wine/gecko
0
0
Fork 0
mirror of https://gitlab.winehq.org/wine/wine-gecko.git synced 2024-09-13 09:24:08 -07:00
Code Issues Packages Projects Releases Wiki Activity
921c072a1a
gecko/content/base/test/csp/test_csp_bug773891.html
Ms2ger f8962d36e5 Bug 903080 - Move CSP tests in content/base/test into a subdir; r=ddahl+mshal 
--HG--
rename : content/base/test/file_CSP.css => content/base/test/csp/file_CSP.css
rename : content/base/test/file_CSP.sjs => content/base/test/csp/file_CSP.sjs
rename : content/base/test/file_CSP_bug663567.xsl => content/base/test/csp/file_CSP_bug663567.xsl
rename : content/base/test/file_CSP_bug663567_allows.xml => content/base/test/csp/file_CSP_bug663567_allows.xml
rename : content/base/test/file_CSP_bug663567_allows.xml^headers^ => content/base/test/csp/file_CSP_bug663567_allows.xml^headers^
rename : content/base/test/file_CSP_bug663567_blocks.xml => content/base/test/csp/file_CSP_bug663567_blocks.xml
rename : content/base/test/file_CSP_bug663567_blocks.xml^headers^ => content/base/test/csp/file_CSP_bug663567_blocks.xml^headers^
rename : content/base/test/file_CSP_bug802872.html => content/base/test/csp/file_CSP_bug802872.html
rename : content/base/test/file_CSP_bug802872.html^headers^ => content/base/test/csp/file_CSP_bug802872.html^headers^
rename : content/base/test/file_CSP_bug802872.js => content/base/test/csp/file_CSP_bug802872.js
rename : content/base/test/file_CSP_bug802872.sjs => content/base/test/csp/file_CSP_bug802872.sjs
rename : content/base/test/file_CSP_bug885433_allows.html => content/base/test/csp/file_CSP_bug885433_allows.html
rename : content/base/test/file_CSP_bug885433_allows.html^headers^ => content/base/test/csp/file_CSP_bug885433_allows.html^headers^
rename : content/base/test/file_CSP_bug885433_blocks.html => content/base/test/csp/file_CSP_bug885433_blocks.html
rename : content/base/test/file_CSP_bug885433_blocks.html^headers^ => content/base/test/csp/file_CSP_bug885433_blocks.html^headers^
rename : content/base/test/file_CSP_bug888172.html => content/base/test/csp/file_CSP_bug888172.html
rename : content/base/test/file_CSP_bug888172.sjs => content/base/test/csp/file_CSP_bug888172.sjs
rename : content/base/test/file_CSP_evalscript_main.html => content/base/test/csp/file_CSP_evalscript_main.html
rename : content/base/test/file_CSP_evalscript_main.html^headers^ => content/base/test/csp/file_CSP_evalscript_main.html^headers^
rename : content/base/test/file_CSP_evalscript_main.js => content/base/test/csp/file_CSP_evalscript_main.js
rename : content/base/test/file_CSP_evalscript_main_allowed.js => content/base/test/csp/file_CSP_evalscript_main_allowed.js
rename : content/base/test/file_CSP_evalscript_main_allowed_getCRMFRequest.js => content/base/test/csp/file_CSP_evalscript_main_allowed_getCRMFRequest.js
rename : content/base/test/file_CSP_evalscript_main_getCRMFRequest.html => content/base/test/csp/file_CSP_evalscript_main_getCRMFRequest.html
rename : content/base/test/file_CSP_evalscript_main_getCRMFRequest.html^headers^ => content/base/test/csp/file_CSP_evalscript_main_getCRMFRequest.html^headers^
rename : content/base/test/file_CSP_evalscript_main_getCRMFRequest.js => content/base/test/csp/file_CSP_evalscript_main_getCRMFRequest.js
rename : content/base/test/file_CSP_evalscript_main_spec_compliant.html => content/base/test/csp/file_CSP_evalscript_main_spec_compliant.html
rename : content/base/test/file_CSP_evalscript_main_spec_compliant.html^headers^ => content/base/test/csp/file_CSP_evalscript_main_spec_compliant.html^headers^
rename : content/base/test/file_CSP_evalscript_main_spec_compliant_allowed.html => content/base/test/csp/file_CSP_evalscript_main_spec_compliant_allowed.html
rename : content/base/test/file_CSP_evalscript_main_spec_compliant_allowed.html^headers^ => content/base/test/csp/file_CSP_evalscript_main_spec_compliant_allowed.html^headers^
rename : content/base/test/file_CSP_evalscript_main_spec_compliant_allowed_getCRMFRequest.html => content/base/test/csp/file_CSP_evalscript_main_spec_compliant_allowed_getCRMFRequest.html
rename : content/base/test/file_CSP_evalscript_main_spec_compliant_allowed_getCRMFRequest.html^headers^ => content/base/test/csp/file_CSP_evalscript_main_spec_compliant_allowed_getCRMFRequest.html^headers^
rename : content/base/test/file_CSP_evalscript_main_spec_compliant_getCRMFRequest.html => content/base/test/csp/file_CSP_evalscript_main_spec_compliant_getCRMFRequest.html
rename : content/base/test/file_CSP_evalscript_main_spec_compliant_getCRMFRequest.html^headers^ => content/base/test/csp/file_CSP_evalscript_main_spec_compliant_getCRMFRequest.html^headers^
rename : content/base/test/file_CSP_evalscript_no_CSP_at_all.html => content/base/test/csp/file_CSP_evalscript_no_CSP_at_all.html
rename : content/base/test/file_CSP_evalscript_no_CSP_at_all.html^headers^ => content/base/test/csp/file_CSP_evalscript_no_CSP_at_all.html^headers^
rename : content/base/test/file_CSP_evalscript_no_CSP_at_all.js => content/base/test/csp/file_CSP_evalscript_no_CSP_at_all.js
rename : content/base/test/file_CSP_frameancestors.sjs => content/base/test/csp/file_CSP_frameancestors.sjs
rename : content/base/test/file_CSP_frameancestors_main.html => content/base/test/csp/file_CSP_frameancestors_main.html
rename : content/base/test/file_CSP_frameancestors_main.js => content/base/test/csp/file_CSP_frameancestors_main.js
rename : content/base/test/file_CSP_frameancestors_main_spec_compliant.html => content/base/test/csp/file_CSP_frameancestors_main_spec_compliant.html
rename : content/base/test/file_CSP_frameancestors_main_spec_compliant.js => content/base/test/csp/file_CSP_frameancestors_main_spec_compliant.js
rename : content/base/test/file_CSP_frameancestors_spec_compliant.sjs => content/base/test/csp/file_CSP_frameancestors_spec_compliant.sjs
rename : content/base/test/file_CSP_inlinescript_main.html => content/base/test/csp/file_CSP_inlinescript_main.html
rename : content/base/test/file_CSP_inlinescript_main.html^headers^ => content/base/test/csp/file_CSP_inlinescript_main.html^headers^
rename : content/base/test/file_CSP_inlinescript_main_spec_compliant.html => content/base/test/csp/file_CSP_inlinescript_main_spec_compliant.html
rename : content/base/test/file_CSP_inlinescript_main_spec_compliant.html^headers^ => content/base/test/csp/file_CSP_inlinescript_main_spec_compliant.html^headers^
rename : content/base/test/file_CSP_inlinescript_main_spec_compliant_allowed.html => content/base/test/csp/file_CSP_inlinescript_main_spec_compliant_allowed.html
rename : content/base/test/file_CSP_inlinescript_main_spec_compliant_allowed.html^headers^ => content/base/test/csp/file_CSP_inlinescript_main_spec_compliant_allowed.html^headers^
rename : content/base/test/file_CSP_inlinestyle_main.html => content/base/test/csp/file_CSP_inlinestyle_main.html
rename : content/base/test/file_CSP_inlinestyle_main.html^headers^ => content/base/test/csp/file_CSP_inlinestyle_main.html^headers^
rename : content/base/test/file_CSP_inlinestyle_main_spec_compliant.html => content/base/test/csp/file_CSP_inlinestyle_main_spec_compliant.html
rename : content/base/test/file_CSP_inlinestyle_main_spec_compliant.html^headers^ => content/base/test/csp/file_CSP_inlinestyle_main_spec_compliant.html^headers^
rename : content/base/test/file_CSP_inlinestyle_main_spec_compliant_allowed.html => content/base/test/csp/file_CSP_inlinestyle_main_spec_compliant_allowed.html
rename : content/base/test/file_CSP_inlinestyle_main_spec_compliant_allowed.html^headers^ => content/base/test/csp/file_CSP_inlinestyle_main_spec_compliant_allowed.html^headers^
rename : content/base/test/file_CSP_main.html => content/base/test/csp/file_CSP_main.html
rename : content/base/test/file_CSP_main.html^headers^ => content/base/test/csp/file_CSP_main.html^headers^
rename : content/base/test/file_CSP_main.js => content/base/test/csp/file_CSP_main.js
rename : content/base/test/file_CSP_main_spec_compliant.html => content/base/test/csp/file_CSP_main_spec_compliant.html
rename : content/base/test/file_CSP_main_spec_compliant.html^headers^ => content/base/test/csp/file_CSP_main_spec_compliant.html^headers^
rename : content/base/test/file_CSP_main_spec_compliant.js => content/base/test/csp/file_CSP_main_spec_compliant.js
rename : content/base/test/file_bothCSPheaders.html => content/base/test/csp/file_bothCSPheaders.html
rename : content/base/test/file_bothCSPheaders.html^headers^ => content/base/test/csp/file_bothCSPheaders.html^headers^
rename : content/base/test/file_csp_bug768029.html => content/base/test/csp/file_csp_bug768029.html
rename : content/base/test/file_csp_bug768029.sjs => content/base/test/csp/file_csp_bug768029.sjs
rename : content/base/test/file_csp_bug773891.html => content/base/test/csp/file_csp_bug773891.html
rename : content/base/test/file_csp_bug773891.sjs => content/base/test/csp/file_csp_bug773891.sjs
rename : content/base/test/file_csp_redirects_main.html => content/base/test/csp/file_csp_redirects_main.html
rename : content/base/test/file_csp_redirects_page.sjs => content/base/test/csp/file_csp_redirects_page.sjs
rename : content/base/test/file_csp_redirects_resource.sjs => content/base/test/csp/file_csp_redirects_resource.sjs
rename : content/base/test/test_CSP.html => content/base/test/csp/test_CSP.html
rename : content/base/test/test_CSP_bug663567.html => content/base/test/csp/test_CSP_bug663567.html
rename : content/base/test/test_CSP_bug802872.html => content/base/test/csp/test_CSP_bug802872.html
rename : content/base/test/test_CSP_bug885433.html => content/base/test/csp/test_CSP_bug885433.html
rename : content/base/test/test_CSP_bug888172.html => content/base/test/csp/test_CSP_bug888172.html
rename : content/base/test/test_CSP_evalscript.html => content/base/test/csp/test_CSP_evalscript.html
rename : content/base/test/test_CSP_evalscript_getCRMFRequest.html => content/base/test/csp/test_CSP_evalscript_getCRMFRequest.html
rename : content/base/test/test_CSP_frameancestors.html => content/base/test/csp/test_CSP_frameancestors.html
rename : content/base/test/test_CSP_inlinescript.html => content/base/test/csp/test_CSP_inlinescript.html
rename : content/base/test/test_CSP_inlinestyle.html => content/base/test/csp/test_CSP_inlinestyle.html
rename : content/base/test/test_bothCSPheaders.html => content/base/test/csp/test_bothCSPheaders.html
rename : content/base/test/chrome/test_csp_bug768029.html => content/base/test/csp/test_csp_bug768029.html
rename : content/base/test/chrome/test_csp_bug773891.html => content/base/test/csp/test_csp_bug773891.html
rename : content/base/test/test_csp_redirects.html => content/base/test/csp/test_csp_redirects.html
2013-09-06 08:41:38 +02:00

229 lines
8.4 KiB
HTML
Raw Blame History

<!DOCTYPE HTML>
<html>
<!--
https://bugzilla.mozilla.org/show_bug.cgi?id=768029
-->
<head>
<meta charset="utf-8">
<title>Test for CSP on trusted/certified and installed apps -- bug 773891</title>
<script type="application/javascript" src="chrome://mochikit/content/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="chrome://mochikit/content/tests/SimpleTest/test.css"/>
</head>
<body>
<a target="_blank" href="https://bugzilla.mozilla.org/show_bug.cgi?id=773891">Mozilla Bug 773891</a>
<p id="display"></p>
<div id="content">
</div>
<pre id="test">
<script type="application/javascript;version=1.7">
Components.utils.import("resource://gre/modules/Services.jsm");
/** Test for Bug 773891 **/
// Note: we don't have to inspect all the different operations of CSP,
// we're just looking for specific differences in behavior that indicate
// a default CSP got applied.
const DEFAULT_CSP_PRIV = "default-src *; script-src *; style-src 'self' 'unsafe-inline'; object-src 'none'";
const DEFAULT_CSP_CERT = "default-src *; script-src *; style-src 'self'; object-src 'none'";
const MANIFEST_CSP_PRIV = "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'";
const MANIFEST_CSP_INST = "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'";
const MANIFEST_CSP_CERT = "default-src *; script-src 'self'; object-src 'none'; style-src 'self' 'unsafe-inline'";
SimpleTest.waitForExplicitFinish();
var gData = [
{
app: "https://example.com/manifest_csp_inst.webapp",
appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_INSTALLED,
csp: MANIFEST_CSP_INST,
origin: "https://example.com",
uri: "https://example.com/tests/content/base/test/csp/file_csp_bug773891.html",
statusString: "installed app",
expectedTestResults: {
max_tests: 7, /* number of bools below plus one for the status check */
cross_origin: { img: true, script: false, style: false },
same_origin: { img: true, script: true, style: true },
},
},
{
app: "https://example.com/manifest_csp_cert.webapp",
appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_CERTIFIED,
csp: MANIFEST_CSP_CERT,
origin: "https://example.com",
uri: "https://example.com/tests/content/base/test/csp/file_csp_bug773891.html",
statusString: "certified app",
expectedTestResults: {
max_tests: 7, /* number of bools below plus one for the status check */
cross_origin: { img: true, script: false, style: false },
same_origin: { img: true, script: true, style: true },
},
},
{
app: "https://example.com/manifest_csp_priv.webapp",
appStatus: Components.interfaces.nsIPrincipal.APP_STATUS_PRIVILEGED,
csp: MANIFEST_CSP_PRIV,
origin: "https://example.com",
uri: "https://example.com/tests/content/base/test/csp/file_csp_bug773891.html",
statusString: "privileged app",
expectedTestResults: {
max_tests: 7, /* number of bools below plus one for the status check */
cross_origin: { img: true, script: false, style: false },
same_origin: { img: true, script: true, style: true },
},
},
];
// Observer for watching allowed loads and blocked attempts
function ThingyListener(app, iframe) {
Services.obs.addObserver(this, "csp-on-violate-policy", false);
Services.obs.addObserver(this, "http-on-modify-request", false);
dump("added observers\n");
// keep track of which app ID this test is monitoring.
this._testData = app;
this._expectedResults = app.expectedTestResults;
this._resultsRecorded = { cross_origin: {}, same_origin: {}};
this._iframe = iframe;
this._countedTests = 0;
}
ThingyListener.prototype = {
observe: function(subject, topic, data) {
// make sure to only observe app-generated calls to the helper for this test.
var testpat = new RegExp("file_csp_bug773891\\.sjs");
// used to extract which kind of load this is (img, script, etc).
var typepat = new RegExp("type=([\\_a-z0-9]+)");
// used to identify whether it's cross-origin or same-origin loads
// (the applied CSP allows same-origin loads).
var originpat = new RegExp("origin=([\\_a-z0-9]+)");
if (topic === "http-on-modify-request") {
// Matching requests on this topic were allowed by the csp
var chan = subject.QueryInterface(Components.interfaces.nsIHttpChannel);
var uri = chan.URI;
// ignore irrelevent URIs
if (!testpat.test(uri.asciiSpec)) return;
var loadType = typepat.exec(uri.asciiSpec)[1];
var originType = originpat.exec(uri.asciiSpec)[1];
// skip duplicate hits to this topic (potentially document loads
// may generate duplicate loads.
if (this._resultsRecorded[originType] &&
this._resultsRecorded[originType][loadType]) {
return;
}
var message = originType + " : " + loadType + " should be " +
(this._expectedResults[originType][loadType] ? "allowed" : "blocked");
ok(this._expectedResults[originType][loadType] == true, message);
this._resultsRecorded[originType][loadType] = true;
this._countedTests++;
}
else if (topic === "csp-on-violate-policy") {
// Matching hits on this topic were blocked by the csp
var uri = subject.QueryInterface(Components.interfaces.nsIURI);
// ignore irrelevent URIs
if (!testpat.test(uri.asciiSpec)) return;
var loadType = typepat.exec(uri.asciiSpec)[1];
var originType = originpat.exec(uri.asciiSpec)[1];
// skip duplicate hits to this topic (potentially document loads
// may generate duplicate loads.
if (this._resultsRecorded[originType] &&
this._resultsRecorded[originType][loadType]) {
return;
}
var message = originType + " : " + loadType + " should be " +
(this._expectedResults[originType][loadType] ? "allowed" : "blocked");
ok(this._expectedResults[originType][loadType] == false, message);
this._resultsRecorded[originType][loadType] = true;
this._countedTests++;
}
else {
// wrong topic! Nothing to do.
return;
}
this._checkForFinish();
},
_checkForFinish: function() {
// check to see if there are load tests still pending.
// (All requests triggered by the app should hit one of the
// two observer topics.)
if (this._countedTests == this._expectedResults.max_tests) {
Services.obs.removeObserver(this, "csp-on-violate-policy");
Services.obs.removeObserver(this, "http-on-modify-request");
dump("removed observers\n");
checkedCount++;
if (checkedCount == checksTodo) {
SpecialPowers.removePermission("browser", "https://example.com");
SimpleTest.finish();
} else {
gTestRunner.next();
}
}
},
// verify the status of the app
checkAppStatus: function() {
var principal = this._iframe.contentDocument.nodePrincipal;
if (this._testData.app) {
is(principal.appStatus, this._testData.appStatus,
"iframe principal's app status doesn't match the expected app status.");
this._countedTests++;
this._checkForFinish();
}
}
}
var content = document.getElementById('content');
var checkedCount = 0; // number of apps checked
var checksTodo = gData.length;
// quick check to make sure we can test apps:
is('appStatus' in document.nodePrincipal, true,
'appStatus should be present in nsIPrincipal, if not the rest of this test will fail');
function runTest() {
for (var i = 0; i < gData.length; i++) {
let data = gData[i];
var iframe = document.createElement('iframe');
// watch for successes and failures
var examiner = new ThingyListener(data, iframe);
iframe.setAttribute('mozapp', data.app);
iframe.setAttribute('mozbrowser', 'true');
iframe.addEventListener('load', examiner.checkAppStatus.bind(examiner));
iframe.src = data.uri;
content.appendChild(iframe);
yield undefined;
}
}
var gTestRunner = runTest();
// load the default CSP and pref it on
SpecialPowers.addPermission("browser", true, "https://example.com");
SpecialPowers.pushPrefEnv({'set': [["dom.mozBrowserFramesEnabled", true],
["security.apps.privileged.CSP.default", DEFAULT_CSP_PRIV],
["security.apps.certified.CSP.default", DEFAULT_CSP_CERT]]},
function() { gTestRunner.next(); });
</script>
</pre>
</body>
</html>
Reference in New Issue View Git Blame Copy Permalink