test_report_for_import.html (3970B)
1 <!DOCTYPE HTML> 2 <html> 3 <!-- 4 https://bugzilla.mozilla.org/show_bug.cgi?id=548193 5 --> 6 <head> 7 <title>Test for Bug 548193</title> 8 <script src="/tests/SimpleTest/SimpleTest.js"></script> 9 <link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" /> 10 </head> 11 <body> 12 <p id="display"></p> 13 <div id="content" style="display: none"> 14 </div> 15 16 <iframe style="width:200px;height:200px;" id='cspframe'></iframe> 17 <script class="testbody" type="text/javascript"> 18 19 /* 20 * Description of the test: 21 * We are loading a stylesheet using a csp policy that only allows styles from 'self' 22 * to be loaded. In other words, the *.css file itself should be allowed to load, but 23 * the @import file within the CSS should get blocked. We verify that the generated 24 * csp-report is sent and contains all the expected values. 25 * In detail, the test starts by sending an XHR request to the report-server 26 * which waits on the server side till the report was received and hands the 27 * report in JSON format back to the testfile which then verifies accuracy 28 * of all the different report fields in the CSP report. 29 */ 30 31 const TEST_FILE = "tests/dom/security/test/csp/file_report_for_import.html"; 32 const REPORT_URI = 33 "http://mochi.test:8888/tests/dom/security/test/csp/file_report_for_import_server.sjs?report"; 34 const POLICY = "style-src 'self'; report-uri " + REPORT_URI; 35 36 const DOC_URI = 37 "http://mochi.test:8888/tests/dom/security/test/csp/file_testserver.sjs?" + 38 "file=tests/dom/security/test/csp/file_report_for_import.html&" + 39 "csp=style-src%20%27self%27%3B%20" + 40 "report-uri%20http%3A//mochi.test%3A8888/tests/dom/security/test/csp/" + 41 "file_report_for_import_server.sjs%3Freport"; 42 43 function checkResults(reportStr) { 44 try { 45 var reportObj = JSON.parse(reportStr); 46 var cspReport = reportObj["csp-report"]; 47 48 is(cspReport["document-uri"], DOC_URI, "Incorrect document-uri"); 49 is(cspReport.referrer, 50 "http://mochi.test:8888/tests/dom/security/test/csp/test_report_for_import.html", 51 "Incorrect referrer"); 52 is(cspReport["violated-directive"], 53 "style-src-elem", 54 "Incorrect violated-directive"); 55 is(cspReport["original-policy"], POLICY, "Incorrect original-policy"); 56 is(cspReport["blocked-uri"], 57 "http://example.com/tests/dom/security/test/csp/file_report_for_import_server.sjs?stylesheet", 58 "Incorrect blocked-uri"); 59 60 // we do not always set the following fields 61 is(cspReport["source-file"], undefined, "Incorrect source-file"); 62 is(cspReport["script-sample"], undefined, "Incorrect script-sample"); 63 is(cspReport["line-number"], undefined, "Incorrect line-number"); 64 } 65 catch (e) { 66 ok(false, "Could not parse JSON (exception: " + e + ")"); 67 } 68 } 69 70 function loadTestPageIntoFrame() { 71 // load the resource which will generate a CSP violation report 72 // save this for last so that our listeners are registered. 73 var src = "file_testserver.sjs"; 74 // append the file that should be served 75 src += "?file=" + escape(TEST_FILE); 76 // append the CSP that should be used to serve the file 77 src += "&csp=" + escape(POLICY); 78 // appending a fragment so we can test that it's correctly stripped 79 // for document-uri and source-file. 80 src += "#foo"; 81 document.getElementById("cspframe").src = src; 82 } 83 84 function runTest() { 85 // send an xhr request to the server which is processed async, which only 86 // returns after the server has received the csp report. 87 var myXHR = new XMLHttpRequest(); 88 myXHR.open("GET", "file_report_for_import_server.sjs?queryresult"); 89 myXHR.onload = function(e) { 90 checkResults(myXHR.responseText); 91 SimpleTest.finish(); 92 } 93 myXHR.onerror = function(e) { 94 ok(false, "could not query results from server (" + e.message + ")"); 95 SimpleTest.finish(); 96 } 97 myXHR.send(); 98 99 // give it some time and run the testpage 100 SimpleTest.executeSoon(loadTestPageIntoFrame); 101 } 102 103 SimpleTest.waitForExplicitFinish(); 104 runTest(); 105 106 </script> 107 </pre> 108 </body> 109 </html>