| <!DOCTYPE html> |
| <title>CSP for subresource WebBundle (allowed cases)</title> |
| <link |
| rel="help" |
| href="https://github.com/WICG/webpackage/blob/master/explainers/subresource-loading.md" |
| /> |
| <meta |
| http-equiv="Content-Security-Policy" |
| content="script-src urn: 'self' 'unsafe-inline'; |
| img-src https://web-platform.test:8444/web-bundle/resources/wbn/pass.png; |
| frame-src urn:" |
| > |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| <body> |
| <link rel="webbundle" href="../resources/wbn/subresource.wbn" |
| resources="https://web-platform.test:8444/web-bundle/resources/wbn/pass.png" /> |
| <link rel="webbundle" href="../resources/wbn/urn-uuid.wbn" |
| resources="urn:uuid:020111b3-437a-4c5c-ae07-adb6bbffb720 |
| urn:uuid:429fcc4e-0696-4bad-b099-ee9175f023ae" /> |
| <script> |
| promise_test(() => { |
| return new Promise((resolve, reject) => { |
| const img = document.createElement('img'); |
| img.src = 'https://web-platform.test:8444/web-bundle/resources/wbn/pass.png'; |
| img.onload = resolve; |
| img.onerror = reject; |
| document.body.appendChild(img); |
| }); |
| }, 'URL matching of CSP should be done based on the subresource URL'); |
| |
| promise_test(async () => { |
| const result = await new Promise((resolve) => { |
| // This function will be called from the script. |
| window.report_result = resolve; |
| const script = document.createElement('script'); |
| script.src = 'urn:uuid:020111b3-437a-4c5c-ae07-adb6bbffb720'; |
| document.body.appendChild(script); |
| }); |
| assert_equals(result, 'OK'); |
| }, '"script-src urn:" CSP directive should allow urn: scripts'); |
| |
| promise_test(() => { |
| const frame_url = 'urn:uuid:429fcc4e-0696-4bad-b099-ee9175f023ae'; |
| const iframe = document.createElement('iframe'); |
| iframe.src = frame_url; |
| const load_promise = new Promise((resolve) => { |
| iframe.addEventListener('load', resolve); |
| }); |
| document.body.appendChild(iframe); |
| return load_promise; |
| }, '"frame-src urn:" CSP directive should allow urn:uuid iframes'); |
| </script> |
| </body> |
