Skip to content

Commit 3208411

Browse files
author
hp23 Server
committed
XCTO test + basic responses
1 parent 4a77e4c commit 3208411

File tree

5 files changed

+102
-0
lines changed

5 files changed

+102
-0
lines changed

‎_hp/common/script-xcto.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
window.parent.postMessage({ "id": "<replace-id>", "message": "message send" }, "*");

‎_hp/server/responses.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ def get_body(feature_group, resp):
5050
file = open("_hp/common/frame-img-csp.html", "rb")
5151
elif feature_group in ["coep"]:
5252
file = open("_hp/common/frame-coep.html", "rb")
53+
elif feature_group in ["xcto"]:
54+
file = open("_hp/common/script-xcto.js", "rb")
5355
else:
5456
print(f"Invalid feature_group: {feature_group}")
5557
return ""
@@ -69,4 +71,6 @@ def main(request, response):
6971
response.raw_header = []
7072
# Get the correct response body based on the current test/feature group
7173
file = get_body(params['feature_group'], resp=resp)
74+
if params['feature_group'] == "xcto":
75+
file = file.replace(b"<replace-id>", bytes(params['count'], encoding="utf-8"))
7276
return response.status_code, response.raw_header, file

‎_hp/tests/script-execution-xcto.sub.html‎

Lines changed: 73 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
<!DOCTYPE html>
2+
<html lang="en">
3+
4+
<head>
5+
<meta charset="UTF-8">
6+
<meta http-equiv="X-UA-Compatible" content="IE=edge">
7+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
8+
<title>Script execution XCTO Tests</title>
9+
<script src="/_hp/resources/testharness.sub.js"></script>
10+
<script src="/_hp/resources/store_results.sub.js"></script>
11+
</head>
12+
13+
<body>
14+
15+
</body>
16+
17+
18+
<script>
19+
let resp_type = urlParams.get("resp_type") || "debug";
20+
var count = 0;
21+
function script_sniffing_test(element, sandbox, test_info, url, origin, response_id) {
22+
/*
23+
url: str, URL to be tested (next in the framing chain)
24+
origin: str, Origin of the URL to be tested
25+
response_id: int, ID of the response element (final response of the chain)
26+
element: str, iframe/object/embed
27+
sandbox: bool whether to add the sandbox attribute to the next frame
28+
test_info: str, additional information about the test (direct, sandbox, nested (A->B->A->A))
29+
*/
30+
test_name = `sniffing_${element}|${sandbox}|${test_info}|${origin}|${response_id}`;
31+
//console.log(url, response_id, test_name);
32+
async_test(t => {
33+
t.set_test_info(url, test_info);
34+
const i = document.createElement(element);
35+
count = count + 1;
36+
i.id = count;
37+
let origin = location.origin;
38+
let resp = 1;
39+
let nest = 0;
40+
let final_url = url + response_id + `&count=${i.id}&nest=${nest}&origin=${origin}&element=${element}&resp=${resp}`
41+
i.src = final_url;
42+
43+
// Wait for 90% of test_timeout; then report that no message was received!
44+
let timer = t.step_timeout(() => {
45+
t.report_outcome("message timeout");
46+
t.done();
47+
}, 0.9 * test_timeout);
48+
// Report that a message was received
49+
waitForMessageFrom(i, t).then(t.step_func_done(e => {
50+
clearTimeout(timer);
51+
t.report_outcome(e.data.message);
52+
}));
53+
// Cleanup function (remove the frame after the test)
54+
t.add_cleanup(() => {
55+
i.remove();
56+
});
57+
// Start the test
58+
document.body.append(i);
59+
}, test_name);
60+
}
61+
62+
// A -> B (XCTO): send message
63+
const simple_sniffing = script_sniffing_test.bind(null, 'script', false, "direct");
64+
simple_sniffing.element_relation = "script_direct";
65+
let test_declarations;
66+
test_declarations = [simple_sniffing];
67+
const path = '/_hp/server/responses.py?feature_group=xcto&resp_id=';
68+
const label = 'XCTO';
69+
run_tests(test_declarations, path, label);
70+
71+
</script>
72+
73+
</html>

‎_hp/tests/script-execution-xcto.sub.html.headers‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
Content-Type: text/html; charset=utf-8
2+
Cache-Control: max-age=3600

‎_hp/tools/create_responses.py‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -414,3 +414,25 @@ def create_responses(header_list, label, status_code=200, resp_type="debug"):
414414

415415

416416
#endregion
417+
418+
#region MIMESniffing XCTO
419+
label = "XCTO"
420+
header_name = "X-Content-Type-Options" # https://fetch.spec.whatwg.org/#x-content-type-options-header
421+
header_deny = [(header_name, "nosniff")]
422+
header_allow = [(header_name, "*")]
423+
# Debug tests
424+
create_responses([header_deny, header_allow], label)
425+
# Basic tests
426+
header_list = [[(header_name, "nosniff")], [],
427+
[(header_name, "null")], [(header_name, origin_s)],
428+
[(header_name, origin)], [(header_name, parent)],
429+
[(header_name, home)], [(header_name, origin_sp)],
430+
[(header_name, site)],
431+
[(header_name, "*"), (header_name, "nosniff")], [(header_name, origin_s), (header_name, "null")]
432+
]
433+
434+
create_responses(header_list, label, resp_type="basic")
435+
# Some basic headers with redirect
436+
header_list = [[(header_name, "*"), redirect_empty], [(header_name, "no-sniff"), redirect_empty]]
437+
create_responses(header_list, label, status_code=302, resp_type="basic")
438+
#endregion

0 commit comments

Comments
 (0)