connect-src-self-report-only.sub.js (3963B)
1 importScripts("{{location[server]}}/resources/testharness.js"); 2 importScripts("{{location[server]}}/content-security-policy/support/testharness-helper.js"); 3 4 let base_same_origin_url = 5 "{{location[server]}}/content-security-policy/support/resource.py"; 6 7 // Same-origin 8 promise_test(t => { 9 let url = `${base_same_origin_url}?same-origin-fetch`; 10 assert_no_csp_event_for_url(t, url); 11 12 return fetch(url) 13 .then(t.step_func(r => assert_equals(r.status, 200))); 14 }, "Same-origin 'fetch()'."); 15 16 // XHR is not available in service workers. 17 if (self.XMLHttpRequest) { 18 promise_test(t => { 19 let url = `${base_same_origin_url}?same-origin-xhr`; 20 assert_no_csp_event_for_url(t, url); 21 22 return new Promise((resolve, reject) => { 23 var xhr = new XMLHttpRequest(); 24 xhr.open("GET", url); 25 xhr.onload = resolve; 26 xhr.onerror = _ => reject("xhr.open should success."); 27 xhr.send(); 28 }); 29 }, "Same-origin XHR."); 30 } 31 32 let base_cross_origin_url = 33 "https://{{hosts[][www]}}:{{ports[https][1]}}" + 34 "/content-security-policy/support/resource.py"; 35 let fetch_cross_origin_url = `${base_cross_origin_url}?cross-origin-fetch`; 36 37 // Cross-origin 38 promise_test(t => { 39 let url = fetch_cross_origin_url; 40 41 return Promise.all([ 42 waitUntilCSPEventForURL(t, url), 43 fetch(url) 44 ]); 45 }, "Cross-origin 'fetch()'."); 46 47 let xhr_cross_origin_url = `${base_cross_origin_url}?cross-origin-xhr`; 48 49 // XHR is not available in service workers. 50 if (self.XMLHttpRequest) { 51 promise_test(t => { 52 let url = xhr_cross_origin_url; 53 54 return Promise.all([ 55 waitUntilCSPEventForURL(t, url), 56 new Promise((resolve, reject) => { 57 var xhr = new XMLHttpRequest(); 58 xhr.open("GET", url); 59 xhr.onload = resolve; 60 xhr.onerror = _ => reject("xhr.open should not have thrown."); 61 xhr.send(); 62 }) 63 ]); 64 }, "Cross-origin XHR."); 65 } 66 67 let redirect_url = `{{location[server]}}/common/redirect-opt-in.py?` + 68 `status=307&location=${fetch_cross_origin_url}`; 69 70 // Same-origin redirecting to cross-origin 71 promise_test(t => { 72 let url = redirect_url; 73 74 return Promise.all([ 75 waitUntilCSPEventForURL(t, url), 76 fetch(url) 77 ]); 78 }, "Same-origin => cross-origin 'fetch()'."); 79 80 let websocket_url = "wss://{{host}}:{{ports[wss][0]}}/echo"; 81 82 // The WebSocket URL is not the same as 'self' 83 promise_test(t => { 84 return Promise.all([ 85 waitUntilCSPEventForURL(t, websocket_url), 86 new Promise(resolve => { 87 let ws = new WebSocket(websocket_url); 88 ws.onopen = resolve; 89 }) 90 ]); 91 }, "WebSocket."); 92 93 let expected_blocked_urls = self.XMLHttpRequest 94 ? [ fetch_cross_origin_url, xhr_cross_origin_url, redirect_url, websocket_url ] 95 : [ fetch_cross_origin_url, redirect_url, websocket_url ]; 96 97 promise_test(async t => { 98 let report_url = `{{location[server]}}/reporting/resources/report.py?` + 99 `?op=retrieve_report&reportID={{GET[id]}}` + 100 `&min_count=${expected_blocked_urls.length}`; 101 102 let response = await fetch(report_url); 103 assert_equals(response.status, 200, "Fetching reports failed"); 104 105 let response_json = await response.json(); 106 let reports = response_json.map(x => x["csp-report"]); 107 108 assert_array_equals( 109 reports.map(x => x["blocked-uri"]).sort(), 110 expected_blocked_urls.sort(), 111 "Reports do not match"); 112 reports.forEach(x => { 113 assert_equals( 114 x["violated-directive"], "connect-src", 115 "Violated directive in report does not match"); 116 assert_equals( 117 x["effective-directive"], "connect-src", 118 "Effective directive in report does not match"); 119 assert_equals( 120 x["disposition"], "report", 121 "Disposition in report does not match"); 122 assert_equals( 123 x["document-uri"], 124 "{{location[server]}}/content-security-policy/inside-worker/" + 125 "support/connect-src-self-report-only.sub.js?id={{GET[id]}}", 126 "Document uri in report does not match"); 127 }); 128 }); 129 130 done();