cspee.https.html (2489B)
1 <!DOCTYPE html> 2 <title>Test fenced frame in CSPEE</title> 3 <script src="/resources/testharness.js"></script> 4 <script src="/resources/testharnessreport.js"></script> 5 <script src="/common/utils.js"></script> 6 <script src="/common/dispatcher/dispatcher.js"></script> 7 <script src="resources/utils.js"></script> 8 9 <body> 10 <script> 11 promise_test(async(t) => { 12 const iframe = attachIFrameContext({ 13 attributes: [["csp", "frame-src *"]], 14 headers: [["Allow-CSP-From", "*"]] 15 }); 16 t.step_timeout(() => t.done(), 1000); 17 await iframe.execute(async (t) => { 18 const fencedframe = attachFencedFrameContext({ 19 headers: [["Allow-CSP-From", "*"]] 20 }); 21 await fencedframe.execute(() => {}); 22 }); 23 assert_unreached("fenced frame should not be loaded."); 24 }, 'fenced frame should not be loaded in CSPEE'); 25 26 promise_test(async(t) => { 27 const iframe_a = attachIFrameContext({ 28 attributes: [["csp", "frame-src *"]], 29 headers: [["Allow-CSP-From", "*"]] 30 }); 31 t.step_timeout(() => t.done(), 1000); 32 await iframe_a.execute(async (t) => { 33 const iframe_b = attachIFrameContext({headers: [["Allow-CSP-From", "*"]]}); 34 await iframe_b.execute(async (t) => { 35 const fencedframe = attachFencedFrameContext({ 36 headers: [["Allow-CSP-From", "*"]] 37 }); 38 await fencedframe.execute(() => {}); 39 }); 40 }); 41 assert_unreached("fenced frame should not be loaded."); 42 }, 'fenced frame should not be loaded if any ancestor has CSPEE'); 43 44 promise_test(async(t) => { 45 const iframe = attachIFrameContext({ 46 attributes: [["csp", "frame-src *"]], 47 headers: [["Allow-CSP-From", "*"]] 48 }); 49 await iframe.execute(async (t) => { 50 assert_false(navigator.canLoadAdAuctionFencedFrame()); 51 }); 52 }, 'canLoadOpaqueURL considers CSPEE headers'); 53 54 promise_test(async(t) => { 55 const iframe_a = attachIFrameContext({ 56 attributes: [["csp", "frame-src *"]], 57 headers: [["Allow-CSP-From", "*"]] 58 }); 59 await iframe_a.execute(async (t) => { 60 const iframe_b = attachIFrameContext({headers: [["Allow-CSP-From", "*"]]}); 61 await iframe_b.execute(async (t) => { 62 assert_false(navigator.canLoadAdAuctionFencedFrame()); 63 }); 64 }); 65 }, 'canLoadOpaqueURL considers CSPEE headers up the ancestor chain'); 66 67 promise_test(async(t) => { 68 const iframe = attachIFrameContext(); 69 await iframe.execute(async (t) => { 70 assert_true(navigator.canLoadAdAuctionFencedFrame()); 71 }); 72 }, 'canLoadOpaqueURL returns true if no CSPEE headers are present in iframe'); 73 </script> 74 </body>