Skip to content

Commit 1b64fcb

Browse files
fred-wangfred-wang
committed
Bug 1968383 - Add more Trusted Type tests for HTML/SVG script enforcements. r=smaug
Differential Revision: https://phabricator.services.mozilla.com/D251094
1 parent f7bd814 commit 1b64fcb

14 files changed

+2000
-0
lines changed

‎testing/web-platform/meta/trusted-types/script-enforcement-001-outerHTML.xhtml.ini

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[script-enforcement-001-outerHTML.xhtml]
2+
[Script source set via TrustedHTML sink Element.outerHTML drops trustworthiness.]
3+
expected: FAIL

‎testing/web-platform/meta/trusted-types/script-enforcement-001.html.ini

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
[script-enforcement-001.html]
2+
[Script source set via TrustedHTML sink Element.innerHTML drops trustworthiness.]
3+
expected: FAIL
4+
5+
[Script source set via TrustedHTML sink Element.setHTMLUnsafe() drops trustworthiness.]
6+
expected: FAIL
7+
8+
[Script source set via Node.nodeValue drops trustworthiness.]
9+
expected: FAIL
10+
11+
[Setting script source via CharacterData.data drops trustworthiness.]
12+
expected: FAIL
13+
14+
[Setting script source via CharacterData.appendData() drops trustworthiness.]
15+
expected: FAIL
16+
17+
[Setting script source via CharacterData.insertData() drops trustworthiness.]
18+
expected: FAIL
19+
20+
[Setting script source via CharacterData.replaceData() drops trustworthiness.]
21+
expected: FAIL
22+
23+
[Setting script source via CharacterData.deleteData() drops trustworthiness.]
24+
expected: FAIL
25+
26+
[Setting script source via CharacterData.before() drops trustworthiness.]
27+
expected: FAIL
28+
29+
[Setting script source via CharacterData.after() drops trustworthiness.]
30+
expected: FAIL
31+
32+
[Setting script source via CharacterData.remove() drops trustworthiness.]
33+
expected: FAIL
34+
35+
[Setting script source via CharacterData.replaceWith() drops trustworthiness.]
36+
expected: FAIL
37+
38+
[Setting script source via Node.appendChild() drops trustworthiness.]
39+
expected: FAIL
40+
41+
[Setting script source via Node.insertBefore() drops trustworthiness.]
42+
expected: FAIL
43+
44+
[Setting script source via Node.replaceChild() drops trustworthiness.]
45+
expected: FAIL
46+
47+
[Setting script source via Node.removeChild() drops trustworthiness.]
48+
expected: FAIL
49+
50+
[Setting script source via Element.prepend() drops trustworthiness.]
51+
expected: FAIL
52+
53+
[Setting script source via Element.append() drops trustworthiness.]
54+
expected: FAIL
55+
56+
[Setting script source via Element.replaceChildren() drops trustworthiness.]
57+
expected: FAIL
58+
59+
[Setting script source via Element.moveBefore() drops trustworthiness.]
60+
expected: FAIL
61+
62+
[Setting script source via TrustedHTML sink Node.insertAdjacentHTML() drops trustworthiness.]
63+
expected: FAIL
64+
65+
[Setting script source via Node.insertAdjacentText() drops trustworthiness.]
66+
expected: FAIL
67+
68+
[Setting script source via Range.insertNode() drops trustworthiness.]
69+
expected: FAIL
70+
71+
[Setting script source via Range.deleteContents() drops trustworthiness.]
72+
expected: FAIL
73+
74+
[Cloning a script via Node.cloneNode() drops trustworthiness.]
75+
expected: FAIL
76+
77+
[Cloning a script via Range.cloneContents() drops trustworthiness.]
78+
expected: FAIL

‎testing/web-platform/meta/trusted-types/script-enforcement-002-outerHTML.xhtml.ini

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
[script-enforcement-002-outerHTML.xhtml]
2+
[Default policy's calls when setting script source via Element.outerHTML.]
3+
expected: FAIL

‎testing/web-platform/meta/trusted-types/script-enforcement-002.html.ini

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
[script-enforcement-002.html]
2+
[Default policy's calls when setting script source via Element.innerHTML.]
3+
expected: FAIL
4+
5+
[Default policy's calls when setting script source via Element.setHTMLUnsafe().]
6+
expected: FAIL
7+
8+
[Default policy's calls when setting script source via Node.nodeValue.]
9+
expected: FAIL
10+
11+
[Default policy's calls when setting script source via CharacterData.data.]
12+
expected: FAIL
13+
14+
[Default policy's calls when setting script source via CharacterData.appendData().]
15+
expected: FAIL
16+
17+
[Default policy's calls when setting script source via CharacterData.insertData().]
18+
expected: FAIL
19+
20+
[Default policy's calls when setting script source via CharacterData.replaceData().]
21+
expected: FAIL
22+
23+
[Default policy's calls when setting script source via CharacterData.deleteData().]
24+
expected: FAIL
25+
26+
[Default policy's calls when setting script source via CharacterData.before().]
27+
expected: FAIL
28+
29+
[Default policy's calls when setting script source via CharacterData.after().]
30+
expected: FAIL
31+
32+
[Default policy's calls when setting script source via CharacterData.remove().]
33+
expected: FAIL
34+
35+
[Default policy's calls when setting script source via CharacterData.replaceWith().]
36+
expected: FAIL
37+
38+
[Default policy's calls when setting script source via Node.appendChild().]
39+
expected: FAIL
40+
41+
[Default policy's calls when setting script source via Node.insertBefore().]
42+
expected: FAIL
43+
44+
[Default policy's calls when setting script source via Node.replaceChild().]
45+
expected: FAIL
46+
47+
[Default policy's calls when setting script source via Node.removeChild().]
48+
expected: FAIL
49+
50+
[Default policy's calls when setting script source via Element.prepend().]
51+
expected: FAIL
52+
53+
[Default policy's calls when setting script source via Element.append().]
54+
expected: FAIL
55+
56+
[Default policy's calls when setting script source via Element.replaceChildren().]
57+
expected: FAIL
58+
59+
[Default policy's calls when setting script source via Element.moveBefore().]
60+
expected: FAIL
61+
62+
[Default policy's calls when setting script source via Node.insertAdjacentText().]
63+
expected: FAIL
64+
65+
[Default policy's calls when setting script source via Node.insertAdjacentHTML().]
66+
expected: FAIL
67+
68+
[Default policy's calls when setting source via Range.insertNode().]
69+
expected: FAIL
70+
71+
[Default policy's calls when setting script source via Range.deleteContents().]
72+
expected: FAIL
73+
74+
[Default policy's calls when cloning a script via Node.cloneNode().]
75+
expected: FAIL
76+
77+
[Default policy's calls when cloning a script via Range.cloneContents().]
78+
expected: FAIL

‎testing/web-platform/meta/trusted-types/script-enforcement-003.html.ini

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
[script-enforcement-003.html]
2+
[Script source set via Element.textContent drops trustworthiness.]
3+
expected: FAIL
4+
5+
[Script source set via TrustedHTML sink Element.innerHTML drops trustworthiness.]
6+
expected: FAIL
7+
8+
[Script source set via TrustedHTML sink Element.outerHTML drops trustworthiness.]
9+
expected: FAIL
10+
11+
[Script source set via TrustedHTML sink Element.setHTMLUnsafe() drops trustworthiness.]
12+
expected: FAIL
13+
14+
[Script source set via Node.nodeValue drops trustworthiness.]
15+
expected: FAIL
16+
17+
[Setting script source via CharacterData.data drops trustworthiness.]
18+
expected: FAIL
19+
20+
[Setting script source via CharacterData.appendData() drops trustworthiness.]
21+
expected: FAIL
22+
23+
[Setting script source via CharacterData.insertData() drops trustworthiness.]
24+
expected: FAIL
25+
26+
[Setting script source via CharacterData.replaceData() drops trustworthiness.]
27+
expected: FAIL
28+
29+
[Setting script source via CharacterData.deleteData() drops trustworthiness.]
30+
expected: FAIL
31+
32+
[Setting script source via CharacterData.before() drops trustworthiness.]
33+
expected: FAIL
34+
35+
[Setting script source via CharacterData.after() drops trustworthiness.]
36+
expected: FAIL
37+
38+
[Setting script source via CharacterData.remove() drops trustworthiness.]
39+
expected: FAIL
40+
41+
[Setting script source via CharacterData.replaceWith() drops trustworthiness.]
42+
expected: FAIL
43+
44+
[Setting script source via Node.appendChild() drops trustworthiness.]
45+
expected: FAIL
46+
47+
[Setting script source via Node.insertBefore() drops trustworthiness.]
48+
expected: FAIL
49+
50+
[Setting script source via Node.replaceChild() drops trustworthiness.]
51+
expected: FAIL
52+
53+
[Setting script source via Node.removeChild() drops trustworthiness.]
54+
expected: FAIL
55+
56+
[Setting script source via Element.prepend() drops trustworthiness.]
57+
expected: FAIL
58+
59+
[Setting script source via Element.append() drops trustworthiness.]
60+
expected: FAIL
61+
62+
[Setting script source via Element.replaceChildren() drops trustworthiness.]
63+
expected: FAIL
64+
65+
[Setting script source via ElementmoveBefore() drops trustworthiness.]
66+
expected: FAIL
67+
68+
[Setting script source via TrustedHTML sink Node.insertAdjacentHTML() drops trustworthiness.]
69+
expected: FAIL
70+
71+
[Setting script source via Node.insertAdjacentText() drops trustworthiness.]
72+
expected: FAIL
73+
74+
[Setting script source via Range.insertNode() drops trustworthiness.]
75+
expected: FAIL
76+
77+
[Setting script source via Range.deleteContents() drops trustworthiness.]
78+
expected: FAIL
79+
80+
[Cloning a script via Node.cloneNode() drops trustworthiness.]
81+
expected: FAIL
82+
83+
[Cloning a script via Range.cloneContents() drops trustworthiness.]
84+
expected: FAIL

‎testing/web-platform/meta/trusted-types/script-enforcement-004.html.ini

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
[script-enforcement-004.html]
2+
[Default policy's calls when setting script source via SVGScriptElement.textContent.]
3+
expected: FAIL
4+
5+
[Default policy's calls when setting script source via Element.innerHTML.]
6+
expected: FAIL
7+
8+
[Default policy's calls when setting script source via Element.outerHTML.]
9+
expected: FAIL
10+
11+
[Default policy's calls when setting script source via Element.setHTMLUnsafe().]
12+
expected: FAIL
13+
14+
[Default policy's calls when setting script source via Node.nodeValue.]
15+
expected: FAIL
16+
17+
[Default policy's calls when setting script source via CharacterData.data.]
18+
expected: FAIL
19+
20+
[Default policy's calls when setting script source via CharacterData.appendData().]
21+
expected: FAIL
22+
23+
[Default policy's calls when setting script source via CharacterData.insertData().]
24+
expected: FAIL
25+
26+
[Default policy's calls when setting script source via CharacterData.replaceData().]
27+
expected: FAIL
28+
29+
[Default policy's calls when setting script source via CharacterData.deleteData().]
30+
expected: FAIL
31+
32+
[Default policy's calls when setting script source via CharacterData.before().]
33+
expected: FAIL
34+
35+
[Default policy's calls when setting script source via CharacterData.after().]
36+
expected: FAIL
37+
38+
[Default policy's calls when setting script source via CharacterData.remove().]
39+
expected: FAIL
40+
41+
[Default policy's calls when setting script source via CharacterData.replaceWith().]
42+
expected: FAIL
43+
44+
[Default policy's calls when setting script source via Node.appendChild().]
45+
expected: FAIL
46+
47+
[Default policy's calls when setting script source via Node.insertBefore().]
48+
expected: FAIL
49+
50+
[Default policy's calls when setting script source via Node.replaceChild().]
51+
expected: FAIL
52+
53+
[Default policy's calls when setting script source via Node.removeChild().]
54+
expected: FAIL
55+
56+
[Default policy's calls when setting script source via Element.prepend().]
57+
expected: FAIL
58+
59+
[Default policy's calls when setting script source via Element.append().]
60+
expected: FAIL
61+
62+
[Default policy's calls when setting script source via Element.replaceChildren().]
63+
expected: FAIL
64+
65+
[Default policy's calls when setting script source via Element.moveBefore().]
66+
expected: FAIL
67+
68+
[Default policy's calls when setting script source via Node.insertAdjacentText().]
69+
expected: FAIL
70+
71+
[Default policy's calls when setting script source via Node.insertAdjacentHTML().]
72+
expected: FAIL
73+
74+
[Default policy's calls when setting source via Range.insertNode().]
75+
expected: FAIL
76+
77+
[Default policy's calls when setting script source via Range.deleteContents().]
78+
expected: FAIL
79+
80+
[Default policy's calls when cloning a script via Node.cloneNode().]
81+
expected: FAIL
82+
83+
[Default policy's calls when cloning a script via Range.cloneContents().]
84+
expected: FAIL

‎testing/web-platform/tests/trusted-types/script-enforcement-001-outerHTML.xhtml

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
2+
<html xmlns="http://www.w3.org/1999/xhtml">
3+
<head>
4+
<script src="/resources/testharness.js"></script>
5+
<script src="/resources/testharnessreport.js"></script>
6+
<script src="support/namespaces.js"></script>
7+
<script src="support/passthroughpolicy.js"></script>
8+
<script src="support/script-messages.js"></script>
9+
<link rel="help" href="https://w3c.github.io/trusted-types/dist/spec/#enforcement-in-scripts"/>
10+
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script';"/>
11+
</head>
12+
<body>
13+
<!--- See script-enforcement-001.html an explanation of this test.
14+
The HTML parser won't create a child element for the span child of
15+
scriptForOuterHTMLTest below, so we instead rely on the XHTML parser. -->
16+
<div>
17+
<script id="scriptForOuterHTMLTest" type="unknown"><span></span></script>
18+
</div>
19+
<div id="container"></div>
20+
<script>
21+
promise_test(async t => {
22+
await promise_rejects_js(t, TypeError, script_messages_for(_ => {
23+
document.createElement("script").outerHTML = LOG_RUN_MESSAGE;
24+
}), "TrustedHTML required.");
25+
await no_script_message_for(_ => {
26+
let script = document.getElementById("scriptForOuterHTMLTest");
27+
script.remove();
28+
script.removeAttribute("type");
29+
script.firstElementChild.outerHTML = passthroughpolicy.createHTML(LOG_RUN_MESSAGE);
30+
document.getElementById("container").appendChild(script);
31+
});
32+
}, "Script source set via TrustedHTML sink Element.outerHTML drops trustworthiness.");
33+
</script>
34+
</body>
35+
</html>

0 commit comments

Comments
 (0)