Skip to content

Commit 53f7340

Browse files
youennffoolip
youennf
authored and
foolip
committed
Fetch: Cross-Origin-Resource-Policy tests
For whatwg/fetch#733. WebKit export of https://bugs.webkit.org/show_bug.cgi?id=185840.
1 parent 04a0711 commit 53f7340

File tree

13 files changed

+365
-0
lines changed

13 files changed

+365
-0
lines changed

‎common/get-host-info.sub.js

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ function get_host_info() {
66
var ORIGINAL_HOST = '{{host}}';
77
var REMOTE_HOST = (ORIGINAL_HOST === 'localhost') ? '127.0.0.1' : ('www1.' + ORIGINAL_HOST);
88
var OTHER_HOST = '{{domains[www2]}}';
9+
var NOTSAMESITE_HOST = (ORIGINAL_HOST === 'localhost') ? '127.0.0.1' : ('not-' + ORIGINAL_HOST);
910

1011
return {
1112
HTTP_PORT: HTTP_PORT,
@@ -19,6 +20,7 @@ function get_host_info() {
1920
HTTPS_ORIGIN_WITH_CREDS: 'https://foo:bar@' + ORIGINAL_HOST + ':' + HTTPS_PORT,
2021
HTTP_ORIGIN_WITH_DIFFERENT_PORT: 'http://' + ORIGINAL_HOST + ':' + HTTP_PORT2,
2122
HTTP_REMOTE_ORIGIN: 'http://' + REMOTE_HOST + ':' + HTTP_PORT,
23+
HTTP_NOTSAMESITE_ORIGIN: 'http://' + NOTSAMESITE_HOST + ':' + HTTP_PORT,
2224
HTTP_REMOTE_ORIGIN_WITH_DIFFERENT_PORT: 'http://' + REMOTE_HOST + ':' + HTTP_PORT2,
2325
HTTPS_REMOTE_ORIGIN: 'https://' + REMOTE_HOST + ':' + HTTPS_PORT,
2426
HTTPS_REMOTE_ORIGIN_WITH_CREDS: 'https://foo:bar@' + REMOTE_HOST + ':' + HTTPS_PORT,

‎fetch/cross-origin-resource-policy/fetch-in-iframe.html

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
<script src="/common/get-host-info.sub.js"></script>
7+
</head>
8+
<body>
9+
<script>
10+
const host = get_host_info();
11+
const remoteBaseURL = host.HTTP_REMOTE_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
12+
const notSameSiteBaseURL = host.HTTP_NOTSAMESITE_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
13+
const localBaseURL = host.HTTP_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
14+
15+
function with_iframe(url)
16+
{
17+
return new Promise(function(resolve) {
18+
var frame = document.createElement('iframe');
19+
frame.src = url;
20+
frame.onload = function() { resolve(frame); };
21+
document.body.appendChild(frame);
22+
});
23+
}
24+
25+
function loadIFrameAndFetch(iframeURL, fetchURL, expectedFetchResult, title)
26+
{
27+
promise_test(async () => {
28+
const frame = await with_iframe(iframeURL);
29+
let receiveMessage;
30+
const promise = new Promise((resolve, reject) => {
31+
receiveMessage = (event) => {
32+
if (event.data !== expectedFetchResult) {
33+
reject("Received unexpected message " + event.data);
34+
return;
35+
}
36+
resolve();
37+
}
38+
window.addEventListener("message", receiveMessage, false);
39+
});
40+
frame.contentWindow.postMessage(fetchURL, "*");
41+
return promise.finally(() => {
42+
frame.remove();
43+
window.removeEventListener("message", receiveMessage, false);
44+
});
45+
}, title);
46+
}
47+
48+
// This above data URL should be equivalent to resources/iframeFetch.html
49+
var dataIFrameURL = "data:text/html;base64,PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgIDxzY3JpcHQ+CiAgICAgICAgZnVuY3Rpb24gcHJvY2Vzc01lc3NhZ2UoZXZlbnQpCiAgICAgICAgewogICAgICAgICAgICBmZXRjaChldmVudC5kYXRhLCB7IG1vZGU6ICJuby1jb3JzIiB9KS50aGVuKCgpID0+IHsKICAgICAgICAgICAgICAgIHBhcmVudC5wb3N0TWVzc2FnZSgib2siLCAiKiIpOwogICAgICAgICAgICB9LCAoKSA9PiB7CiAgICAgICAgICAgICAgICBwYXJlbnQucG9zdE1lc3NhZ2UoImtvIiwgIioiKTsKICAgICAgICAgICAgfSk7CiAgICAgICAgfQogICAgICAgIHdpbmRvdy5hZGRFdmVudExpc3RlbmVyKCJtZXNzYWdlIiwgcHJvY2Vzc01lc3NhZ2UsIGZhbHNlKTsKICAgIDwvc2NyaXB0Pgo8L2hlYWQ+Cjxib2R5PgogICAgPGgzPlRoZSBpZnJhbWUgbWFraW5nIGEgc2FtZSBvcmlnaW4gZmV0Y2ggY2FsbC48L2gzPgo8L2JvZHk+CjwvaHRtbD4K";
50+
51+
loadIFrameAndFetch(dataIFrameURL, localBaseURL + "resources/hello.py?corp=same-origin", "ko",
52+
"Cross-origin fetch in a data: iframe load fails if the server blocks cross-origin loads with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
53+
54+
loadIFrameAndFetch(dataIFrameURL, localBaseURL + "resources/hello.py?corp=same-site", "ko",
55+
"Cross-origin fetch in a data: iframe load fails if the server blocks cross-origin loads with a 'Cross-Origin-Resource-Policy: same-site' response header.");
56+
57+
loadIFrameAndFetch(remoteBaseURL + "resources/iframeFetch.html", localBaseURL + "resources/hello.py?corp=same-origin", "ko",
58+
"Cross-origin fetch in a cross origin iframe load fails if the server blocks cross-origin loads with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
59+
60+
loadIFrameAndFetch(notSameSiteBaseURL + "resources/iframeFetch.html", localBaseURL + "resources/hello.py?corp=same-site", "ko",
61+
"Cross-origin fetch in a cross origin iframe load fails if the server blocks cross-origin loads with a 'Cross-Origin-Resource-Policy: same-site' response header.");
62+
63+
loadIFrameAndFetch(remoteBaseURL + "resources/iframeFetch.html", remoteBaseURL + "resources/hello.py?corp=same-origin", "ok",
64+
"Same-origin fetch in a cross origin iframe load succeeds if the server blocks cross-origin loads with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
65+
</script>
66+
</body>
67+
</html>

‎fetch/cross-origin-resource-policy/fetch.html

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
<script src="/common/get-host-info.sub.js"></script>
7+
</head>
8+
<body>
9+
<script>
10+
const host = get_host_info();
11+
const localBaseURL = host.HTTP_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
12+
const sameSiteBaseURL = "http://" + host.ORIGINAL_HOST + ":" + host.HTTP_PORT2 + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
13+
const notSameSiteBaseURL = host.HTTP_NOTSAMESITE_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
14+
const httpsBaseURL = host.HTTPS_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
15+
16+
promise_test(async () => {
17+
const response = await fetch("./resources/hello.py?corp=same-origin");
18+
assert_equals(await response.text(), "hello");
19+
}, "Same-origin fetch with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
20+
21+
promise_test(async () => {
22+
const response = await fetch("./resources/hello.py?corp=same-site");
23+
assert_equals(await response.text(), "hello");
24+
}, "Same-origin fetch with a 'Cross-Origin-Resource-Policy: same-site' response header.");
25+
26+
promise_test(async (test) => {
27+
const response = await fetch(notSameSiteBaseURL + "resources/hello.py?corp=same-origin");
28+
assert_equals(await response.text(), "hello");
29+
}, "Cross-origin cors fetch with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
30+
31+
promise_test(async (test) => {
32+
const response = await fetch(notSameSiteBaseURL + "resources/hello.py?corp=same-site");
33+
assert_equals(await response.text(), "hello");
34+
}, "Cross-origin cors fetch with a 'Cross-Origin-Resource-Policy: same-site' response header.");
35+
36+
promise_test((test) => {
37+
const remoteURL = notSameSiteBaseURL + "resources/hello.py?corp=same-origin";
38+
return promise_rejects(test, new TypeError, fetch(remoteURL, { mode : "no-cors" }));
39+
}, "Cross-origin no-cors fetch with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
40+
41+
promise_test((test) => {
42+
const remoteURL = notSameSiteBaseURL + "resources/hello.py?corp=same-site";
43+
return promise_rejects(test, new TypeError, fetch(remoteURL, { mode: "no-cors" }));
44+
}, "Cross-origin no-cors fetch with a 'Cross-Origin-Resource-Policy: same-site' response header.");
45+
46+
promise_test((test) => {
47+
const remoteURL = httpsBaseURL + "resources/hello.py?corp=same-site";
48+
return fetch(remoteURL, { mode: "no-cors" });
49+
}, "Cross-origin no-cors fetch to a same-site URL with a 'Cross-Origin-Resource-Policy: same-site' response header.");
50+
51+
promise_test((test) => {
52+
const remoteURL = httpsBaseURL + "resources/hello.py?corp=same-origin";
53+
return promise_rejects(test, new TypeError, fetch(remoteURL, { mode : "no-cors" }));
54+
}, "Cross-origin no-cors fetch to a same-site URL with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
55+
56+
promise_test(async (test) => {
57+
const remoteSameSiteURL = sameSiteBaseURL + "resources/hello.py?corp=same-site";
58+
59+
await fetch(remoteSameSiteURL, { mode: "no-cors" });
60+
61+
return promise_rejects(test, new TypeError, fetch(sameSiteBaseURL + "resources/hello.py?corp=same-origin", { mode: "no-cors" }));
62+
}, "Valid cross-origin no-cors fetch with a 'Cross-Origin-Resource-Policy: same-site' response header.");
63+
64+
promise_test((test) => {
65+
const finalURL = notSameSiteBaseURL + "resources/hello.py?corp=same-origin";
66+
return promise_rejects(test, new TypeError, fetch("resources/redirect.py?redirectTo=" + encodeURIComponent(finalURL), { mode: "no-cors" }));
67+
}, "Cross-origin no-cors fetch with a 'Cross-Origin-Resource-Policy: same-origin' response header after a redirection.");
68+
69+
promise_test((test) => {
70+
const finalURL = localBaseURL + "resources/hello.py?corp=same-origin";
71+
return fetch(notSameSiteBaseURL + "resources/redirect.py?redirectTo=" + encodeURIComponent(finalURL), { mode: "no-cors" });
72+
}, "Cross-origin no-cors fetch with a 'Cross-Origin-Resource-Policy: same-origin' response header after a cross-origin redirection.");
73+
74+
promise_test(async (test) => {
75+
const finalURL = localBaseURL + "resources/hello.py?corp=same-origin";
76+
77+
await fetch(finalURL, { mode: "no-cors" });
78+
79+
return promise_rejects(test, new TypeError, fetch(notSameSiteBaseURL + "resources/redirect.py?corp=same-origin&redirectTo=" + encodeURIComponent(finalURL), { mode: "no-cors" }));
80+
}, "Cross-origin no-cors fetch with a 'Cross-Origin-Resource-Policy: same-origin' redirect response header.");
81+
</script>
82+
</body>
83+
</html>

‎fetch/cross-origin-resource-policy/iframe-loads.html

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
<script src="/common/get-host-info.sub.js"></script>
7+
</head>
8+
<body>
9+
<script>
10+
const host = get_host_info();
11+
const remoteBaseURL = host.HTTP_REMOTE_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
12+
const localBaseURL = host.HTTP_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
13+
14+
function with_iframe(url) {
15+
return new Promise(function(resolve) {
16+
var frame = document.createElement('iframe');
17+
frame.src = url;
18+
frame.onload = function() { resolve(frame); };
19+
document.body.appendChild(frame);
20+
});
21+
}
22+
23+
promise_test(async() => {
24+
const url = remoteBaseURL + "resources/iframe.py?corp=same-origin";
25+
26+
await new Promise((resolve, reject) => {
27+
return fetch(url, { mode: "no-cors" }).then(reject, resolve);
28+
});
29+
30+
const iframe = await with_iframe(url);
31+
return new Promise((resolve, reject) => {
32+
window.addEventListener("message", (event) => {
33+
if (event.data !== "pong") {
34+
reject(event.data);
35+
return;
36+
}
37+
resolve();
38+
}, false);
39+
iframe.contentWindow.postMessage("ping", "*");
40+
}).finally(() => {
41+
iframe.remove();
42+
});
43+
}, "Load an iframe that has Cross-Origin-Resource-Policy header");
44+
</script>
45+
</body>
46+
</html>

‎fetch/cross-origin-resource-policy/image-loads.html

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
<script src="/common/get-host-info.sub.js"></script>
7+
</head>
8+
<body>
9+
<div id="testDiv"></div>
10+
<script>
11+
const host = get_host_info();
12+
const notSameSiteBaseURL = host.HTTP_NOTSAMESITE_ORIGIN + window.location.pathname.replace(/\/[^\/]*$/, '/') ;
13+
const ok = true;
14+
const ko = false;
15+
const noCors = false;
16+
17+
function loadImage(url, shoudLoad, corsMode, title)
18+
{
19+
promise_test(() => {
20+
const img = new Image();
21+
if (corsMode)
22+
img.crossOrigin = corsMode;
23+
img.src = url;
24+
return new Promise((resolve, reject) => {
25+
img.onload = shoudLoad ? resolve : reject;
26+
img.onerror = shoudLoad ? reject : resolve;
27+
testDiv.appendChild(img);
28+
}).finally(() => {
29+
testDiv.innerHTML = "";
30+
});
31+
}, title);
32+
}
33+
34+
loadImage("./resources/image.py?corp=same-origin", ok, noCors,
35+
"Same-origin image load with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
36+
37+
loadImage("./resources/image.py?corp=same-site", ok, noCors,
38+
"Same-origin image load with a 'Cross-Origin-Resource-Policy: same-site' response header.");
39+
40+
loadImage(notSameSiteBaseURL + "resources/image.py?corp=same-origin&acao=*", ok, "anonymous",
41+
"Cross-origin cors image load with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
42+
43+
loadImage(notSameSiteBaseURL + "resources/image.py?corp=same-site&acao=*", ok, "anonymous",
44+
"Cross-origin cors image load with a 'Cross-Origin-Resource-Policy: same-site' response header.");
45+
46+
loadImage(notSameSiteBaseURL + "resources/image.py?corp=same-origin&acao=*", ko, noCors,
47+
"Cross-origin no-cors image load with a 'Cross-Origin-Resource-Policy: same-origin' response header.");
48+
49+
loadImage(notSameSiteBaseURL + "resources/image.py?corp=same-site&acao=*", ko, noCors,
50+
"Cross-origin no-cors image load with a 'Cross-Origin-Resource-Policy: same-site' response header.");
51+
</script>
52+
</body>
53+
</html>

‎fetch/cross-origin-resource-policy/resources/green.png

87 Bytes
Loading

‎fetch/cross-origin-resource-policy/resources/hello.py

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
def main(request, response):
2+
headers = [("Cross-Origin-Resource-Policy", request.GET['corp'])]
3+
if 'origin' in request.headers:
4+
headers.append(('Access-Control-Allow-Origin', request.headers['origin']))
5+
6+
return 200, headers, "hello"

‎fetch/cross-origin-resource-policy/resources/iframe.py

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
def main(request, response):
2+
headers = [("Content-Type", "text/html"),
3+
("Cross-Origin-Resource-Policy", request.GET['corp'])]
4+
return 200, headers, "<body><h3>The iframe</h3><script>window.onmessage = () => { parent.postMessage('pong', '*'); }</script></body>"
5+

‎fetch/cross-origin-resource-policy/resources/iframeFetch.html

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<script>
5+
function processMessage(event)
6+
{
7+
fetch(event.data, { mode: "no-cors" }).then(() => {
8+
parent.postMessage("ok", "*");
9+
}, () => {
10+
parent.postMessage("ko", "*");
11+
});
12+
}
13+
window.addEventListener("message", processMessage, false);
14+
</script>
15+
</head>
16+
<body>
17+
<h3>The iframe making a same origin fetch call.</h3>
18+
</body>
19+
</html>

‎fetch/cross-origin-resource-policy/resources/image.py

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
import os.path
2+
3+
def main(request, response):
4+
type = request.GET.first("type", None)
5+
6+
body = open(os.path.join(os.path.dirname(__file__), "green.png"), "rb").read()
7+
8+
response.add_required_headers = False
9+
response.writer.write_status(200)
10+
11+
if 'corp' in request.GET:
12+
response.writer.write_header("cross-origin-resource-policy", request.GET['corp'])
13+
if 'acao' in request.GET:
14+
response.writer.write_header("access-control-allow-origin", request.GET['acao'])
15+
response.writer.write_header("content-length", len(body))
16+
if(type != None):
17+
response.writer.write_header("content-type", type)
18+
response.writer.end_headers()
19+
20+
response.writer.write(body)
21+

0 commit comments

Comments
 (0)