tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

browser_websocket_exceptions.js (2157B)

      1 "use strict";
      2 
      3 const TEST_PATH_HTTP = getRootDirectory(gTestPath).replace(
      4  "chrome://mochitests/content",
      5  "http://localhost:9898"
      6 );
      7 
      8 let WEBSOCKET_DOC_URL = `${TEST_PATH_HTTP}file_websocket_exceptions.html`;
      9 
     10 add_task(async function () {
     11  // Here is a sequence of how this test works:
     12  // 1. Dynamically inject a localhost iframe
     13  // 2. Add an exemption for localhost
     14  // 3. Fire up Websocket
     15  // Generally local IP addresses are exempt from https-only, but if we do not add
     16  // an exemption for localhost, then the TriggeringPrincipal of the WebSocket is
     17  // `not` exempt and we would upgrade ws to wss.
     18 
     19  await SpecialPowers.pushPrefEnv({
     20    set: [
     21      ["dom.security.https_only_mode", true],
     22      ["network.proxy.allow_hijacking_localhost", true],
     23    ],
     24  });
     25 
     26  await BrowserTestUtils.withNewTab("about:blank", async function (browser) {
     27    let loaded = BrowserTestUtils.browserLoaded(browser);
     28 
     29    BrowserTestUtils.startLoadingURIString(browser, WEBSOCKET_DOC_URL);
     30    await loaded;
     31 
     32    await SpecialPowers.spawn(browser, [], async function () {
     33      // Part 1:
     34      let myIframe = content.document.createElement("iframe");
     35      content.document.body.appendChild(myIframe);
     36      myIframe.src =
     37        "http://localhost:9898/browser/dom/security/test/https-only/file_websocket_exceptions_iframe.html";
     38 
     39      myIframe.onload = async function () {
     40        // Part 2:
     41        await SpecialPowers.pushPermissions([
     42          {
     43            type: "https-only-load-insecure",
     44            allow: true,
     45            context: "http://localhost:9898",
     46          },
     47        ]);
     48        // Part 3.
     49        myIframe.contentWindow.postMessage({ myMessage: "runWebSocket" }, "*");
     50      };
     51 
     52      const promise = new Promise(resolve => {
     53        content.addEventListener("WebSocketEnded", resolve, {
     54          once: true,
     55        });
     56      });
     57 
     58      const { detail } = await promise;
     59 
     60      is(detail.state, "onopen", "sanity: websocket loaded");
     61      ok(
     62        detail.url.startsWith("ws://example.com/tests"),
     63        "exempt websocket should not be upgraded to wss://"
     64      );
     65    });
     66  });
     67  await SpecialPowers.popPermissions();
     68 });