to-javascript-url-script-src.html (2775B)
1 <!DOCTYPE html> 2 <script src="/resources/testharness.js"></script> 3 <script src="/resources/testharnessreport.js"></script> 4 5 <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc'"> 6 7 <body> 8 9 <script nonce="abc"> 10 function assert_csp_event_for_element(test, element, resolve) { 11 assert_equals(typeof SecurityPolicyViolationEvent, "function", "These tests require 'SecurityPolicyViolationEvent'."); 12 document.addEventListener("securitypolicyviolation", test.step_func(e => { 13 assert_equals(e.blockedURI, "inline"); 14 assert_equals(e.effectiveDirective, "script-src-elem"); 15 assert_equals(element.contentDocument.body.innerText, "", "Ensure that 'Fail' doesn't appear in the child document."); 16 element.remove(); 17 resolve(); 18 }, { once: true })); 19 } 20 21 function navigate_to_javascript_onload(test, iframe) { 22 iframe.addEventListener("load", test.step_func(e => { 23 assert_equals(typeof SecurityPolicyViolationEvent, "function"); 24 iframe.contentDocument.addEventListener( 25 "securitypolicyviolation", 26 test.unreached_func("The CSP event should be fired in the embedding document, not in the embedee.") 27 ); 28 29 iframe.src = "javascript:'Fail.'"; 30 })); 31 } 32 33 promise_test(t => { 34 return new Promise(resolve => { 35 var i = document.createElement("iframe"); 36 i.src = "javascript:'Fail.'"; 37 38 assert_csp_event_for_element(t, i, resolve); 39 40 document.body.appendChild(i); 41 }) 42 }, "<iframe src='javascript:'> blocked without 'unsafe-inline'."); 43 44 promise_test(t => { 45 return new Promise(resolve => { 46 var i = document.createElement("iframe"); 47 48 assert_csp_event_for_element(t, i, resolve); 49 navigate_to_javascript_onload(t, i); 50 51 document.body.appendChild(i); 52 }) 53 }, "<iframe> navigated to 'javascript:' blocked without 'unsafe-inline'."); 54 55 promise_test(t => { 56 return new Promise(resolve => { 57 var i = document.createElement("iframe"); 58 i.src = "../support/echo-policy.py?policy=" + encodeURIComponent("script-src 'unsafe-inline'"); 59 60 assert_csp_event_for_element(t, i, resolve); 61 navigate_to_javascript_onload(t, i); 62 63 document.body.appendChild(i); 64 }) 65 }, "<iframe src='...'> with 'unsafe-inline' navigated to 'javascript:' blocked in this document"); 66 67 promise_test(t => { 68 return new Promise(resolve => { 69 var i = document.createElement("iframe"); 70 i.src = "../support/echo-policy.py?policy=" + encodeURIComponent("script-src 'none'"); 71 72 assert_csp_event_for_element(t, i, resolve); 73 navigate_to_javascript_onload(t, i); 74 75 document.body.appendChild(i); 76 }) 77 }, "<iframe src='...'> without 'unsafe-inline' navigated to 'javascript:' blocked in this document."); 78 </script>