LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-script-no-cors.html - Issue 954233003: Enable SRI only for same origin and CORS content.

Side by Side Diff

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Side by Side Diff: LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-script-no-cors.html

Issue 954233003: Enable SRI only for same origin and CORS content. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master

Patch Set: Rebase on ToT Created 5 years, 9 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-script-cors.html ('K') | « LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-script-cors-expected.txt ('k') | LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-script-no-cors-expected.txt » ('j') | LayoutTests/http/tests/security/subresourceIntegrity/subresource-integrity-style-no-cors.html » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
(Empty)
	1 <!DOCTYPE html>

	2 <head>

	3 </head>

	4 <body>

	5 <script src="/js-test-resources/js-test.js"></script>

	6 <script>

	7 var result = false;

	8 var scriptLoaded = function() {

	9 if (result)

	10 testFailed('Script ran.');

	11 else

	12 testPassed('Script did not run.');

	13 finishJSTest();

	14 };

	15

	16 window.jsTestIsAsync = true;

	17 description("The test passes if the script fails to run and there is als o a console error saying that the specified integrity attribute cannot be enforc ed because the resource is not CORS enabled.");

	18 </script>

	19 <script integrity="ni:///sha256;deadbeef" src="http://localhost:8000/securit y/resources/cors-script.php?credentials=true&cors=false&value=true" onload="scri ptLoaded();"></script>
	Mike West 2015/03/06 03:17:09 You're conflating a few things here: 1. You've d You're conflating a few things here: 1. You've dropped the `crossorigin` attribute. 2. You've broken the `integrity` attribute. 3. You've dropped the ACAO header. Any of these might be causing the failure. Would you mind splitting these out into separate tests so that we have a good idea of the expected behavior for each? jww 2015/03/06 08:24:21 Yup, I added a bunch of tests. This is probably as Show quoted text On 2015/03/06 03:17:09, Mike West wrote: > You're conflating a few things here: > > 1. You've dropped the `crossorigin` attribute. > 2. You've broken the `integrity` attribute. > 3. You've dropped the ACAO header. > > Any of these might be causing the failure. Would you mind splitting these out > into separate tests so that we have a good idea of the expected behavior for > each? Yup, I added a bunch of tests. This is probably as good a place as any to mention that these tests demonstrate a slight difference from the spec in our implementation. Namely, when an integrity causes a resource load failure, the load event still fires, rather than the error event. However, as discussed in https://github.com/w3c/webappsec/issues/149, this is still a bit up in the air, so I'm not going to change it (yet). I did file https://crbug.com/464648 to track this, however.
	20 </body>

	21 </html>

OLD	NEW