tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

test_ignore_xfo.html (4117B)

      1 <!DOCTYPE HTML>
      2 <html>
      3 <head>
      4  <title>Bug 1024557: Ignore x-frame-options if CSP with frame-ancestors exists</title>
      5  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
      6  <script src="/tests/SimpleTest/SimpleTest.js"></script>
      7  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
      8 </head>
      9 <body>
     10 <iframe style="width:100%;" id="csp_testframe"></iframe>
     11 <iframe style="width:100%;" id="csp_testframe_no_xfo"></iframe>
     12 <iframe style="width:100%;" id="csp_ro_testframe"></iframe>
     13 
     14 <script class="testbody" type="text/javascript">
     15 
     16 /*
     17 * We load two frames using:
     18 *   x-frame-options: deny
     19 * where the first frame uses a csp and the second a csp_ro including frame-ancestors.
     20 * We make sure that xfo is ignored for regular csp but not for csp_ro.
     21 */
     22 
     23 SimpleTest.waitForExplicitFinish();
     24 
     25 var script = SpecialPowers.loadChromeScript(() => {
     26 /* eslint-env mozilla/chrome-script */
     27  let ignoreCount = 0;
     28  function listener(msg) {
     29    if(msg.message.includes("Content-Security-Policy: Ignoring ‘x-frame-options’ because of ‘frame-ancestors’ directive.")) {
     30      ignoreCount++;
     31      if(ignoreCount == 2) {
     32        ok(false, 'The "Content-Security-Policy: Ignoring ‘x-frame-options’ because of ‘frame-ancestors’ directive." warning should only appear once for the csp_testframe.');
     33      }
     34    }
     35  }
     36  Services.console.registerListener(listener);
     37 
     38  addMessageListener("cleanup", () => {
     39    Services.console.unregisterListener(listener);
     40  });
     41 });
     42 
     43 SimpleTest.registerCleanupFunction(async () => {
     44  await script.sendQuery("cleanup");
     45 });
     46 
     47 var testcounter = 0;
     48 function checkFinished() {
     49  testcounter++;
     50  if (testcounter < 4) {
     51    return;
     52  }
     53  // remove the listener and we are done.
     54  window.examiner.remove();
     55  SimpleTest.finish();
     56 }
     57 
     58 // X-Frame-Options checks happen in the parent, hence we have to
     59 // proxy the xfo violation notifications.
     60 SpecialPowers.registerObservers("xfo-on-violate-policy");
     61 
     62 function examiner() {
     63  SpecialPowers.addObserver(this, "specialpowers-xfo-on-violate-policy");
     64 }
     65 examiner.prototype  = {
     66  observe(subject, topic, data) {
     67    var asciiSpec = SpecialPowers.getPrivilegedProps(SpecialPowers.do_QueryInterface(subject, "nsIURI"), "asciiSpec");
     68 
     69    is(asciiSpec, "http://mochi.test:8888/tests/dom/security/test/csp/file_ro_ignore_xfo.html", "correct subject");  
     70    ok(topic.endsWith("xfo-on-violate-policy"), "correct topic");
     71    is(data, "deny", "correct data");
     72    checkFinished();
     73  },
     74  remove() {
     75    SpecialPowers.removeObserver(this, "specialpowers-xfo-on-violate-policy");
     76  }
     77 }
     78 window.examiner = new examiner();
     79 
     80 // 1) test XFO with CSP
     81 var csp_testframe = document.getElementById("csp_testframe");
     82 csp_testframe.onload = function() {
     83  var msg = csp_testframe.contentDocument.getElementById("cspmessage");
     84  is(msg.innerHTML, "Ignoring XFO because of CSP", "Loading frame with with XFO and CSP");
     85  checkFinished();
     86 }
     87 csp_testframe.onerror = function() {
     88  ok(false, "sanity: should not fire onerror for csp_testframe");
     89  checkFinished();
     90 }
     91 csp_testframe.src = "file_ignore_xfo.html";
     92 
     93 // 2) test XFO with CSP_RO
     94 var csp_ro_testframe = document.getElementById("csp_ro_testframe");
     95 // If XFO denies framing then the onload event should fire.
     96 csp_ro_testframe.onload = function() {
     97  ok(true, "sanity: should fire onload for csp_ro_testframe");
     98  checkFinished();
     99 }
    100 csp_ro_testframe.onerror = function() {
    101  ok(false, "sanity: should not fire onerror for csp_ro_testframe");
    102  checkFinished();
    103 }
    104 csp_ro_testframe.src = "file_ro_ignore_xfo.html";
    105 
    106 var csp_testframe_no_xfo = document.getElementById("csp_testframe_no_xfo");
    107 csp_testframe_no_xfo.onload = function() {
    108  var msg = csp_testframe_no_xfo.contentDocument.getElementById("cspmessage");
    109  is(msg.innerHTML, "Do not log xfo ignore warning when no xfo is set.", "Loading frame with with no XFO and CSP");
    110  checkFinished();
    111 }
    112 csp_testframe_no_xfo.onerror = function() {
    113  ok(false, "sanity: should not fire onerror for csp_testframe_no_xfo");
    114  checkFinished();
    115 }
    116 csp_testframe_no_xfo.src = "file_no_log_ignore_xfo.html";
    117 
    118 </script>
    119 </body>
    120 </html>