tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

nonimport-integrity.html (5824B)


      1 <!DOCTYPE html>
      2 <html>
      3 <head>
      4 <script src="/resources/testharness.js"></script>
      5 <script src="/resources/testharnessreport.js"></script>
      6 <script>
      7 let log = [];
      8 </script>
      9 <script type="importmap">
     10 {
     11  "integrity": {
     12    "./resources/log.js?pipe=sub&name=ModuleNoIntegrity": "sha384-foobar",
     13    "./resources/log.js?pipe=sub&name=ModuleIntegrity": "sha384-foobar",
     14    "./resources/log.js?pipe=sub&name=ModuleEmptyIntegrity": "sha384-foobar",
     15    "./resources/log.js?pipe=sub&name=ModuleBadIntegrityAttribute": "sha384-COhDkp+ybIZ9wz9hUaSJ5NzKcn8wOMZMpsACZfTeEdBRtNcX5yWJnFn+lIK77Tay",
     16    "./resources/log.js?pipe=sub&name=ModulePreloadNoIntegrity": "sha384-foobar",
     17    "./resources/log.js?pipe=sub&name=ModulePreloadIntegrity": "sha384-foobar",
     18    "./resources/log.js?pipe=sub&name=ModulePreloadEmptyIntegrity": "sha384-foobar",
     19    "./resources/log.js?pipe=sub&name=ModulePreloadBadIntegrityAttribute": "sha384-026dlUs9+KSmPb0Uc7oUPOlWBO67o7vSFdfLJZWEVTvKCly5NXO8+CsOXl54ZBqJ",
     20    "./resources/log.js?pipe=sub&name=NonModule": "sha384-foobar",
     21    "/images/green.png": "sha384-foobar"
     22  }
     23 }
     24 </script>
     25 <script type="module">
     26 const test_not_loaded = async (elem) => {
     27  const promise = new Promise((resolve, reject) => {
     28    elem.onload = () =>  {
     29       reject(new Error("It shouldn't have loaded"));
     30     };
     31    elem.onerror = resolve;
     32  });
     33  document.head.appendChild(elem);
     34  const event = await promise;
     35  assert_equals(event.type, "error");
     36 };
     37 
     38 promise_test(async t => {
     39  log = [];
     40  const script = document.createElement("script");
     41  script.type = "module";
     42  script.src = "./resources/log.js?pipe=sub&name=ModuleNoIntegrity";
     43  await test_not_loaded(script);
     44 }, "Script was not loaded as its integrity check was not ignored");
     45 
     46 promise_test(async () => {
     47  log = [];
     48  const script = document.createElement("script");
     49  script.type = "module";
     50  script.integrity = "sha384-QtZrhNFOSmHASHnBdmGg+zrVz5hjukCBakaqwT2pcG7w+QTa/niK16csP6kXAeXI";
     51  script.src = "./resources/log.js?pipe=sub&name=ModuleIntegrity";
     52  const promise = new Promise((resolve, reject) => {
     53    script.onload = resolve;
     54    script.onerror = reject;
     55  });
     56  document.head.appendChild(script);
     57  await promise;
     58  assert_equals(log.length, 1);
     59  assert_equals(log[0], "log:ModuleIntegrity");
     60 }, "Script was loaded as its correct integrity attribute was not ignored");
     61 
     62 promise_test(async () => {
     63  log = [];
     64  const script = document.createElement("script");
     65  script.type = "module";
     66  script.integrity = "";
     67  script.src = "./resources/log.js?pipe=sub&name=ModuleEmptyIntegrity";
     68  const promise = new Promise((resolve, reject) => {
     69    script.onload = resolve;
     70    script.onerror = reject;
     71  });
     72  document.head.appendChild(script);
     73  await promise;
     74  assert_equals(log.length, 1);
     75  assert_equals(log[0], "log:ModuleEmptyIntegrity");
     76 }, "Script was loaded as its empty integrity attribute was not ignored");
     77 
     78 promise_test(async t => {
     79  log = [];
     80  const script = document.createElement("script");
     81  script.type = "module";
     82  script.integrity = "sha384-foobar";
     83  script.src = "./resources/log.js?pipe=sub&name=ModuleBadIntegrityAttribute";
     84  await test_not_loaded(script);
     85 }, "Script was not loaded as its bad integrity attribute was not overridden");
     86 
     87 promise_test(async t => {
     88  const link = document.createElement("link");
     89  link.rel = "modulepreload";
     90  link.href = "./resources/log.js?pipe=sub&name=ModulePreloadNoIntegrity";
     91  const promise = new Promise((resolve, reject) => {
     92    link.onload = resolve;
     93    link.onerror = () => { reject(Error()); };
     94  });
     95  document.head.appendChild(link);
     96  await promise_rejects_js(t, Error, promise);
     97 }, "Modulepreload was not loaded as its integrity check was not ignored");
     98 
     99 promise_test(async () => {
    100  const link = document.createElement("link");
    101  link.rel = "modulepreload";
    102  link.integrity = "sha384-iDG3WysExtjWvD9QwQrC7nGXRvO0jM+r7Z2cOLMDO2geMlEtmN9j9xfqHfzT45+9";
    103  link.href = "./resources/log.js?pipe=sub&name=ModulePreloadIntegrity";
    104  const promise = new Promise((resolve, reject) => {
    105    link.onload = resolve;
    106    link.onerror = reject;
    107  });
    108  document.head.appendChild(link);
    109  await promise;
    110 }, "Modulepreload was loaded as its correct integrity attribute was not ignored");
    111 
    112 promise_test(async () => {
    113  const link = document.createElement("link");
    114  link.rel = "modulepreload";
    115  link.integrity = "";
    116  link.href = "./resources/log.js?pipe=sub&name=ModulePreloadEmptyIntegrity";
    117  const promise = new Promise((resolve, reject) => {
    118    link.onload = resolve;
    119    link.onerror = reject;
    120  });
    121  document.head.appendChild(link);
    122  await promise;
    123 }, "Modulepreload was loaded as its empty integrity attribute was not ignored");
    124 
    125 promise_test(async t => {
    126  const link = document.createElement("link");
    127  link.rel = "modulepreload";
    128  link.integrity = "sha384-foobar";
    129  link.href = "./resources/log.js?pipe=sub&name=ModulePreloadBadIntegrityAttribute";
    130  await test_not_loaded(link);
    131 }, "Modulepreload was not loaded as its bad integrity attribute was not ignored");
    132 
    133 promise_test(async () => {
    134  log = [];
    135  const script = document.createElement("script");
    136  script.src = "./resources/log.js?pipe=sub&name=NonModule";
    137  const promise = new Promise((resolve, reject) => {
    138    script.onload = resolve;
    139    script.onerror = reject;
    140  });
    141  document.head.appendChild(script);
    142  await promise;
    143  assert_equals(log.length, 1);
    144  assert_equals(log[0], "log:NonModule");
    145 }, "Classic script was loaded as its integrity check was ignored");
    146 
    147 promise_test(async () => {
    148  const img = document.createElement("img");
    149  const promise = new Promise((resolve, reject) => {
    150    img.onload = resolve;
    151    img.onerror = reject;
    152  });
    153  img.src = "/images/green.png";
    154  document.head.appendChild(img);
    155  await promise;
    156 }, "Image was loaded as its integrity check was ignored");
    157 </script>
    158 </head>