tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

max-payload.https.window.js (4256B)

      1 // META: script=/common/get-host-info.sub.js
      2 // META: script=/common/utils.js
      3 // META: script=/fetch/fetch-later/resources/fetch-later-helper.js
      4 // META: script=/fetch/fetch-later/quota/resources/helper.js
      5 'use strict';
      6 
      7 const {HTTPS_ORIGIN, HTTPS_NOTSAMESITE_ORIGIN} = get_host_info();
      8 
      9 // Skips FormData & URLSearchParams, as browser adds extra bytes to them
     10 // in addition to the user-provided content. It is difficult to test a
     11 // request right at the quota limit.
     12 // Skips File & Blob as it's difficult to estimate what additional data are
     13 // added into them.
     14 const dataType = BeaconDataType.String;
     15 
     16 // Request headers are counted into total request size.
     17 const headers = new Headers({'Content-Type': 'text/plain;charset=UTF-8'});
     18 
     19 
     20 // In a cross-origin iframe, test making a POST request (same origin as parent
     21 // frame) with max possible payload.
     22 promise_test(
     23    async _ => {
     24      const uuid = token();
     25      const requestUrl = generateSetBeaconURL(uuid, {host: HTTPS_ORIGIN});
     26 
     27      await loadFetchLaterIframe(HTTPS_NOTSAMESITE_ORIGIN, {
     28        targetUrl: requestUrl,
     29        uuid: uuid,
     30        activateAfter: 0,
     31        method: 'POST',
     32        bodyType: dataType,
     33        bodySize:
     34            getRemainingQuota(QUOTA_PER_CROSS_ORIGIN, requestUrl, headers),
     35        // Required, as the size of referrer also take up quota.
     36        referrer: '',
     37      });
     38    },
     39    `fetchLater() accepts max payload in a parent-frame-origin POST request body of ${
     40        dataType} in a default cross-origin iframe.`);
     41 
     42 // In a cross-origin iframe, test making a POST request (same origin as parent
     43 // frame) with max possible payload + 1 byte.
     44 promise_test(
     45    async _ => {
     46      const uuid = token();
     47      const requestUrl = generateSetBeaconURL(uuid, {host: HTTPS_ORIGIN});
     48 
     49      await loadFetchLaterIframe(HTTPS_NOTSAMESITE_ORIGIN, {
     50        targetUrl: requestUrl,
     51        uuid: uuid,
     52        activateAfter: 0,
     53        method: 'POST',
     54        bodyType: dataType,
     55        bodySize:
     56            getRemainingQuota(QUOTA_PER_CROSS_ORIGIN, requestUrl, headers) + 1,
     57        // Required, as the size of referrer also take up quota.
     58        referrer: '',
     59        expect: new FetchLaterIframeExpectation(
     60            FetchLaterExpectationType.ERROR_DOM, 'QuotaExceededError'),
     61      });
     62    },
     63    `fetchLater() rejects max+1 payload in a parent-frame-origin POST request body of ${
     64        dataType} in a default cross-origin iframe.`);
     65 
     66 // In a cross-origin iframe, test making a POST request (same origin as iframe)
     67 // with max possible payload.
     68 promise_test(
     69    async _ => {
     70      const uuid = token();
     71      const crossOriginRequestUrl =
     72          generateSetBeaconURL(uuid, {host: HTTPS_NOTSAMESITE_ORIGIN});
     73 
     74      await loadFetchLaterIframe(HTTPS_NOTSAMESITE_ORIGIN, {
     75        targetUrl: crossOriginRequestUrl,
     76        uuid: uuid,
     77        activateAfter: 0,
     78        method: 'POST',
     79        bodyType: dataType,
     80        bodySize: getRemainingQuota(
     81            QUOTA_PER_CROSS_ORIGIN, crossOriginRequestUrl, headers),
     82        // Required, as the size of referrer also take up quota.
     83        referrer: '',
     84      });
     85    },
     86    `fetchLater() accepts max payload in a self-frame-origin POST request body of ${
     87        dataType} in a default cross-origin iframe.`);
     88 
     89 // In a cross-origin iframe, test making a POST request (same origin as iframe)
     90 // with max possible payload + 1 byte.
     91 promise_test(
     92    async _ => {
     93      const uuid = token();
     94      const crossOriginRequestUrl =
     95          generateSetBeaconURL(uuid, {host: HTTPS_NOTSAMESITE_ORIGIN});
     96 
     97      await loadFetchLaterIframe(HTTPS_NOTSAMESITE_ORIGIN, {
     98        targetUrl: crossOriginRequestUrl,
     99        uuid: uuid,
    100        activateAfter: 0,
    101        method: 'POST',
    102        bodyType: dataType,
    103        bodySize: getRemainingQuota(
    104                      QUOTA_PER_CROSS_ORIGIN, crossOriginRequestUrl, headers) +
    105            1,
    106        // Required, as the size of referrer also take up quota.
    107        referrer: '',
    108        expect: new FetchLaterIframeExpectation(
    109            FetchLaterExpectationType.ERROR_DOM, 'QuotaExceededError'),
    110      });
    111    },
    112    `fetchLater() rejects max+1 payload in a self-frame-origin POST request body of ${
    113        dataType} in a default cross-origin iframe.`);