');
|
| + assert_equals(script.nonce, 'abc');
|
| + }, "Writing 'nonce' content attribute.");
|
| +
|
| + // Set the IDL attribute to 'bar'
|
| + test(t => {
|
| + script.nonce = 'bar';
|
| + assert_equals(script.nonce, 'bar');
|
| + assert_equals(script.getAttribute('nonce'), 'foo');
|
| + }, "Writing 'nonce' IDL attribute.");
|
| +
|
| + // Fragment parser.
|
| + var documentWriteTest = async_test("Document-written script executes.");
|
| + document.write(`<script nonce='abc'>
|
| + documentWriteTest.done();
|
| + test(t => {
|
| + var script = document.currentScript;
|
| + assert_equals(script.getAttribute('nonce'), '');
|
| + assert_equals(script.nonce, 'abc');
|
| + }, "Document-written script's nonce value.");
|
| + </scr` + `ipt>`);
|
| +
|
| + // Create node.
|
| + async_test(t => {
|
| + var s = document.createElement('script');
|
| + s.innerText = script.innerText;
|
| + s.nonce = 'abc';
|
| + document.head.appendChild(s);
|
| +
|
| + window.addEventListener('load', t.step_func_done(_ => {
|
| + assert_equals(s.nonce, 'abc');
|
| + assert_equals(s.getAttribute('nonce'), null);
|
| + }));
|
| + }, "createElement.nonce.");
|
| +
|
| + // Create node.
|
| + async_test(t => {
|
| + var s = document.createElement('script');
|
| + s.innerText = script.innerText;
|
| + s.setAttribute('nonce', 'abc');
|
| + assert_equals(s.getAttribute('nonce'), 'abc', "Pre-insertion content");
|
| + assert_equals(s.nonce, '', "Pre-insertion IDL");
|
| + document.head.appendChild(s);
|
| +
|
| + window.addEventListener('load', t.step_func_done(_ => {
|
| + assert_equals(s.nonce, 'abc', "Post-insertion IDL");
|
| + assert_equals(s.getAttribute('nonce'), '', "Post-insertion content");
|
| + }));
|
| + }, "createElement.setAttribute.");
|
| +</script>
|
| +
|
| +<!-- CSS Leakage -->
|
| +<style>
|
| + #cssTest { display: block; }
|
| + #cssTest[nonce=abc] { background: url(/security/resources/abe.png); }
|
| +</style>
|
| +<script nonce="abc" id="cssTest">
|
| + async_test(t => {
|
| + requestAnimationFrame(t.step_func_done(_ => {
|
| + var script = document.querySelector('#cssTest');
|
| + var style = getComputedStyle(script);
|
| + assert_equals(style['display'], 'block');
|
| + assert_equals(style['background-image'], 'none');
|
| + }));
|
| + }, "Nonces don't leak via CSS side-channels.");
|
| +</script>
|
|
|
Chromium Code Reviews
Issue 2801243002:
More tweaks to <script nonce> hiding. (Closed)
