script-src-strict_dynamic_hashes.html (2315B)
1 <!DOCTYPE HTML> 2 <html> 3 4 <head> 5 <title>`strict-dynamic` allows scripts matching hashes present in the policy.</title> 6 <script src='/resources/testharness.js' nonce='dummy'></script> 7 <script src='/resources/testharnessreport.js' nonce='dummy'></script> 8 9 <!-- CSP served: script-src 'strict-dynamic' 'nonce-dummy' 'sha256-yU6Q7nD1TCBB9JvY06iIJ8ONLOPU4g8ml5JCDgXkv+M=' 'sha256-EEoi70frWHkGFhK51NVIJkXpq72aPxSCNZEow37ZmRA=' 'sha256-wIc3KtqOuTFEu6t17sIBuOswgkV406VJvhSk79Gw6U0=' --> 10 </head> 11 12 <body> 13 <h1>`strict-dynamic` allows scripts matching hashes present in the policy.</h1> 14 <div id='log'></div> 15 16 <script nonce='dummy'> 17 var hashScriptRan = false; 18 window.addEventListener('securitypolicyviolation', function(e) { 19 assert_unreached('CSP violation reports should not fire.'); 20 }); 21 </script> 22 23 <!-- Hash: 'sha256-EEoi70frWHkGFhK51NVIJkXpq72aPxSCNZEow37ZmRA=' --> 24 <script> 25 hashScriptRan = true; 26 </script> 27 28 <script nonce='dummy'> 29 async_test(function(t) { 30 assert_true(hashScriptRan); 31 t.done(); 32 }, "Script matching SHA256 hash is allowed with `strict-dynamic`."); 33 </script> 34 35 <!-- Hash: 'sha256-IFt1v6itHgqlrtInbPm/y7qyWcAlDbPgZM+92C5EZ5o=' --> 36 <script> 37 async_test(function(t) { 38 window.addEventListener('message', t.step_func(function(e) { 39 if (e.data === 'hashScript') { 40 t.done(); 41 } 42 })); 43 var e = document.createElement('script'); 44 e.id = 'hashScript'; 45 e.src = 'simpleSourcedScript.js?' + e.id; 46 e.onerror = t.unreached_func('Error should not be triggered.'); 47 document.body.appendChild(e); 48 }, 'Script injected via `appendChild` from a script matching SHA256 hash is allowed with `strict-dynamic`.'); 49 </script> 50 51 <script nonce='dummy'> 52 var externalRan = false; 53 </script> 54 <script src='./externalScript.js' 55 integrity="sha256-wIc3KtqOuTFEu6t17sIBuOswgkV406VJvhSk79Gw6U0="></script> 56 <script nonce='dummy'> 57 test(function(t) { 58 assert_true(externalRan); 59 }, "External script in a script tag with matching SRI hash is allowed with `strict-dynamic`."); 60 </script> 61 </body> 62 63 </html>