| <!DOCTYPE html> |
| <head> |
| <script nonce="123" src="/resources/testharness.js"></script> |
| <script nonce="123" src="/resources/testharnessreport.js"></script> |
| </head> |
| <body> |
| <script nonce="123"> |
| // CSP insists the "trusted-types: ..." directives are deliverd as headers |
| // (rather than as "<meta http-equiv" tags). This test assumes the following |
| // headers are set in the .headers file: |
| // |
| // Content-Security-Policy: trusted-types * |
| // Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval'; report-uri ... |
| // Content-Security-Policy: plugin-types bla/blubb |
| // |
| // The last rule is there so we can provoke a CSP violation report at will. |
| // The intent is that in order to test that a violation has *not* been thrown |
| // (and without resorting to abominations like timeouts), we force a *another* |
| // CSP violation (by violating the img-src rule) and when that event is |
| // processed we can we sure that an earlier event - if it indeed occurred - |
| // must have already been processed. |
| |
| // Return function that returns a promise that resolves on the given |
| // violation report. |
| function promise_violation(filter_arg) { |
| return _ => new Promise((resolve, reject) => { |
| function handler(e) { |
| let matches = e.originalPolicy.includes(filter_arg); |
| if (matches) { |
| document.removeEventListener("securitypolicyviolation", handler); |
| e.stopPropagation(); |
| resolve(e); |
| } |
| } |
| document.addEventListener("securitypolicyviolation", handler); |
| }); |
| } |
| |
| // Like assert_throws, but we don't care about the exact error. We just want |
| // to run the code and continue. |
| function expect_throws(fn) { |
| try { fn(); assert_unreached(); } catch (err) { /* ignore */ } |
| } |
| |
| // A sample policy we use to test trustedTypes.createPolicy behaviour. |
| const id = x => x; |
| const a_policy = { |
| createHTML: id, |
| createScriptURL: id, |
| createURL: id, |
| createScript: id, |
| }; |
| const scriptyPolicy = trustedTypes.createPolicy('allowEval', a_policy); |
| |
| // Provoke/wait for a CSP violation, in order to be sure that all previous |
| // CSP violations have been delivered. |
| function promise_flush() { |
| return promise_violation("plugin-types bla/blubb"); |
| } |
| function flush() { |
| expect_throws(_ => { |
| var o = document.createElement('object'); |
| o.type = "application/x-shockwave-flash"; |
| document.body.appendChild(o); |
| }); |
| } |
| |
| promise_test(t => { |
| let beacon = 'never_overwritten'; |
| let p = Promise.resolve() |
| .then(promise_violation("trusted-types *")) |
| .then(promise_flush()); |
| assert_throws(new EvalError(), |
| _ => eval('beacon="should not run"')); |
| assert_equals(beacon, 'never_overwritten'); |
| flush(); |
| return p; |
| }, "Trusted Type violation report: evaluating a string."); |
| |
| promise_test(t => { |
| let beacon = 'never_overwritten2'; |
| let p = promise_flush()(); |
| eval(scriptyPolicy.createScript('beacon="i ran"')); |
| assert_equals(beacon, 'i ran'); |
| flush(); |
| return p; |
| }, "Trusted Type violation report: evaluating a Trusted Script."); |
| |
| promise_test(t => { |
| let beacon = 'never_overwritten'; |
| trustedTypes.createPolicy('default', { |
| createScript: s => s.replace('payload', 'default policy'), |
| }, true); |
| let p = promise_flush()(); |
| eval('beacon="payload"'); |
| assert_equals(beacon, 'default policy'); |
| flush(); |
| return p; |
| }, "Trusted Type violation report: default policy transforms the script before CSP checks runs."); |
| |
| </script> |
| </body> |
