wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity

Bug 1069762 - CSP: blocked-uri in violation reports should not contain sensitive data - tests (r=sstamm)

Browse Source
This commit is contained in:
Christoph Kerschbaumer 2014-10-17 14:22:27 -07:00
parent c2b521b3e0
commit 6df7ec56cd
2 changed files with 120 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dom/security/test/csp/mochitest.ini
View File

@ -191,3 +191,5 @@ skip-if = buildapp == 'b2g' || buildapp == 'mulet' || toolkit == 'gonk' || toolk
skip-if = buildapp == 'b2g' || buildapp == 'mulet' || toolkit == 'gonk' || toolkit == 'android'
[test_upgrade_insecure_cors.html]
skip-if = buildapp == 'b2g' || buildapp == 'mulet' || toolkit == 'gonk' || toolkit == 'android'
[test_blocked_uri_in_reports.html]
skip-if = e10s || buildapp == 'b2g' # http-on-opening-request observer not supported in child process (bug 1009632)

118
dom/security/test/csp/test_blocked_uri_in_reports.html Normal file
View File

@ -0,0 +1,118 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Bug 1069762 - Check blocked-uri in csp-reports after redirect</title>
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:200px;height:200px;" id='cspframe'></iframe>
<script class="testbody" type="text/javascript">
SimpleTest.waitForExplicitFinish();
/* Description of the test:
* We try to load a script from:
* http://example.com/tests/dom/security/test/csp/file_path_matching_redirect_server.sjs
* which gets redirected to:
* http://test1.example.com/tests/dom/security//test/csp/file_path_matching.js
*
* The blocked-uri in the csp-report should be:
* test1.example.com
* instead of:
* http://test1.example.com/tests/com/security/test/csp/file_path_matching.js
*
* see also: http://www.w3.org/TR/CSP/#violation-reports
*
* Note, that we reuse the test-setup from
* test_path_matching_redirect.html
*/
const reportURI = "http://mochi.test:8888/foo.sjs";
const policy = "script-src http://example.com; report-uri " + reportURI;
const testfile = "tests/dom/security/test/csp/file_path_matching_redirect.html";
// This is used to watch requests go out so we can see if the report is
// sent correctly
function examiner() {
SpecialPowers.addObserver(this, "http-on-opening-request", false);
}
examiner.prototype = {
observe: function(subject, topic, data) {
// subject should be an nsURI
if (!SpecialPowers.can_QI(subject))
return;
if (topic === "http-on-opening-request") {
var asciiSpec = SpecialPowers.getPrivilegedProps(SpecialPowers.do_QueryInterface(subject, "nsIHttpChannel"), "URI.asciiSpec");
if (asciiSpec !== reportURI) return;
try {
// Verify that the report was properly formatted.
// We'll parse the report text as JSON and verify that the properties
// have expected values.
var reportText = "{}";
var uploadStream = SpecialPowers.wrap(SpecialPowers.do_QueryInterface(subject, "nsIUploadChannel")).uploadStream;
if (uploadStream) {
// get the bytes from the request body
var binstream = SpecialPowers.Cc["@mozilla.org/binaryinputstream;1"]
.createInstance(SpecialPowers.Ci.nsIBinaryInputStream);
binstream.setInputStream(uploadStream);
var segments = [];
for (var count = uploadStream.available(); count; count = uploadStream.available()) {
var data = binstream.readBytes(count);
segments.push(data);
}
var reportText = segments.join("");
// rewind stream as we are supposed to - there will be an assertion later if we don't.
SpecialPowers.do_QueryInterface(uploadStream, "nsISeekableStream").seek(SpecialPowers.Ci.nsISeekableStream.NS_SEEK_SET, 0);
}
try {
var reportObj = JSON.parse(reportText);
}
catch (e) {
ok(false, "Could not parse JSON (exception: " + e + ")");
}
var cspReport = reportObj["csp-report"];
// blocked-uri should only be the asciiHost instead of:
// http://test1.example.com/tests/dom/security/test/csp/file_path_matching.js
is(cspReport["blocked-uri"], "http://test1.example.com", "Incorrect blocked-uri");
}
catch (e) {
ok(false, "Could not query report (exception: " + e + ")");
}
// finish up
window.examiner.remove();
SimpleTest.finish();
}
},
// remove the listener
remove: function() {
SpecialPowers.removeObserver(this, "http-on-opening-request");
}
}
window.examiner = new examiner();
SimpleTest.waitForExplicitFinish();
function runTest() {
var src = "file_testserver.sjs";
// append the file that should be served
src += "?file=" + escape(testfile);
// append the CSP that should be used to serve the file
src += "&csp=" + escape(policy);
document.getElementById("cspframe").src = src;
}
runTest();
</script>
</body>
</html>