tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

connect-src-self-report-only.sub.js (3963B)


      1 importScripts("{{location[server]}}/resources/testharness.js");
      2 importScripts("{{location[server]}}/content-security-policy/support/testharness-helper.js");
      3 
      4 let base_same_origin_url =
      5      "{{location[server]}}/content-security-policy/support/resource.py";
      6 
      7 // Same-origin
      8 promise_test(t => {
      9  let url = `${base_same_origin_url}?same-origin-fetch`;
     10  assert_no_csp_event_for_url(t, url);
     11 
     12  return fetch(url)
     13      .then(t.step_func(r => assert_equals(r.status, 200)));
     14 }, "Same-origin 'fetch()'.");
     15 
     16 // XHR is not available in service workers.
     17 if (self.XMLHttpRequest) {
     18  promise_test(t => {
     19    let url = `${base_same_origin_url}?same-origin-xhr`;
     20    assert_no_csp_event_for_url(t, url);
     21 
     22    return new Promise((resolve, reject) => {
     23      var xhr = new XMLHttpRequest();
     24      xhr.open("GET", url);
     25      xhr.onload = resolve;
     26      xhr.onerror = _ => reject("xhr.open should success.");
     27      xhr.send();
     28    });
     29  }, "Same-origin XHR.");
     30 }
     31 
     32 let base_cross_origin_url =
     33      "https://{{hosts[][www]}}:{{ports[https][1]}}" +
     34      "/content-security-policy/support/resource.py";
     35 let fetch_cross_origin_url = `${base_cross_origin_url}?cross-origin-fetch`;
     36 
     37 // Cross-origin
     38 promise_test(t => {
     39  let url = fetch_cross_origin_url;
     40 
     41  return Promise.all([
     42    waitUntilCSPEventForURL(t, url),
     43    fetch(url)
     44  ]);
     45 }, "Cross-origin 'fetch()'.");
     46 
     47 let xhr_cross_origin_url = `${base_cross_origin_url}?cross-origin-xhr`;
     48 
     49 // XHR is not available in service workers.
     50 if (self.XMLHttpRequest) {
     51  promise_test(t => {
     52    let url = xhr_cross_origin_url;
     53 
     54    return Promise.all([
     55      waitUntilCSPEventForURL(t, url),
     56      new Promise((resolve, reject) => {
     57        var xhr = new XMLHttpRequest();
     58        xhr.open("GET", url);
     59        xhr.onload = resolve;
     60        xhr.onerror = _ => reject("xhr.open should not have thrown.");
     61        xhr.send();
     62      })
     63    ]);
     64  }, "Cross-origin XHR.");
     65 }
     66 
     67 let redirect_url = `{{location[server]}}/common/redirect-opt-in.py?` +
     68      `status=307&location=${fetch_cross_origin_url}`;
     69 
     70 // Same-origin redirecting to cross-origin
     71 promise_test(t => {
     72  let url = redirect_url;
     73 
     74  return Promise.all([
     75    waitUntilCSPEventForURL(t, url),
     76    fetch(url)
     77  ]);
     78 }, "Same-origin => cross-origin 'fetch()'.");
     79 
     80 let websocket_url = "wss://{{host}}:{{ports[wss][0]}}/echo";
     81 
     82 // The WebSocket URL is not the same as 'self'
     83 promise_test(t => {
     84  return Promise.all([
     85    waitUntilCSPEventForURL(t, websocket_url),
     86    new Promise(resolve => {
     87      let ws = new WebSocket(websocket_url);
     88      ws.onopen = resolve;
     89    })
     90  ]);
     91 }, "WebSocket.");
     92 
     93 let expected_blocked_urls = self.XMLHttpRequest
     94    ? [ fetch_cross_origin_url, xhr_cross_origin_url, redirect_url, websocket_url ]
     95    : [ fetch_cross_origin_url, redirect_url, websocket_url ];
     96 
     97 promise_test(async t => {
     98  let report_url = `{{location[server]}}/reporting/resources/report.py?` +
     99      `?op=retrieve_report&reportID={{GET[id]}}` +
    100      `&min_count=${expected_blocked_urls.length}`;
    101 
    102  let response = await fetch(report_url);
    103  assert_equals(response.status, 200, "Fetching reports failed");
    104 
    105  let response_json = await response.json();
    106  let reports = response_json.map(x => x["csp-report"]);
    107 
    108  assert_array_equals(
    109      reports.map(x => x["blocked-uri"]).sort(),
    110      expected_blocked_urls.sort(),
    111      "Reports do not match");
    112  reports.forEach(x => {
    113    assert_equals(
    114        x["violated-directive"], "connect-src",
    115        "Violated directive in report does not match");
    116    assert_equals(
    117        x["effective-directive"], "connect-src",
    118        "Effective directive in report does not match");
    119    assert_equals(
    120        x["disposition"], "report",
    121        "Disposition in report does not match");
    122    assert_equals(
    123        x["document-uri"],
    124        "{{location[server]}}/content-security-policy/inside-worker/" +
    125          "support/connect-src-self-report-only.sub.js?id={{GET[id]}}",
    126        "Document uri in report does not match");
    127  });
    128 });
    129 
    130 done();