tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

test_form-action.html (3039B)

      1 <!DOCTYPE HTML>
      2 <html>
      3 <head>
      4  <title>Bug 529697 - Test mapping of form submission to form-action</title>
      5  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
      6  <script src="/tests/SimpleTest/SimpleTest.js"></script>
      7  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
      8 </head>
      9 <body>
     10  <p id="display"></p>
     11  <div id="content" style="visibility: hidden">
     12    <iframe style="width:100%;" id="testframe"></iframe>
     13  </div>
     14 
     15 <script class="testbody" type="text/javascript">
     16 
     17 /*
     18 * Description of the test:
     19 *   We load a page with a given CSP and verify that form submissions are correctly
     20 *   evaluated through the "form-action" directive.
     21 */
     22 
     23 SimpleTest.waitForExplicitFinish();
     24 
     25 var tests = [
     26  {
     27    page   : "file_form-action.html",
     28    result : "allowed",
     29    policy : "form-action 'self'"
     30  },
     31  {
     32    page   : "file_form-action.html",
     33    result : "blocked",
     34    policy : "form-action 'none'"
     35  }
     36 ];
     37 
     38 // initializing to -1 so we start at index 0 when we start the test
     39 var counter = -1;
     40 
     41 function checkResult(aResult) {
     42  is(aResult, tests[counter].result, "should be " + tests[counter].result + " in test " + counter + "!");
     43  loadNextTest();
     44 }
     45 
     46 // We use the examiner to identify requests that hit the wire and requests
     47 // that are blocked by CSP and bubble up the result to the including iframe
     48 // document (parent).
     49 function examiner() {
     50  SpecialPowers.addObserver(this, "csp-on-violate-policy");
     51  SpecialPowers.addObserver(this, "specialpowers-http-notify-request");
     52 }
     53 examiner.prototype  = {
     54  observe(subject, topic, data) {
     55   if (topic === "specialpowers-http-notify-request") {
     56      // making sure we do not bubble a result for something other
     57      // then the request in question.
     58      if (!data.includes("submit-form")) {
     59        return;
     60      }
     61      checkResult("allowed");
     62    }
     63 
     64    if (topic === "csp-on-violate-policy") {
     65      // making sure we do not bubble a result for something other
     66      // then the request in question.
     67      var asciiSpec = SpecialPowers.getPrivilegedProps(
     68                        SpecialPowers.do_QueryInterface(subject, "nsIURI"),
     69                        "asciiSpec");
     70      if (!asciiSpec.includes("submit-form")) {
     71        return;
     72      }
     73      checkResult("blocked");
     74    }
     75  },
     76  remove() {
     77    SpecialPowers.removeObserver(this, "csp-on-violate-policy");
     78    SpecialPowers.removeObserver(this, "specialpowers-http-notify-request");
     79  }
     80 }
     81 window.FormActionExaminer = new examiner();
     82 
     83 function loadNextTest() {
     84  counter++;
     85  if (counter == tests.length) {
     86    window.FormActionExaminer.remove();
     87    SimpleTest.finish();
     88    return;
     89  }
     90 
     91  var src = "file_testserver.sjs";
     92  // append the file that should be served
     93  src += "?file=" + escape("tests/dom/security/test/csp/" + tests[counter].page);
     94  // append the CSP that should be used to serve the file
     95  src += "&csp=" + escape(tests[counter].policy);
     96 
     97  document.getElementById("testframe").src = src;
     98 }
     99 
    100 // start running the tests
    101 loadNextTest();
    102 
    103 </script>
    104 </body>
    105 </html>