script-src-wildcards-disallowed.html (2571B)
1 <!DOCTYPE html> 2 <html> 3 <head> 4 <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-nonce' *; connect-src 'self';"> 5 <title>script-src disallowed wildcard use</title> 6 <script src="/resources/testharness.js"></script> 7 <script src="/resources/testharnessreport.js"></script> 8 </head> 9 <body> 10 <script nonce="nonce"> 11 var t1 = async_test('data: URIs should not match *'); 12 t1.step(function() { 13 var script = document.createElement("script"); 14 script.src = 'data:application/javascript,'; 15 script.addEventListener('load', t1.step_func(function() { 16 assert_unreached('Should not successfully load data URI.'); 17 })); 18 script.addEventListener('error', t1.step_func(function() { 19 t1.done(); 20 })); 21 document.head.appendChild(script); 22 }); 23 24 var t2 = async_test('blob: URIs should not match *'); 25 t2.step(function() { 26 var b = new Blob([''], { type: 'application/javascript' }); 27 var script = document.createElement('script'); 28 script.addEventListener('load', t2.step_func(function() { 29 assert_unreached('Should not successfully load blob URI.'); 30 })); 31 script.addEventListener('error', t2.step_func(function() { 32 t2.done(); 33 })); 34 35 script.src = URL.createObjectURL(b); 36 document.head.appendChild(script); 37 }); 38 39 var t3 = async_test('filesystem URIs should not match *'); 40 if (window.webkitRequestFileSystem) { 41 window.webkitRequestFileSystem(TEMPORARY, 1024*1024 /*1MB*/, function(fs) { 42 fs.root.getFile('fail.js', {create: true}, function(fileEntry) { 43 fileEntry.createWriter(function(fileWriter) { 44 var script = document.createElement('script'); 45 46 script.addEventListener('load', t3.step_func(function() { 47 assert_unreached('Should not successfully load filesystem URI.'); 48 })); 49 script.addEventListener('error', t3.step_func(function() { 50 t3.done(); 51 })); 52 53 script.src = fileEntry.toURL('application/javascript'); 54 document.body.appendChild(script); 55 }); 56 }); 57 }); 58 } else { 59 t3.done(); 60 } 61 </script> 62 </body> 63 </html>