CSP: 'importScripts()' should be allowed under 'strict-dynamic'
'importScripts()' is not a parser-inserted script-loading mechanism; it
ought to continue loading script in the presence of 'strict-dynamic'.
Bug: 742354
Change-Id: Ice327c6f69183e1b27912c808646d16d0030b934
Reviewed-on: https://chromium-review.googlesource.com/571723
Commit-Queue: Mike West <mkwst@chromium.org>
Cr-Commit-Position: refs/heads/master@{#486718}
WPT-Export-Revision: 0923c5782ecf046eb20df3e058b68d39a21313d7
diff --git a/content-security-policy/script-src/script-src-strict_dynamic_worker-importScripts.https.html b/content-security-policy/script-src/script-src-strict_dynamic_worker-importScripts.https.html
new file mode 100644
index 0000000..681e195
--- /dev/null
+++ b/content-security-policy/script-src/script-src-strict_dynamic_worker-importScripts.https.html
@@ -0,0 +1,18 @@
+<!DOCTYPE html>
+<script src='/resources/testharness.js'></script>
+<script src='/resources/testharnessreport.js'></script>
+<script src='../support/testharness-helper.js'></script>
+
+<meta http-equiv="content-security-policy" content="script-src 'nonce-abc' 'strict-dynamic'">
+
+<script nonce="abc">
+ async_test(t => {
+ assert_no_csp_event_for_url(t, "../support/import-scripts.js");
+ var w = new Worker("../support/import-scripts.js");
+ assert_no_event(t, w, "error");
+ waitUntilEvent(w, "message")
+ .then(t.step_func_done(e => {
+ assert_true(e.data.executed);
+ }));
+ }, "`importScripts(...)` is allowed by 'strict-dynamic'");
+</script>
diff --git a/content-security-policy/support/import-scripts.js b/content-security-policy/support/import-scripts.js
new file mode 100644
index 0000000..8325ebb
--- /dev/null
+++ b/content-security-policy/support/import-scripts.js
@@ -0,0 +1,3 @@
+self.a = false;
+importScripts('/content-security-policy/support/var-a.js');
+postMessage({ 'executed': self.a });
