| <!DOCTYPE html> |
| <title>Test transparent url navigated in fenced frame interacting with CSP</title> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| <script src="/common/utils.js"></script> |
| <script src="/common/dispatcher/dispatcher.js"></script> |
| <script src="resources/utils.js"></script> |
| |
| <body> |
| <script> |
| function setupCSP(csp) { |
| let meta = document.createElement('meta'); |
| meta.httpEquiv = "Content-Security-Policy"; |
| meta.content = "fenced-frame-src " + csp; |
| document.head.appendChild(meta); |
| } |
| |
| const allowedCSPs = ["*", "https:", "'self'"]; |
| allowedCSPs.forEach((csp) => { |
| promise_test(async(t) => { |
| setupCSP(csp); |
| |
| t.step_timeout(t.unreached_func( |
| "The fenced frame should load for CSP fenced-frame-src " + csp), 3000); |
| |
| const fencedframe = attachFencedFrameContext(); |
| await fencedframe.execute(() => {}); |
| }, "Fenced frame loaded for CSP fenced-frame-src " + csp); |
| }); |
| |
| const blockedCSPs = ["'none'"]; |
| blockedCSPs.forEach((csp) => { |
| promise_test(async(t) => { |
| setupCSP(csp); |
| |
| const csp_violation = new Promise(resolve => { |
| window.addEventListener("securitypolicyviolation", resolve); |
| }); |
| |
| const fencedframe = attachFencedFrameContext(); |
| |
| const fencedframe_loaded = fencedframe.execute(() => {}); |
| fencedframe_loaded.then(t.unreached_func( |
| "The fenced frame should not load for CSP fenced-frame-src " + csp)); |
| |
| const csp_violation_event = await csp_violation; |
| const remote_url = getRemoteContextURL(location.origin).toString(); |
| assert_true(csp_violation_event.blockedURI.includes(remote_url), |
| "blockedURI should include the url"); |
| }, "Fenced frame blocked for CSP fenced-frame-src " + csp); |
| }); |
| </script> |
| </body> |
