LayoutTests/http/tests/security/contentSecurityPolicy/object-src-param-blocked.html - Issue 76303002: CSP: Check <param> element values against the document's CSP before loading.

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: LayoutTests/http/tests/security/contentSecurityPolicy/object-src-param-blocked.html

Issue 76303002: CSP: Check <param> element values against the document's CSP before loading. (Closed) Base URL: svn://svn.chromium.org/blink/trunk

Patch Set: Event. Created 7 years, 1 month ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch | Annotate | Revision Log

« no previous file with comments | « no previous file | LayoutTests/http/tests/security/contentSecurityPolicy/object-src-param-blocked-expected.txt » ('j') | LayoutTests/http/tests/security/contentSecurityPolicy/object-src-param-blocked-expected.txt » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
(Empty)
	1 <!DOCTYPE html>

	2 <html>

	3 <head>

	4 <script>

	5 if (window.testRunner) {

	6 testRunner.dumpAsText();

	7 testRunner.waitUntilDone();

	8 }

	9 </script>

	10 <meta http-equiv="Content-Security-Policy" content="object-src http://localhost: 8080">

	11 </head>

	12 <body>

	13 This test passes if there is are four console messages saying the plugins were b locked.

	14 <script>

	15 var names = ['src', 'movie', 'code', 'url'];
	Tom Sepez 2013/11/19 17:54:22 nit: maybe a link to the section of the spec that nit: maybe a link to the section of the spec that calls out these 4 names. Mike West 2013/11/19 18:35:06 This is non-standard behavior, based (I think) on Show quoted text On 2013/11/19 17:54:22, Tom Sepez wrote: > nit: maybe a link to the section of the spec that calls out these 4 names. This is non-standard behavior, based (I think) on something IE did/does. There's a comment (like, literally an HTML comment) in the spec that notes "we may have to define magic fallback to <param> if it turns out to be needed in testing", and quotes Hyatt from IRC.
	16

	17 var errorsSeen = 0;

	18 for (var i = 0; i < names.length; i++) {

	19 var o = document.createElement('object');

	20 o.setAttribute('type', 'application/x-webkit-test-netscape');

	21 o.addEventListener('error', function () {

	22 console.log('PASS: Error occurred, so load was correctly blocked.');

	23 errorsSeen++;

	24 if (errorsSeen === names.length && window.testRunner)

	25 testRunner.notifyDone();

	26 });

	27
	Tom Sepez 2013/11/19 17:54:22 Can we also use an onload handler to keep track of Can we also use an onload handler to keep track of failures? If we break this down the road, having a text diff vs a timeout when the expected number of handlers don't fire ... Mike West 2013/11/19 18:35:06 Sure. It's probably worth rewriting all the object Show quoted text On 2013/11/19 17:54:22, Tom Sepez wrote: > Can we also use an onload handler to keep track of failures? If we break this > down the road, having a text diff vs a timeout when the expected number of > handlers don't fire ... Sure. It's probably worth rewriting all the object-src tests in that pattern. Of course, it would require implementing the 'load' event, which I don't think exists at the moment either. I'd like to defer that to the next CL if at all possible. :)
	28 var p = document.createElement('param');

	29 p.setAttribute('value', 'http://127.0.0.1:8080/plugins/resources/mock-pl ugin.pl?' + names[i]);

	30 p.setAttribute('name', names[i]);

	31

	32 o.appendChild(p);

	33

	34 document.body.appendChild(o);

	35 }

	36 </script>

	37 </body>

	38 </html>

OLD	NEW