targeting.html (7239B)
1 <!doctype html> 2 <meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abc'; style-src 'self'"> 3 <script nonce="abc" src="/resources/testharness.js"></script> 4 <script nonce="abc" src="/resources/testharnessreport.js"></script> 5 <script nonce="abc"> 6 var unexecuted_test = async_test("These tests should not fail."); 7 8 async_test(t => { 9 var watcher = new EventWatcher(t, document, ['securitypolicyviolation']) 10 watcher.wait_for('securitypolicyviolation') 11 .then(t.step_func(e => { 12 assert_equals(e.blockedURI, "inline"); 13 assert_equals(e.target, document.querySelector('#block1')); 14 return watcher.wait_for('securitypolicyviolation'); 15 })) 16 .then(t.step_func(e => { 17 assert_equals(e.blockedURI, "inline"); 18 assert_equals(e.target, document.querySelector('#block2')); 19 return watcher.wait_for('securitypolicyviolation'); 20 })) 21 .then(t.step_func(e => { 22 assert_equals(e.blockedURI, "inline"); 23 assert_equals(e.target, document.querySelector('#block3')); 24 return watcher.wait_for('securitypolicyviolation'); 25 })) 26 .then(t.step_func(e => { 27 assert_equals(e.blockedURI, "inline"); 28 assert_equals(e.target, document.querySelector('#block4')); 29 return watcher.wait_for('securitypolicyviolation'); 30 })) 31 .then(t.step_func(e => { 32 assert_equals(e.blockedURI, "inline"); 33 assert_equals(e.target, document.querySelector('#block5')); 34 return watcher.wait_for('securitypolicyviolation'); 35 })) 36 .then(t.step_func(e => { 37 assert_equals(e.blockedURI, "inline"); 38 assert_equals(e.lineNumber, 118); 39 assert_in_array(e.columnNumber, [5, 7]); 40 assert_equals(e.target, document, "Elements created in this document, but pushed into a same-origin frame trigger on that frame's document, not on this frame's document."); 41 return watcher.wait_for('securitypolicyviolation'); 42 })) 43 .then(t.step_func(e => { 44 assert_equals(e.blockedURI, "inline"); 45 assert_equals(e.lineNumber, 131); 46 assert_in_array(e.columnNumber, [5, 60]); 47 assert_equals(e.target, document, "Elements created in this document, but pushed into a same-origin frame trigger on that frame's document, not on this frame's document."); 48 return watcher.wait_for('securitypolicyviolation'); 49 })) 50 .then(t.step_func(e => { 51 assert_equals(e.blockedURI, "inline"); 52 assert_equals(e.lineNumber, 139); 53 assert_in_array(e.columnNumber, [5, 7]); 54 assert_equals(e.target, document, "Inline event handlers for disconnected elements target the document."); 55 return watcher.wait_for('securitypolicyviolation'); 56 })) 57 .then(t.step_func(e => { 58 assert_equals(e.blockedURI, "inline"); 59 assert_equals(e.lineNumber, 0); 60 assert_equals(e.columnNumber, 1); 61 assert_equals(e.target, document, "Inline event handlers for elements disconnected after triggering target the document."); 62 })) 63 .then(t.step_func_done(_ => { 64 unexecuted_test.done(); 65 })); 66 }, "Inline violations target the right element."); 67 68 </script> 69 <!-- Inline block with no nonce. --> 70 <script id="block1"> 71 unexecuted_test.assert_unreached("This code block should not execute."); 72 </script> 73 74 <!-- Inline event handler. --> 75 <a id="block2" onclick="void(0)">Click me!</a> 76 <script nonce='abc'>document.querySelector('#block2').click();</script> 77 78 <!-- Style block. --> 79 <style id="block3"> 80 p { color: red !important; } 81 </style> 82 83 <!-- Inline event handler inside Shadow DOM --> 84 <div id="block4"></div> 85 <script nonce='abc'> 86 async_test(t => { 87 var shadow = document.querySelector('#block4').attachShadow({"mode":"closed"}); 88 shadow.innerHTML = "<a id='block4a' onclick='void(0)'>Click!</a>"; 89 var a = shadow.querySelector('#block4a'); 90 a.addEventListener('securitypolicyviolation', t.step_func_done(e => { 91 assert_equals(e.blockedURI, "inline"); 92 assert_equals(e.target, a); 93 })); 94 a.click(); 95 }, "Correct targeting inside shadow tree (inline handler)."); 96 </script> 97 98 <!-- Inline event handler inside Shadow DOM --> 99 <div id="block5"></div> 100 <script nonce='abc'> 101 async_test(t => { 102 var shadow = document.querySelector('#block5').attachShadow({"mode":"closed"}); 103 var style = document.createElement('style'); 104 style.innerText = 'p { color: red; }'; 105 style.addEventListener('securitypolicyviolation', t.step_func_done(e => { 106 assert_equals(e.blockedURI, "inline"); 107 assert_equals(e.target, style); 108 })); 109 shadow.appendChild(style); 110 }, "Correct targeting inside shadow tree (style)."); 111 </script> 112 113 <!-- Pushed into a same-origin Document that isn't this Document --> 114 <iframe id="block6"></iframe> 115 <script nonce="abc"> 116 async_test(t => { 117 var d = document.createElement("div"); 118 d.setAttribute("onclick", "void(0);"); 119 var events = 0; 120 d.addEventListener('securitypolicyviolation', t.step_func(e => { 121 events++; 122 assert_equals(e.blockedURI, "inline"); 123 assert_equals(e.target, d); 124 })); 125 document.querySelector('#block6').contentDocument.addEventListener('securitypolicyviolation', t.step_func_done(e => { 126 events++; 127 assert_equals(e.blockedURI, "inline"); 128 assert_equals(e.target, d); 129 assert_equals(events, 2); 130 })); 131 document.querySelector('#block6').contentDocument.body.appendChild(d); 132 }, "Elements created in this document, but pushed into a same-origin frame trigger on that frame's document, not on this frame's document."); 133 </script> 134 135 <!-- Disconnected inline event handler --> 136 <script nonce="abc"> 137 async_test(t => { 138 var d = document.createElement("div"); 139 d.setAttribute("onclick", "void(0);"); 140 d.addEventListener('securitypolicyviolation', t.unreached_func()); 141 d.click(); 142 t.done(); 143 }, "Inline event handlers for disconnected elements target the document."); 144 </script> 145 146 <!-- Inline event handler, disconnected after click. --> 147 <a id="block8" onclick="void(0)">Click me also!</a> 148 <script nonce="abc"> 149 async_test(t => { 150 var a = document.querySelector('#block8'); 151 a.addEventListener('securitypolicyviolation', t.unreached_func()); 152 a.click(); 153 a.parentNode.removeChild(a); 154 t.done(); 155 }, "Inline event handlers for elements disconnected after triggering target the document."); 156 </script> 157 158 <!-- Disconnected in a DocumentFragment --> 159 <script nonce="abc"> 160 async_test(t => { 161 var f = new DocumentFragment(); 162 var d = document.createElement('div'); 163 d.setAttribute('onclick', 'void(0)'); 164 d.addEventListener('securitypolicyviolation', t.unreached_func()); 165 f.appendChild(d); 166 d.click(); 167 t.done(); 168 }, "Inline event handlers for elements in a DocumentFragment target the document."); 169 </script>