tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

test_meta_header_dual.html (3989B)

      1 <!DOCTYPE HTML>
      2 <html>
      3 <head>
      4  <meta charset="utf-8">
      5  <title>Bug 663570 - Implement Content Security Policy via meta tag</title>
      6  <!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
      7  <script src="/tests/SimpleTest/SimpleTest.js"></script>
      8  <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
      9 </head>
     10 <body>
     11 <p id="display"></p>
     12 <iframe style="width:100%;" id="testframe"></iframe>
     13 
     14 <script class="testbody" type="text/javascript">
     15 
     16 /* Description of the test:
     17 * We test all sorts of CSPs on documents, including documents with no
     18 * CSP, with meta CSP and with meta CSP in combination with a CSP header.
     19 */
     20 
     21 const TESTS = [
     22  {
     23    /* load image without any CSP */
     24    query: "test1",
     25    result: "img-loaded",
     26    policyLen: 0,
     27    desc: "no CSP should allow load",
     28  },
     29  {
     30    /* load image where meta denies load */
     31    query: "test2",
     32    result: "img-blocked",
     33    policyLen: 1,
     34    desc: "meta (img-src 'none') should block load"
     35  },
     36  {
     37    /* load image where meta allows load */
     38    query: "test3",
     39    result: "img-loaded",
     40    policyLen: 1,
     41    desc: "meta (img-src http://mochi.test) should allow load"
     42  },
     43  {
     44    /* load image where meta allows but header blocks */
     45    query: "test4", // triggers speculative load
     46    result: "img-blocked",
     47    policyLen: 2,
     48    desc: "meta (img-src http://mochi.test), header (img-src 'none') should block load"
     49  },
     50  {
     51    /* load image where meta blocks but header allows */
     52    query: "test5", // triggers speculative load
     53    result: "img-blocked",
     54    policyLen: 2,
     55    desc: "meta (img-src 'none'), header (img-src http://mochi.test) should block load"
     56  },
     57  {
     58    /* load image where meta allows and header allows */
     59    query: "test6", // triggers speculative load
     60    result: "img-loaded",
     61    policyLen: 2,
     62    desc: "meta (img-src http://mochi.test), header (img-src http://mochi.test) should allow load"
     63  },
     64  {
     65    /* load image where meta1 allows but meta2 blocks */
     66    query: "test7",
     67    result: "img-blocked",
     68    policyLen: 2,
     69    desc: "meta1 (img-src http://mochi.test), meta2 (img-src 'none') should allow blocked"
     70  },
     71  {
     72    /* load image where meta1 allows and meta2 allows */
     73    query: "test8",
     74    result: "img-loaded",
     75    policyLen: 2,
     76    desc: "meta1 (img-src http://mochi.test), meta2 (img-src http://mochi.test) should allow allowed"
     77  },
     78 ];
     79 
     80 var curTest;
     81 var counter = -1;
     82 
     83 function finishTest() {
     84  window.removeEventListener("message", receiveMessage);
     85  SimpleTest.finish();
     86 }
     87 
     88 function checkResults(result) {
     89  // make sure the image got loaded or blocked
     90  is(result, curTest.result, curTest.query + ": " + curTest.desc);
     91 
     92  if (curTest.policyLen != 0) {
     93    // make sure that meta policy got not parsed and appended twice
     94    try {
     95      // get the csp in JSON notation from the principal
     96      var frame = document.getElementById("testframe");
     97      var contentDoc = SpecialPowers.wrap(frame.contentDocument);
     98      var cspOBJ = JSON.parse(contentDoc.cspJSON);
     99      // make sure that the speculative policy and the actual policy
    100      // are not appended twice.
    101      var policies = cspOBJ["csp-policies"];
    102      is(policies.length, curTest.policyLen, curTest.query + " should have: " + curTest.policyLen + " policies");
    103    }
    104    catch (e) {
    105      ok(false, "uuh, something went wrong within cspToJSON in " + curTest.query);
    106    }
    107  }
    108  // move on to the next test
    109  runNextTest();
    110 }
    111 
    112 // a postMessage handler used to bubble up the
    113 // onsuccess/onerror state from within the iframe.
    114 window.addEventListener("message", receiveMessage);
    115 function receiveMessage(event) {
    116  checkResults(event.data.result);
    117 }
    118 
    119 function runNextTest() {
    120  if (++counter == TESTS.length) {
    121    finishTest();
    122    return;
    123  }
    124  curTest = TESTS[counter];
    125  // load next test
    126  document.getElementById("testframe").src = "file_meta_header_dual.sjs?" + curTest.query;
    127 }
    128 
    129 // start the test
    130 SimpleTest.waitForExplicitFinish();
    131 runNextTest();
    132 
    133 </script>
    134 </body>
    135 </html>