forked from mirrors/gecko-dev
0d460e3432
This is split from the previous changeset since if we include dom/ the file size is too large for phabricator to handle. This is an autogenerated commit to handle scripts loading mochitest harness files, in the simple case where the script src is on the same line as the tag. This was generated with https://bug1544322.bmoattachments.org/attachment.cgi?id=9058170 using the `--part 2` argument. Differential Revision: https://phabricator.services.mozilla.com/D27457 --HG-- extra : moz-landing-system : lando
240 lines
7.7 KiB
HTML
240 lines
7.7 KiB
HTML
<!DOCTYPE HTML>
|
|
<html>
|
|
<!--
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=671389
|
|
Bug 671389 - Implement CSP sandbox directive
|
|
-->
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<title>Tests for Bug 671389</title>
|
|
<script src="/tests/SimpleTest/SimpleTest.js"></script>
|
|
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css"/>
|
|
</head>
|
|
<script type="application/javascript">
|
|
|
|
SimpleTest.waitForExplicitFinish();
|
|
|
|
// Check if two sandbox flags are the same, ignoring case-sensitivity.
|
|
// getSandboxFlags returns a list of sandbox flags (if any) or
|
|
// null if the flag is not set.
|
|
// This function checks if two flags are the same, i.e., they're
|
|
// either not set or have the same flags.
|
|
function eqFlags(a, b) {
|
|
if (a === null && b === null) { return true; }
|
|
if (a === null || b === null) { return false; }
|
|
if (a.length !== b.length) { return false; }
|
|
var a_sorted = a.map(function(e) { return e.toLowerCase(); }).sort();
|
|
var b_sorted = b.map(function(e) { return e.toLowerCase(); }).sort();
|
|
for (var i in a_sorted) {
|
|
if (a_sorted[i] !== b_sorted[i]) {
|
|
return false;
|
|
}
|
|
}
|
|
return true;
|
|
}
|
|
|
|
// Get the sandbox flags of document doc.
|
|
// If the flag is not set sandboxFlagsAsString returns null,
|
|
// this function also returns null.
|
|
// If the flag is set it may have some flags; in this case
|
|
// this function returns the (potentially empty) list of flags.
|
|
function getSandboxFlags(doc) {
|
|
var flags = doc.sandboxFlagsAsString;
|
|
if (flags === null) { return null; }
|
|
return flags? flags.split(" "):[];
|
|
}
|
|
|
|
// Constructor for a CSP sandbox flags test. The constructor
|
|
// expectes a description 'desc' and set of options 'opts':
|
|
// - sandboxAttribute: [null] or string corresponding to the iframe sandbox attributes
|
|
// - csp: [null] or string corresponding to the CSP sandbox flags
|
|
// - cspReportOnly: [null] or string corresponding to the CSP report-only sandbox flags
|
|
// - file: [null] or string corresponding to file the server should serve
|
|
// Above, we use [brackets] to denote default values.
|
|
function CSPFlagsTest(desc, opts) {
|
|
function ifundef(x, v) {
|
|
return (x !== undefined) ? x : v;
|
|
}
|
|
|
|
function intersect(as, bs) { // Intersect two csp attributes:
|
|
as = as === null ? null
|
|
: as.split(' ').filter(function(x) { return !!x; });
|
|
bs = bs === null ? null
|
|
: bs.split(' ').filter(function(x) { return !!x; });
|
|
|
|
if (as === null) { return bs; }
|
|
if (bs === null) { return as; }
|
|
|
|
var cs = [];
|
|
as.forEach(function(a) {
|
|
if (a && bs.includes(a))
|
|
cs.push(a);
|
|
});
|
|
return cs;
|
|
}
|
|
|
|
this.desc = desc || "Untitled test";
|
|
this.attr = ifundef(opts.sandboxAttribute, null);
|
|
this.csp = ifundef(opts.csp, null);
|
|
this.cspRO = ifundef(opts.cspReportOnly, null);
|
|
this.file = ifundef(opts.file, null);
|
|
this.expected = intersect(this.attr, this.csp);
|
|
}
|
|
|
|
// Return function that checks that the actual flags are the same as the
|
|
// expected flags
|
|
CSPFlagsTest.prototype.checkFlags = function(iframe) {
|
|
var this_ = this;
|
|
return function() {
|
|
try {
|
|
var actual = getSandboxFlags(SpecialPowers.wrap(iframe).contentDocument);
|
|
ok(eqFlags(actual, this_.expected),
|
|
this_.desc + ' - expected: "' + this_.expected + '", got: "' + actual + '"');
|
|
} catch (e) {
|
|
ok(false,
|
|
this_.desc + ' - expected: "' + this_.expected + '", failed with: "' + e + '"');
|
|
}
|
|
runNextTest();
|
|
};
|
|
};
|
|
|
|
// Set the iframe src and sandbox attribute
|
|
CSPFlagsTest.prototype.runTest = function () {
|
|
var iframe = document.createElement('iframe');
|
|
document.getElementById("content").appendChild(iframe);
|
|
iframe.onload = this.checkFlags(iframe);
|
|
|
|
// set sandbox attribute
|
|
if (this.attr === null) {
|
|
iframe.removeAttribute('sandbox');
|
|
} else {
|
|
iframe.sandbox = this.attr;
|
|
}
|
|
|
|
// set query string
|
|
var src = 'http://mochi.test:8888/tests/dom/security/test/csp/file_testserver.sjs';
|
|
|
|
var delim = '?';
|
|
|
|
if (this.csp !== null) {
|
|
src += delim + 'csp=' + escape('sandbox ' + this.csp);
|
|
delim = '&';
|
|
}
|
|
|
|
if (this.cspRO !== null) {
|
|
src += delim + 'cspRO=' + escape('sandbox ' + this.cspRO);
|
|
delim = '&';
|
|
}
|
|
|
|
if (this.file !== null) {
|
|
src += delim + 'file=' + escape(this.file);
|
|
delim = '&';
|
|
}
|
|
|
|
iframe.src = src;
|
|
iframe.width = iframe.height = 10;
|
|
|
|
}
|
|
|
|
testCases = [
|
|
{
|
|
desc: "Test 1: Header should not override attribute",
|
|
sandboxAttribute: "",
|
|
csp: "allow-forms aLLOw-POinter-lock alLOW-popups aLLOW-SAME-ORIGin ALLOW-SCRIPTS allow-top-navigation"
|
|
},
|
|
{
|
|
desc: "Test 2: Attribute should not override header",
|
|
sandboxAttribute: "sandbox allow-forms allow-pointer-lock allow-popups allow-same-origin allow-scripts allow-top-navigation",
|
|
csp: ""
|
|
},
|
|
{
|
|
desc: "Test 3: Header and attribute intersect",
|
|
sandboxAttribute: "allow-same-origin allow-scripts",
|
|
csp: "allow-forms allow-same-origin allow-scripts"
|
|
},
|
|
{
|
|
desc: "Test 4: CSP sandbox sets the right flags (pt 1)",
|
|
csp: "alLOW-FORms ALLOW-pointer-lock allow-popups allow-same-origin allow-scripts ALLOW-TOP-NAVIGation"
|
|
},
|
|
{
|
|
desc: "Test 5: CSP sandbox sets the right flags (pt 2)",
|
|
csp: "allow-same-origin allow-TOP-navigation"
|
|
},
|
|
{
|
|
desc: "Test 6: CSP sandbox sets the right flags (pt 3)",
|
|
csp: "allow-FORMS ALLOW-scripts"
|
|
},
|
|
{
|
|
desc: "Test 7: CSP sandbox sets the right flags (pt 4)",
|
|
csp: ""
|
|
},
|
|
{
|
|
desc: "Test 8: CSP sandbox sets the right flags (pt 5)",
|
|
csp: null
|
|
},
|
|
{
|
|
desc: "Test 9: Read-only header should not override attribute",
|
|
sandboxAttribute: "",
|
|
cspReportOnly: "allow-forms ALLOW-pointer-lock allow-POPUPS allow-same-origin ALLOW-scripts allow-top-NAVIGATION"
|
|
},
|
|
{
|
|
desc: "Test 10: Read-only header should not override CSP header",
|
|
csp: "allow-forms allow-scripts",
|
|
cspReportOnly: "allow-forms aLlOw-PoInTeR-lOcK aLLow-pOPupS aLLoW-SaME-oRIgIN alLow-scripts allow-tOp-navigation"
|
|
},
|
|
{
|
|
desc: "Test 11: Read-only header should not override attribute or CSP header",
|
|
sandboxAttribute: "allow-same-origin allow-scripts",
|
|
csp: "allow-forms allow-same-origin allow-scripts",
|
|
cspReportOnly: "allow-forms allow-pointer-lock allow-popups allow-same-origin allow-scripts allow-top-navigation"
|
|
},
|
|
{
|
|
desc: "Test 12: CSP sandbox not affected by document.write()",
|
|
csp: "allow-scripts",
|
|
file: 'tests/dom/security/test/csp/file_iframe_sandbox_document_write.html'
|
|
},
|
|
].map(function(t) { return (new CSPFlagsTest(t.desc,t)); });
|
|
|
|
|
|
var testCaseIndex = 0;
|
|
|
|
// Track ok messages from iframes
|
|
var childMessages = 0;
|
|
var totalChildMessages = 1;
|
|
|
|
|
|
// Check to see if we ran all the tests and received all messges
|
|
// from child iframes. If so, finish.
|
|
function tryFinish() {
|
|
if (testCaseIndex === testCases.length && childMessages === totalChildMessages){
|
|
SimpleTest.finish();
|
|
}
|
|
}
|
|
|
|
function runNextTest() {
|
|
|
|
tryFinish();
|
|
|
|
if (testCaseIndex < testCases.length) {
|
|
testCases[testCaseIndex].runTest();
|
|
testCaseIndex++;
|
|
}
|
|
}
|
|
|
|
function receiveMessage(event) {
|
|
ok(event.data.ok, event.data.desc);
|
|
childMessages++;
|
|
tryFinish();
|
|
}
|
|
|
|
window.addEventListener("message", receiveMessage);
|
|
|
|
addLoadEvent(runNextTest);
|
|
</script>
|
|
<body>
|
|
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=671389">Mozilla Bug 671389</a> - Implement CSP sandbox directive
|
|
<p id="display"></p>
|
|
<div id="content">
|
|
</div>
|
|
</body>
|
|
</html>
|