Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(47)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: third_party/WebKit/LayoutTests/external/wpt/fetch/dangling-markup-mitigation.tentative.html

Issue 2895953002: Update dangling markup mitigations. (Closed)
Patch Set: Test. Created 3 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « third_party/WebKit/LayoutTests/editing/pasteboard/dragstart-contains-default-content-expected.txt ('k') | third_party/WebKit/LayoutTests/fast/canvas/canvas-composite-canvas-expected.txt » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
(Empty)
1 <!DOCTYPE html>
Mike West 2017/05/24 07:10:48 This is the actual test. The rest of the test file
2 <script src="/resources/testharness.js"></script>
3 <script src="/resources/testharnessreport.js"></script>
4 <script src="./resources/helper.js"></script>
5 <body>
6 <script>
7 function readableURL(url) {
8 return url.replace(/\n/g, "\\n").replace(/\r/g, "\\r").replace(/\t/g, "\\t") ;
9 }
10
11 var should_load = [
12 `/images/green-1x1.png`,
13 `/images/gre\nen-1x1.png`,
14 `/images/gre\ten-1x1.png`,
15 `/images/gre\ren-1x1.png`,
16 `/images/green-1x1.png?img=<`,
17 `/images/green-1x1.png?img=&lt;`,
18 `/images/green-1x1.png?img=%3C`,
19 `/images/gr\neen-1x1.png?img=%3C`,
20 `/images/gr\reen-1x1.png?img=%3C`,
21 `/images/gr\teen-1x1.png?img=%3C`,
22 `/images/green-1x1.png?img=&#10;`,
23 `/images/gr\neen-1x1.png?img=&#10;`,
24 `/images/gr\reen-1x1.png?img=&#10;`,
25 `/images/gr\teen-1x1.png?img=&#10;`,
26 ];
27 should_load.forEach(url => async_test(t => {
28 fetch(url)
29 .then(t.step_func_done(r => {
30 assert_equals(r.status, 200);
31 }))
32 .catch(t.unreached_func("Fetch should succeed."));
33 }, "Fetch: " + readableURL(url)));
34
35 var should_block = [
36 `/images/gre\nen-1x1.png?img=<`,
37 `/images/gre\ren-1x1.png?img=<`,
38 `/images/gre\ten-1x1.png?img=<`,
39 `/images/green-1x1.png?<\n=block`,
40 `/images/green-1x1.png?<\r=block`,
41 `/images/green-1x1.png?<\t=block`,
42 ];
43 should_block.forEach(url => async_test(t => {
44 fetch(url)
45 .then(t.unreached_func("Fetch should fail."))
46 .catch(t.step_func_done());
47 }, "Fetch: " + readableURL(url)));
48
49
50 // For each of the following tests, we'll inject a frame containing the HTML w e'd like to poke at
51 // as a `srcdoc` attribute. Because we're injecting markup via `srcdoc`, we ne ed to entity-escape
52 // the content we'd like to treat as "raw" (e.g. `\n` => `&#10;`, `<` => `&lt; `), and
53 // double-escape the "escaped" content.
54 var rawBrace = "&lt;";
55 var escapedBrace = "&amp;lt;";
56 var rawNewline = "&#10;";
57 var escapedNewline = "&amp;#10;";
58
59 function appendFrameAndGetElement(test, frame) {
60 return new Promise((resolve, reject) => {
61 frame.onload = test.step_func(_ => {
62 frame.onload = null;
63 resolve(frame.contentDocument.querySelector('#dangling'));
64 });
65 document.body.appendChild(frame);
66 });
67 }
68
69 function assert_img_loaded(test, frame) {
70 appendFrameAndGetElement(test, frame)
71 .then(test.step_func_done(img => {
72 assert_equals(img.naturalHeight, 1, "Height");
73 frame.remove();
74 }));
75 }
76
77 function assert_img_not_loaded(test, frame) {
78 appendFrameAndGetElement(test, frame)
79 .then(test.step_func_done(img => {
80 assert_equals(img.naturalHeight, 0, "Height");
81 assert_equals(img.naturalWidth, 0, "Width");
82 }));
83 }
84
85 function createFrame(markup) {
86 var i = document.createElement('iframe');
87 i.srcdoc = `${markup}sekrit`;
88 return i;
89 }
90
91 // The following resources should not be blocked, as their URLs do not contain both a `\n` and `<`
92 // character in the body of the URL.
93 var should_load = [
94 // Brace alone doesn't block:
95 `<img id="dangling" src="/images/green-1x1.png?img=${rawBrace}b">`,
96
97 // Newline alone doesn't block:
98 `<img id="dangling" src="/images/green-1x1.png?img=${rawNewline}b">`,
99
100 // Entity-escaped characters don't trigger blocking:
101 `<img id="dangling" src="/images/green-1x1.png?img=${escapedNewline}b">`,
102 `<img id="dangling" src="/images/green-1x1.png?img=${escapedBrace}b">`,
103 `<img id="dangling" src="/images/green-1x1.png?img=${escapedNewline}b${escap edBrace}c">`,
104
105 // Leading and trailing whitespace is stripped:
106 `
107 <img id="dangling" src="
108 /images/green-1x1.png?img=
109 ">
110 `,
111 `
112 <img id="dangling" src="
113 /images/green-1x1.png?img=${escapedBrace}
114 ">
115 `,
116 `
117 <img id="dangling" src="
118 /images/green-1x1.png?img=${escapedNewline}
119 ">
120 `,
121
122 // Data URLs don't trigger blocking:
123 `<img id="dangling" src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAA AABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=">`,
124 `<img id="dangling" src="data:image/png;base64,${rawNewline}iVBORw0KGgoAAAAN SUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=">`,
125 `<img id="dangling" src="data:image/png;base64,i${rawNewline}VBORw0KGgoAAAAN SUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=">`,
126 `<img id="dangling" src="data:image/svg+xml;utf8,
127 <svg width='1' height='1' xmlns='http://www.w3.org/2000/svg'>
128 <rect width='100%' height='100%' fill='rebeccapurple'/>
129 <rect x='10%' y='10%' width='80%' height='80%' fill='lightgreen'/>
130 </svg>">`
131 ];
132
133 should_load.forEach(markup => {
134 async_test(t => {
135 var i = createFrame(`${markup} <element attr="" another=''>`);
136 assert_img_loaded(t, i);
137 }, readableURL(markup));
138 });
139
140 // The following resources should be blocked, as their URLs contain both `\n` and `<` characters:
141 var should_block = [
142 `<img id="dangling" src="/images/green-1x1.png?img=${rawNewline}${rawBrace}b ">`,
143 `<img id="dangling" src="/images/green-1x1.png?img=${rawBrace}${rawNewline}b ">`,
144 `
145 <img id="dangling" src="/images/green-1x1.png?img=
146 ${rawBrace}
147 ${rawNewline}b
148 ">
149 `,
150 ];
151
152 should_block.forEach(markup => {
153 async_test(t => {
154 var i = createFrame(`${markup}`);
155 assert_img_not_loaded(t, i);
156 }, readableURL(markup));
157 });
158 </script>
OLDNEW
« no previous file with comments | « third_party/WebKit/LayoutTests/editing/pasteboard/dragstart-contains-default-content-expected.txt ('k') | third_party/WebKit/LayoutTests/fast/canvas/canvas-composite-canvas-expected.txt » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698