2010-05-27 09:12:32 -07:00
|
|
|
<!DOCTYPE HTML>
|
|
|
|
|
<html>
|
2014-02-18 06:47:53 -08:00
|
|
|
<!--
|
|
|
|
|
https://bugzilla.mozilla.org/show_bug.cgi?id=548193
|
|
|
|
|
-->
|
2010-05-27 09:12:32 -07:00
|
|
|
<head>
|
2014-02-18 06:47:53 -08:00
|
|
|
<title>Test for Bug 548193</title>
|
2010-05-27 09:12:32 -07:00
|
|
|
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
|
|
|
|
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
|
|
|
|
</head>
|
|
|
|
|
<body>
|
|
|
|
|
<p id="display"></p>
|
|
|
|
|
<div id="content" style="display: none">
|
|
|
|
|
</div>
|
|
|
|
|
|
|
|
|
|
<iframe style="width:200px;height:200px;" id='cspframe'></iframe>
|
|
|
|
|
<script class="testbody" type="text/javascript">
|
|
|
|
|
// This is used to watch requests go out so we can see if the report is
|
|
|
|
|
// sent correctly
|
|
|
|
|
function examiner() {
|
2013-03-18 12:43:21 -07:00
|
|
|
SpecialPowers.addObserver(this, "http-on-opening-request", false);
|
2010-05-27 09:12:32 -07:00
|
|
|
}
|
|
|
|
|
examiner.prototype = {
|
|
|
|
|
observe: function(subject, topic, data) {
|
|
|
|
|
// subject should be an nsURI
|
2013-03-18 12:43:21 -07:00
|
|
|
if (!SpecialPowers.can_QI(subject))
|
2010-05-27 09:12:32 -07:00
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
const reportURI = "http://mochi.test:8888/csp-report.cgi";
|
|
|
|
|
|
2013-03-18 12:43:21 -07:00
|
|
|
if (topic === "http-on-opening-request") {
|
|
|
|
|
var asciiSpec = SpecialPowers.getPrivilegedProps(SpecialPowers.do_QueryInterface(subject, "nsIHttpChannel"), "URI.asciiSpec");
|
|
|
|
|
if (asciiSpec !== reportURI) return;
|
2010-05-27 09:12:32 -07:00
|
|
|
|
|
|
|
|
// Verify that the report was properly formatted.
|
|
|
|
|
// We'll parse the report text as JSON and verify that the properties
|
|
|
|
|
// have expected values.
|
|
|
|
|
var reportText = "{}";
|
|
|
|
|
try {
|
2013-03-18 12:43:21 -07:00
|
|
|
var uploadStream = SpecialPowers.wrap(SpecialPowers.do_QueryInterface(subject, "nsIUploadChannel")).uploadStream;
|
2010-05-27 09:12:32 -07:00
|
|
|
|
|
|
|
|
if (uploadStream) {
|
|
|
|
|
// get the bytes from the request body
|
2013-03-18 12:43:21 -07:00
|
|
|
var binstream = SpecialPowers.Cc["@mozilla.org/binaryinputstream;1"]
|
|
|
|
|
.createInstance(SpecialPowers.Ci.nsIBinaryInputStream);
|
2010-05-27 09:12:32 -07:00
|
|
|
binstream.setInputStream(uploadStream);
|
|
|
|
|
|
|
|
|
|
var segments = [];
|
2013-03-18 12:43:21 -07:00
|
|
|
for (var count = uploadStream.available(); count; count = uploadStream.available()) {
|
|
|
|
|
var data = binstream.readBytes(count);
|
|
|
|
|
segments.push(data);
|
|
|
|
|
}
|
2010-05-27 09:12:32 -07:00
|
|
|
|
|
|
|
|
var reportText = segments.join("");
|
2013-03-18 12:43:21 -07:00
|
|
|
// rewind stream as we are supposed to - there will be an assertion later if we don't.
|
|
|
|
|
SpecialPowers.do_QueryInterface(uploadStream, "nsISeekableStream").seek(SpecialPowers.Ci.nsISeekableStream.NS_SEEK_SET, 0);
|
2010-05-27 09:12:32 -07:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
catch(e) {}
|
|
|
|
|
|
|
|
|
|
var reportObj = JSON.parse(reportText);
|
|
|
|
|
|
|
|
|
|
// test for the proper values in the report object
|
|
|
|
|
window.checkResults(reportObj);
|
|
|
|
|
|
|
|
|
|
// finish up
|
|
|
|
|
window.examiner.remove();
|
|
|
|
|
SimpleTest.finish();
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
|
|
|
|
|
// remove the listener
|
|
|
|
|
remove: function() {
|
2013-03-18 12:43:21 -07:00
|
|
|
SpecialPowers.removeObserver(this, "http-on-opening-request");
|
2010-05-27 09:12:32 -07:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// content file that triggers a violation report
|
2014-02-18 06:47:53 -08:00
|
|
|
var testFile = "file_csp_report.sjs";
|
2010-05-27 09:12:32 -07:00
|
|
|
|
|
|
|
|
window.checkResults = function(reportObj) {
|
|
|
|
|
var cspReport = reportObj["csp-report"];
|
|
|
|
|
// correct violating request
|
2012-07-10 00:44:05 -07:00
|
|
|
is(cspReport["document-uri"],
|
2014-02-18 06:47:53 -08:00
|
|
|
"http://mochi.test:8888/tests/content/base/test/csp/" + testFile,
|
2010-05-27 09:12:32 -07:00
|
|
|
"Incorrect violating request");
|
|
|
|
|
// correct blocked-uri
|
|
|
|
|
is(cspReport["blocked-uri"],
|
|
|
|
|
"http://example.org/tests/content/base/test/file_CSP.sjs?testid=img_bad&type=img/png",
|
|
|
|
|
"Incorrect blocked uri");
|
|
|
|
|
// correct violated-directive
|
2011-04-10 11:23:23 -07:00
|
|
|
is(cspReport["violated-directive"], "default-src http://mochi.test:8888",
|
2010-05-27 09:12:32 -07:00
|
|
|
"Incorrect violated directive");
|
|
|
|
|
// not practical to test request-headers as header names and values will
|
|
|
|
|
// change with the trunk
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
window.examiner = new examiner();
|
|
|
|
|
|
|
|
|
|
SimpleTest.waitForExplicitFinish();
|
|
|
|
|
|
|
|
|
|
// load the resource which will generate a CSP violation report
|
2014-06-09 14:26:09 -07:00
|
|
|
SpecialPowers.pushPrefEnv(
|
|
|
|
|
{'set':[["security.csp.speccompliant", true]]},
|
|
|
|
|
function() {
|
|
|
|
|
// save this for last so that our listeners are registered.
|
|
|
|
|
// ... this loads the testbed of good and bad requests.
|
|
|
|
|
document.getElementById("cspframe").src = testFile;
|
|
|
|
|
});
|
2010-05-27 09:12:32 -07:00
|
|
|
</script>
|
|
|
|
|
</pre>
|
|
|
|
|
</body>
|
|
|
|
|
</html>
|
