dedicated-worker-cache-storage.https.html (4945B)
1 <!doctype html> 2 <html> 3 <title> Check enforcement of COEP in a DedicatedWorker using CacheStorage. </title> 4 <script src="/resources/testharness.js"></script> 5 <script src="/resources/testharnessreport.js"></script> 6 <script src="/common/get-host-info.sub.js"></script> 7 <script> 8 // See also: ./shared-worker-cache-storage.https.html 9 10 function remote(path) { 11 const REMOTE_ORIGIN = get_host_info().HTTPS_REMOTE_ORIGIN; 12 return new URL(path, REMOTE_ORIGIN); 13 } 14 15 const iframe_path = "./resources/iframe.html?pipe="; 16 const dedicated_worker_path = "./universal-worker.js?pipe="; 17 const ressource_path = "/images/blue.png?pipe="; 18 19 const coep_header= { 20 "coep-none" : "", 21 "coep-require-corp" : "|header(Cross-Origin-Embedder-Policy,require-corp)", 22 } 23 24 const corp_header = { 25 "corp-undefined": "", 26 "corp-cross-origin": "|header(Cross-Origin-Resource-Policy,cross-origin)", 27 } 28 29 // Check enforcement of COEP in a DedicatedWorker using CacheStorage. 30 // 31 // 1) Fetch a response from a document with COEP:none. Store it in the 32 // CacheStorage. The response is cross-origin without any CORS header. 33 // 2) From an iframe, start a DedicatedWorker and try to retrieve the response 34 // from the CacheStorage. 35 // 36 // Test parameters: 37 // - |iframe_coep| the COEP header of the iframe's document response 38 // - |worker_coep| the COEP header of the DedicatedWorker's script response. 39 // - |response_corp| the CORP header of the response. 40 // 41 // Test expectations: 42 // |result| 43 // - "success" when the worker is able to fetch the response from the 44 // CacheStorage, 45 // - "failure" when the worker is not able to fetch the response from the 46 // CacheStorage, and 47 // - "error" when it is unable to create a worker. 48 // https://mikewest.github.io/corpp/#initialize-embedder-policy-for-global 49 function check( 50 // Test parameters: 51 iframe_coep, 52 worker_coep, 53 response_corp, 54 55 // Test expectations: 56 result) { 57 58 promise_test(async (t) => { 59 // 1) Fetch a response from a document with COEP:none. Store it in the 60 // CacheStorage. The response is cross-origin without any CORS header. 61 const resource_path = ressource_path + corp_header[response_corp]; 62 const resource_url = remote(resource_path); 63 const fetch_request = new Request(resource_url, {mode: 'no-cors'}); 64 const cache = await caches.open('v1'); 65 const fetch_response = await fetch(fetch_request); 66 await cache.put(fetch_request, fetch_response); 67 68 // 2) From an iframe, start a DedicatedWorker and try to retrieve the 69 // response from the CacheStorage. 70 const worker_url = dedicated_worker_path + coep_header[worker_coep]; 71 const worker_eval = ` 72 (async function() { 73 const cache = await caches.open('v1'); 74 const request = new Request('${resource_url}', { 75 mode: 'no-cors' 76 }); 77 try { 78 const response = await cache.match(request); 79 postMessage('success'); 80 } catch(error) { 81 postMessage('failure'); 82 } 83 })() 84 `; 85 86 const iframe_url = iframe_path + coep_header[iframe_coep]; 87 const iframe_eval = ` 88 (async function() { 89 const w = new Worker('${worker_url}'); 90 const worker_response = new Promise(resolve => w.onmessage = resolve); 91 w.onerror = () => parent.postMessage('error'); 92 w.postMessage(\`${worker_eval}\`); 93 const response = await worker_response; 94 parent.postMessage(response.data); 95 })(); 96 `; 97 98 const iframe = document.createElement("iframe"); 99 t.add_cleanup(() => iframe.remove()); 100 iframe.src = iframe_url; 101 const iframe_loaded = new Promise(resolve => iframe.onload = resolve); 102 document.body.appendChild(iframe); 103 await iframe_loaded; 104 105 const iframe_response = new Promise(resolve => { 106 window.addEventListener("message", resolve); 107 }) 108 iframe.contentWindow.postMessage(iframe_eval); 109 110 const {data} = await iframe_response; 111 assert_equals(data, result); 112 }, `${iframe_coep} ${worker_coep} ${response_corp}`) 113 } 114 115 // ----------------------------------------------------------------------------- 116 // iframe_coep , worker_coep , response_corp , loaded 117 // ----------------------------------------------------------------------------- 118 check("coep-none" , "coep-none" , "corp-cross-origin" , "success"); 119 check("coep-none" , "coep-none" , "corp-undefined" , "success"); 120 check("coep-none" , "coep-require-corp" , "corp-cross-origin" , "success"); 121 check("coep-none" , "coep-require-corp" , "corp-undefined" , "failure"); 122 check("coep-require-corp" , "coep-none" , "corp-cross-origin" , "error"); 123 check("coep-require-corp" , "coep-none" , "corp-undefined" , "error"); 124 check("coep-require-corp" , "coep-require-corp" , "corp-cross-origin" , "success"); 125 check("coep-require-corp" , "coep-require-corp" , "corp-undefined" , "failure"); 126 127 </script> 128 </html>