| OLD | NEW |
|---|
| (Empty) | |
| 1 <!DOCTYPE html> |
| 2 <html> |
| 3 <head> |
| 4 <meta http-equiv="Content-Security-Policy" content="default-src https:; script-s
rc 'unsafe-inline'"> |
| 5 <script> |
| 6 if (window.testRunner) { |
| 7 testRunner.waitUntilDone(); |
| 8 testRunner.dumpAsText(); |
| 9 } |
| 10 |
| 11 var testIndex = 1; |
| 12 var testCount = 12; |
| 13 function produceOutput(promise) { |
| 14 var suffix = ' (' + testIndex++ + '/' + testCount + ')'; |
| 15 return promise.then(function() { console.log('PASS' + suffix); }, |
| 16 function() { console.log('FAIL' + suffix); }); |
| 17 } |
| 18 |
| 19 |
| 20 function expectImageLoad(shouldLoad) { |
| 21 return produceOutput(new Promise(function(resolve, reject) { |
| 22 var img = document.createElement('img'); |
| 23 var pass = function() { resolve(); }; |
| 24 var fail = function() { reject(new Error()); }; |
| 25 img.onload = shouldLoad ? pass : fail; |
| 26 img.onerror = shouldLoad ? fail : pass; |
| 27 img.src = '../resources/abe.png'; |
| 28 })); |
| 29 } |
| 30 |
| 31 function expectStyleLoad(shouldLoad) { |
| 32 // onerror doesn't seem to work on <link>. |
| 33 // Fortunately, srcdoc iframes are bound by containing CSP. |
| 34 return produceOutput(new Promise(function(resolve, reject) { |
| 35 var iframe = document.createElement('iframe'); |
| 36 iframe.onload = function() { |
| 37 var didLoad = iframe.contentDocument.styleSheets.length > 0; |
| 38 (shouldLoad == didLoad) ? resolve() : reject(new Error()); |
| 39 iframe.remove(); |
| 40 }; |
| 41 iframe.srcdoc = '<link rel="stylesheet" href="../resources/cssStyle.
css">'; |
| 42 document.body.appendChild(iframe); |
| 43 })); |
| 44 } |
| 45 |
| 46 window.onload = function() { |
| 47 Promise.resolve() |
| 48 .then(function() { |
| 49 return expectImageLoad(false).then(function() { return expectSty
leLoad(false); }); |
| 50 }) |
| 51 .then(function() { |
| 52 internals.registerURLSchemeAsBypassingContentSecurityPolicy('htt
p'); |
| 53 return expectImageLoad(true).then(function() { return expectStyl
eLoad(true); }); |
| 54 }) |
| 55 .then(function() { |
| 56 internals.removeURLSchemeRegisteredAsBypassingContentSecurityPol
icy('http'); |
| 57 internals.registerURLSchemeAsBypassingContentSecurityPolicy('htt
p', []); |
| 58 return expectImageLoad(false).then(function() { return expectSty
leLoad(false); }); |
| 59 }) |
| 60 .then(function() { |
| 61 internals.removeURLSchemeRegisteredAsBypassingContentSecurityPol
icy('http'); |
| 62 internals.registerURLSchemeAsBypassingContentSecurityPolicy('htt
p', ['img']); |
| 63 return expectImageLoad(true).then(function() { return expectStyl
eLoad(false); }); |
| 64 }) |
| 65 .then(function() { |
| 66 internals.removeURLSchemeRegisteredAsBypassingContentSecurityPol
icy('http'); |
| 67 internals.registerURLSchemeAsBypassingContentSecurityPolicy('htt
p', ['style']); |
| 68 return expectImageLoad(false).then(function() { return expectSty
leLoad(true); }); |
| 69 }) |
| 70 .then(function() { |
| 71 internals.removeURLSchemeRegisteredAsBypassingContentSecurityPol
icy('http'); |
| 72 return expectImageLoad(false).then(function() { return expectSty
leLoad(false); }); |
| 73 }) |
| 74 .then(function() { if (window.testRunner) testRunner.notifyDone(); }
); |
| 75 }; |
| 76 </script> |
| 77 </head> |
| 78 <body> |
| 79 <p> |
| 80 This test ensures that registering a scheme as bypassing CSP actually by
passes CSP. |
| 81 This test passes if only PASSes are generated. |
| 82 </p> |
| 83 </body> |
| 84 </html> |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 730203007:
CSP: Permit exempting schemes only for certain policy areas. (Closed)
Base URL: svn://svn.chromium.org/blink/trunk