|
1 | | -The web-platform-tests Project |
2 | | -============================== |
3 | | - |
4 | | -[](https://community-tc.services.mozilla.com/api/github/v1/repository/web-platform-tests/wpt/master/latest) [](https://github.com/web-platform-tests/wpt/actions?query=workflow%3Adocumentation+branch%3Amaster) [](https://github.com/web-platform-tests/wpt/actions?query=workflow%3Amanifest+branch%3Amaster) [](https://pyup.io/repos/github/web-platform-tests/wpt/) |
5 | | - |
6 | | -The web-platform-tests Project is a cross-browser test suite for the |
7 | | -Web-platform stack. Writing tests in a way that allows them to be run in all |
8 | | -browsers gives browser projects confidence that they are shipping software that |
9 | | -is compatible with other implementations, and that later implementations will |
10 | | -be compatible with their implementations. This in turn gives Web |
11 | | -authors/developers confidence that they can actually rely on the Web platform |
12 | | -to deliver on the promise of working across browsers and devices without |
13 | | -needing extra layers of abstraction to paper over the gaps left by |
14 | | -specification editors and implementors. |
15 | | - |
16 | | -The most important sources of information and activity are: |
17 | | - |
18 | | -- [github.com/web-platform-tests/wpt](https://github.com/web-platform-tests/wpt): |
19 | | - the canonical location of the project's source code revision history and the |
20 | | - discussion forum for changes to the code |
21 | | -- [web-platform-tests.org](https://web-platform-tests.org): the documentation |
22 | | - website; details how to set up the project, how to write tests, how to give |
23 | | - and receive peer review, how to serve as an administrator, and more |
24 | | -- [wpt.live](https://wpt.live): a public deployment of the test suite, |
25 | | - allowing anyone to run the tests by visiting from an |
26 | | - Internet-enabled browser of their choice |
27 | | -- [wpt.fyi](https://wpt.fyi): an archive of test results collected from an |
28 | | - array of web browsers on a regular basis |
29 | | -- [Real-time chat room](https://app.element.io/#/room/#wpt:matrix.org): the |
30 | | - `wpt:matrix.org` matrix channel; includes participants located |
31 | | - around the world, but busiest during the European working day. |
32 | | -- [Mailing list](https://lists.w3.org/Archives/Public/public-test-infra/): a |
33 | | - public and low-traffic discussion list |
34 | | -- [RFCs](https://github.com/web-platform-tests/rfcs): a repo for requesting |
35 | | - comments on substantial changes that would impact other stakeholders or |
36 | | - users; people who work on WPT infra are encouraged to watch the repo. |
37 | | - |
38 | | -**If you'd like clarification about anything**, don't hesitate to ask in the |
39 | | -chat room or on the mailing list. |
40 | | - |
41 | | -Setting Up the Repo |
42 | | -=================== |
43 | | - |
44 | | -Clone or otherwise get https://github.com/web-platform-tests/wpt. |
45 | | - |
46 | | -Note: because of the frequent creation and deletion of branches in this |
47 | | -repo, it is recommended to "prune" stale branches when fetching updates, |
48 | | -i.e. use `git pull --prune` (or `git fetch -p && git merge`). |
49 | | - |
50 | | -Running the Tests |
51 | | -================= |
52 | | - |
53 | | -See the [documentation website](https://web-platform-tests.org/running-tests/) |
54 | | -and in particular the |
55 | | -[system setup for running tests locally](https://web-platform-tests.org/running-tests/from-local-system.html#system-setup). |
56 | | - |
57 | | -Command Line Tools |
58 | | -================== |
59 | | - |
60 | | -The `wpt` command provides a frontend to a variety of tools for |
61 | | -working with and running web-platform-tests. Some of the most useful |
62 | | -commands are: |
63 | | - |
64 | | -* `wpt serve` - For starting the wpt http server |
65 | | -* `wpt run` - For running tests in a browser |
66 | | -* `wpt lint` - For running the lint against all tests |
67 | | -* `wpt manifest` - For updating or generating a `MANIFEST.json` test manifest |
68 | | -* `wpt install` - For installing the latest release of a browser or |
69 | | - webdriver server on the local machine. |
70 | | -* `wpt serve-wave` - For starting the wpt http server and the WAVE test runner. |
71 | | -For more details on how to use the WAVE test runner see the [documentation](./tools/wave/docs/usage/usage.md). |
72 | | - |
73 | | -<span id="windows-notes">Windows Notes</span> |
74 | | -============================================= |
75 | | - |
76 | | -On Windows `wpt` commands must be prefixed with `python` or the path |
77 | | -to the python binary (if `python` is not in your `%PATH%`). |
78 | | - |
79 | | -```bash |
80 | | -python wpt [command] |
81 | | -``` |
82 | | - |
83 | | -Alternatively, you may also use |
84 | | -[Bash on Ubuntu on Windows](https://msdn.microsoft.com/en-us/commandline/wsl/about) |
85 | | -in the Windows 10 Anniversary Update build, then access your windows |
86 | | -partition from there to launch `wpt` commands. |
87 | | - |
88 | | -Please make sure git and your text editor do not automatically convert |
89 | | -line endings, as it will cause lint errors. For git, please set |
90 | | -`git config core.autocrlf false` in your working tree. |
91 | | - |
92 | | -Publication |
93 | | -=========== |
94 | | - |
95 | | -The master branch is automatically synced to [wpt.live](https://wpt.live/) and |
96 | | -[w3c-test.org](https://w3c-test.org/). |
97 | | - |
98 | | -Contributing |
99 | | -============ |
100 | | - |
101 | | -Save the Web, Write Some Tests! |
102 | | - |
103 | | -Absolutely everyone is welcome to contribute to test development. No |
104 | | -test is too small or too simple, especially if it corresponds to |
105 | | -something for which you've noted an interoperability bug in a browser. |
106 | | - |
107 | | -The way to contribute is just as usual: |
108 | | - |
109 | | -* Fork this repository (and make sure you're still relatively in sync |
110 | | - with it if you forked a while ago). |
111 | | -* Create a branch for your changes: |
112 | | - `git checkout -b topic`. |
113 | | -* Make your changes. |
114 | | -* Run `./wpt lint` as described above. |
115 | | -* Commit locally and push that to your repo. |
116 | | -* Create a pull request based on the above. |
117 | | - |
118 | | -Issues with web-platform-tests |
119 | | ------------------------------- |
120 | | - |
121 | | -If you spot an issue with a test and are not comfortable providing a |
122 | | -pull request per above to fix it, please |
123 | | -[file a new issue](https://github.com/web-platform-tests/wpt/issues/new). |
124 | | -Thank you! |
| 1 | +# Head(ers) Up! Detecting Security Header Inconsistencies in Browsers |
| 2 | + |
| 3 | +This repository contains all code for our paper `Head(ers) Up! Detecting Security Header Inconsistencies in Browsers`. |
| 4 | + |
| 5 | +This repository is a fork of [WPT](https://github.com/web-platform-tests/wpt), the original README can be found [here](./README_original.md). |
| 6 | +All test and analysis code for our paper can be found in the `_hp` directory. |
| 7 | +Our modified version of the wptserve HTTP server implementation can be found in `tools/serve` and `tools/wptserve`. All other directories are untouched and required for `wptserve` to run, we removed the other WPT test directories for better clarity. |
| 8 | + |
| 9 | +## Setup |
| 10 | + |
| 11 | +## Run Instructions |
| 12 | + |
| 13 | +## Additional Information |
| 14 | + |
| 15 | + |
| 16 | + |
| 17 | +- Setup: |
| 18 | + - Create a fresh Ubuntu22 container/VM: `lxc launch ubuntu:22.04 <name>` and connect to it `lxc exec <name> bash` |
| 19 | + - Switch to the ubuntu user: `su - ubuntu` |
| 20 | + - Clone this repository: `[email protected]:header-testing/header-testing.git` |
| 21 | + - Run the setup file: `cd wpt/_hp`, `./setup.bash` (reopen all terminals or run `source ~/.bashrc` afterwards) |
| 22 | + - Configure DB settings in [config.json](config.json) |
| 23 | + - Setup the database: `cd _hp/tools && poetry run python models.py` |
| 24 | + - Setup certs: either remove `.demo` from the files in `_hp/tools/certs/` to use self-signed certs or add the real certs there |
| 25 | +- Run: |
| 26 | + - Start the WPT Server (from the top-most folder): `poetry run -C _hp python wpt serve --config _hp/wpt-config.json` |
| 27 | + - Automatic: Start the testrunners, e.g., `poetry run desktop_selenium.py` |
| 28 | + - Manual: Visit http://sub.headers.websec.saarland:80/_hp/tests/framing.sub.html (HTTPS: 443) |
| 29 | +- TODOs: |
| 30 | + - analyse results! |
| 31 | + - discover differences in browsers/versions |
| 32 | + - "explain" reasons (keep in mind that other features such as blocked mixed content and CORB might be responsible for differences and not different parsing of the security header) |
| 33 | + - ... |
| 34 | +- Inventory (of _hp): |
| 35 | + - wpt-config.json: Ports, Domains, Certs, ... (Subdomains currently hardcoded in tools/serve/serve.py) |
| 36 | + - common/: Shared non-js files for the tests (images, html, ...) |
| 37 | + - resources/: Shared javascript files for the tests (testharness, save_results, ...) |
| 38 | + - server/ |
| 39 | + - responses.py: Serves the correct responses from the db (responses.py?resp_id=<int>&feature_group=<str>) |
| 40 | + - store_results.py: Stores the test results in the db (expects JSON with {tests: [...], browser=browser_id}) |
| 41 | + - tests/ |
| 42 | + - One file for each feature group to test |
| 43 | + - Create one testcase for everything one wants to test |
| 44 | + - Then run these for all corresponding responses and relevant origin configurations |
| 45 | + - How to provide parameters to the tests |
| 46 | + - http://sub.headers.websec.saarland:80/_hp/tests/framing.sub.html?browser=<browser_id>&first_id=<id>&last_id=<id> |
| 47 | + - tools/ |
| 48 | + - Non web files |
| 49 | + - config.json: DB connection and co. |
| 50 | + - crawler/ The code for the crawlers that visit the tests |
| 51 | + - models.py: Defines the database models (results, responses, ...); creates dummy data if run directly |
| 52 | + - create_responses.py: create two responses for each feature group: "deny" and "allow" for testing the tests |
| 53 | +- The only other relevant files are: |
| 54 | + - tools/serve/...: Config to run WPT |
| 55 | + - tools/wptserve/...: The WPT server |
| 56 | + - Some of the tests to take inspirations e.g., x-frame-options/... |
0 commit comments