script-sample-no-opt-in.html (2370B)
1 <!doctype html> 2 <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc'; style-src 'self'; img-src 'none'"> 3 <script nonce="abc" src="/resources/testharness.js"></script> 4 <script nonce="abc" src="/resources/testharnessreport.js"></script> 5 <body> 6 <script nonce="abc"> 7 function waitForViolation(el) { 8 return new Promise(resolve => { 9 el.addEventListener('securitypolicyviolation', e => resolve(e)); 10 }); 11 } 12 13 async_test(t => { 14 var s = document.createElement('script'); 15 s.innerText = "assert_unreached('inline script block')"; 16 17 waitForViolation(s) 18 .then(t.step_func_done(e => { 19 assert_equals(e.blockedURI, "inline"); 20 assert_equals(e.sample, ""); 21 })); 22 23 document.head.append(s); 24 }, "Inline script should not have a sample."); 25 26 async_test(t => { 27 var a = document.createElement("a"); 28 a.setAttribute("onclick", "assert_unreached('inline event handler')"); 29 30 waitForViolation(a) 31 .then(t.step_func_done(e => { 32 assert_equals(e.blockedURI, "inline"); 33 assert_equals(e.sample, ""); 34 })); 35 36 document.body.append(a); 37 a.click(); 38 }, "Inline event handlers should not have a sample."); 39 40 async_test(t => { 41 var i = document.createElement("iframe"); 42 i.src = "javascript:'inline url'"; 43 44 waitForViolation(i) 45 .then(t.step_func_done(e => { 46 assert_equals(e.blockedURI, "inline"); 47 assert_equals(e.sample, ""); 48 })); 49 50 document.body.append(i); 51 }, "JavaScript URLs in iframes should not have a sample."); 52 53 async_test(t => { 54 var violations = 0; 55 document.addEventListener('securitypolicyviolation', t.step_func(e => { 56 if (e.blockedURI != "eval") 57 return; 58 59 assert_equals(e.sample, ""); 60 violations++ 61 if (violations == 3) 62 t.done(); 63 })); 64 try { 65 eval("assert_unreached('eval')"); 66 assert_unreached('eval'); 67 } catch (e) { 68 } 69 try { 70 setInterval("assert_unreached('interval')", 1000); 71 assert_unreached('interval'); 72 } catch (e) { 73 } 74 try { 75 setTimeout("assert_unreached('timeout')", 1000); 76 assert_unreached('timeout'); 77 } catch (e) { 78 } 79 }, "eval()-alikes should not have a sample."); 80 </script>