tor-browser

The Tor Browser
git clone https://git.dasho.dev/tor-browser.git
Log | Files | Refs | README | LICENSE

response-status-code.html (4829B)


      1 <!DOCTYPE html>
      2 <head>
      3 <meta charset="utf-8" />
      4 <meta name="timeout" content="long">
      5 <title>This test validates the response status of resources.</title>
      6 <link rel="help" href="https://www.w3.org/TR/resource-timing-2/#sec-performanceresourcetiming"/>
      7 <script src="/resources/testharness.js"></script>
      8 <script src="/resources/testharnessreport.js"></script>
      9 <script src="resources/entry-invariants.js"></script>
     10 <script src="resources/resource-loaders.js"></script>
     11 <script src="/common/get-host-info.sub.js"></script>
     12 </head>
     13 <body>
     14 <script>
     15 const {ORIGIN, REMOTE_ORIGIN} = get_host_info();
     16 const SAME_ORIGIN = location.origin;
     17 const status_codes = [
     18  200, 203,
     19  400, 401, 403, 404,
     20  500, 501, 502, 503,
     21 ];
     22 
     23 const load_image_object = async path => {
     24  return load.object(path, "image/png");
     25 }
     26 
     27 const load_frame_object = async path => {
     28  return load.object(path, "text/html");
     29 }
     30 
     31 const load_null_object = async path => {
     32  return load.object(path, null);
     33 }
     34 
     35 // Response status for same origin resources is exposed.
     36 for(const loader of [
     37  load.font,
     38  load.image,
     39  load.script,
     40  load.stylesheet,
     41  load.xhr_sync,
     42  load.xhr_async,
     43  load.iframe,
     44  load_image_object,
     45  load_frame_object,
     46  load_null_object
     47 ]) {
     48  for(const status of status_codes) {
     49    let path = (loader == load.font) ? '/fonts/pass.woff' :
     50                                       '/resource-timing/resources/empty.js';
     51    path += `?pipe=status(${status})`;
     52    attribute_test(
     53      loader, new URL(path, ORIGIN),
     54      entry => {
     55        assert_equals(entry.responseStatus, status,
     56          `response status for ${entry.name} should be ${status}`);
     57      }
     58    );
     59  }
     60 }
     61 
     62 // Response status is exposed for CORS requests for cross-origin resources.
     63 for(const loader of [
     64  load.image_with_attrs,
     65  load.script_with_attrs,
     66  load.stylesheet_with_attrs
     67 ]) {
     68  for(const status of status_codes) {
     69    const path = `/resource-timing/resources/empty.js?pipe=status(${status})`
     70      + `|header(access-control-allow-origin, ${ORIGIN})`;
     71    loader_with_crossOrigin_attr = async url => {
     72      return loader(url, {"crossOrigin": "anonymous"});
     73    }
     74    attribute_test(
     75      loader_with_crossOrigin_attr, new URL(path, REMOTE_ORIGIN),
     76      entry => {
     77        assert_equals(entry.responseStatus, status,
     78          `response status for ${entry.name} should be ${status}`);
     79      }
     80    );
     81  }
     82 }
     83 
     84 // Response status is 0 when a no-cors request is made for cross origin
     85 // fonts, images, scripts, stylesheets.
     86 // Response status is 0 when request's mode is "navigate" and response's
     87 // URL's origin is not same origin with request's origin. So response
     88 // status is not exposed for cross origin iframes.
     89 for(const loader of [
     90  load.font,
     91  load.image,
     92  load.script,
     93  load.stylesheet,
     94  load.iframe,
     95  load_image_object,
     96  load_frame_object,
     97  load_null_object
     98 ]) {
     99  for(const tao of [false, true]) {
    100    for(const status of status_codes) {
    101      let path = (loader == load.font) ? '/fonts/pass.woff' :
    102                                         '/resource-timing/resources/empty.js';
    103      path += `?pipe=status(${status})`;
    104      if (tao) {
    105        path += `|header(timing-allow-origin, *)`;
    106      }
    107      attribute_test(
    108        loader, new URL(path, REMOTE_ORIGIN),
    109        entry => {
    110          assert_equals(entry.responseStatus, 0,
    111            `response status for ${entry.name} should be 0`);
    112        }
    113      );
    114    }
    115  }
    116 }
    117 
    118 // Response status for iframes is 0 when cross origin redirects are present
    119 // Same-Origin => Cross-Origin => Same-Origin => Same-Origin redirect chain
    120 for(const loader of [
    121  load.iframe,
    122  load_frame_object,
    123  load_null_object
    124 ]) {
    125  for(const status of status_codes) {
    126    const destUrl =
    127      `${SAME_ORIGIN}/resource-timing/resources/multi_redirect.py` +
    128        `?page_origin=${SAME_ORIGIN}` +
    129        `&cross_origin=${REMOTE_ORIGIN}` +
    130        `&final_resource=` +
    131        `/resource-timing/resources/empty.js?pipe=status(${status})`;
    132    attribute_test(
    133      loader, new URL(destUrl),
    134      entry => {
    135        assert_equals(entry.responseStatus, 0,
    136          `response status should be 0 for iframes having cross origin`
    137          + ` redirects`);
    138      }
    139    );
    140  }
    141 }
    142 
    143 // Response status for iframes is exposed for same origin redirects
    144 for(const loader of [
    145  load.iframe,
    146  load_frame_object,
    147  load_null_object
    148 ]) {
    149  for(const status of status_codes) {
    150    const destUrl = `${SAME_ORIGIN}/resource-timing/resources/redirect-cors.py`
    151      + `?location=${SAME_ORIGIN}/resource-timing/resources/empty.js`
    152      + `?pipe=status(${status})`;
    153    attribute_test(
    154      loader, new URL(destUrl),
    155      entry => {
    156        assert_equals(entry.responseStatus, status,
    157          `response status should be exposed for iframes having only same`
    158          + ` origin redirects`);
    159      }
    160    );
    161  }
    162 };
    163 </script>
    164 </body>
    165 </html>