Skip to content

Commit 0b9fc07

Browse files
Mirko Brodessermoz-wptsync-bot
Mirko Brodesser
authored and
moz-wptsync-bot
committed
add WPTs for javascript: URL navigations which check the order of the parent CSP and child CSP.
This isn't specified yet, see the comments in <to-javascript-parent-initiated-check-csp-order.html>. Differential Revision: https://phabricator.services.mozilla.com/D229010 bugzilla-url: https://bugzilla.mozilla.org/show_bug.cgi?id=1933142 gecko-commit: ef3240476ac544bb76056721e39f7889b70c4e59 gecko-reviewers: tschuster
1 parent 6fa3fe8 commit 0b9fc07

File tree

3 files changed

+105
-6
lines changed

3 files changed

+105
-6
lines changed

‎content-security-policy/navigation/support/utils.js

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,3 +31,9 @@ function assignJavascriptURLToInjectionSink(testCase) {
3131
element[testCase.navigationFunction]();
3232
}
3333
}
34+
35+
function encodeURIWithApostrophes(uriWithApostrophes) {
36+
const encodedURI = encodeURI(uriWithApostrophes);
37+
// https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding
38+
return encodedURI.replaceAll("'","%27");
39+
}

‎content-security-policy/navigation/to-javascript-parent-initiated-check-csp-order.html

Lines changed: 99 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
<!DOCTYPE html>
2+
<html>
3+
<head>
4+
<meta http-equiv="content-security-policy" content="script-src 'self' 'nonce-abc'">
5+
<meta charset="utf-8">
6+
<script src="/resources/testharness.js"></script>
7+
<script src="/resources/testharnessreport.js"></script>
8+
<script src="support/utils.js"></script>
9+
</head>
10+
<body>
11+
<iframe id="iframeWithScriptSrcNone"></iframe>
12+
<a id="anchorWithTargetScriptSrcNone" target="iframeWithScriptSrcNone">a</a>
13+
<a id="anchorWithTargetOtherTabWithScriptSrcNone" target="otherTabWithScriptSrcNone">a2</a>
14+
<map name="m">
15+
<area target="iframeWithScriptScrcNone" id="areaWithTargetIframeWithScriptSrcNone" shape="default">
16+
<area target="otherTabWithScriptSrcNone" id="areaWithTargetOtherTabWithScriptSrcNone" shape="default">
17+
</map>
18+
<img usemap="#m" alt="i">
19+
20+
<script nonce="abc">
21+
// Since another tab is opened, this test suite needs to explicitly signal
22+
// when it's done. Otherwise, the tests which wait for the tab to finish
23+
// loading aren't executed. See,
24+
// https://web-platform-tests.org/writing-tests/testharness-api.html#determining-when-all-tests-are-complete.
25+
setup({explicit_done: true});
26+
27+
const kEncodedURLOfPageWithScriptSrcNone = encodeURIWithApostrophes(
28+
"support/frame-with-csp.sub.html" + "?csp=script-src 'none'");
29+
30+
document.getElementById("iframeWithScriptSrcNone").src =
31+
kEncodedURLOfPageWithScriptSrcNone;
32+
33+
window.addEventListener("load", () => {
34+
const otherTabWithScriptSrcNone = window.open(
35+
kEncodedURLOfPageWithScriptSrcNone, "otherTabWithScriptSrcNone");
36+
37+
otherTabWithScriptSrcNone.addEventListener("load", () => {
38+
const kTestCases = [
39+
{ elementId: "iframeWithScriptSrcNone",
40+
propertySequence: ["contentWindow", "location", "href"],
41+
},
42+
{ elementId: "iframeWithScriptSrcNone",
43+
propertySequence: ["src"],
44+
},
45+
{ elementId: "anchorWithTargetScriptSrcNone",
46+
propertySequence: ["href"],
47+
navigationFunction: "click",
48+
},
49+
{ elementId: "anchorWithTargetOtherTabWithScriptSrcNone",
50+
propertySequence: ["href"],
51+
navigationFunction: "click",
52+
},
53+
{ elementId: "areaWithTargetIframeWithScriptSrcNone",
54+
propertySequence: ["href"],
55+
navigationFunction: "click",
56+
},
57+
{ elementId: "areaWithTargetOtherTabWithScriptSrcNone",
58+
propertySequence: ["href"],
59+
navigationFunction: "click",
60+
},
61+
{ targetWindow: otherTabWithScriptSrcNone,
62+
propertySequence: ["location", "href"],
63+
},
64+
];
65+
66+
for (testCase of kTestCases) {
67+
const injectionSinkDescription = determineInjectionSinkDescription(testCase);
68+
69+
promise_test(t => new Promise(resolve => {
70+
window.addEventListener("securitypolicyviolation", resolve,
71+
{ once: true });
72+
73+
window.addEventListener("message",
74+
t.unreached_func("Should not have received a message"),
75+
{ once: true }
76+
);
77+
assignJavascriptURLToInjectionSink(testCase);
78+
}).then(e => {
79+
assert_equals(e.blockedURI, "inline");
80+
assert_equals(e.effectiveDirective, "script-src-elem");
81+
82+
// Chrome and Firefox currently check the parent's CSP first, hence
83+
// asserting it below. A comparison with WebKit was impossible due to
84+
// https://github.com/web-platform-tests/wpt/issues/49262.
85+
// The behavior should be specified; see
86+
// https://github.com/whatwg/html/issues/4651#issuecomment-495060149 and
87+
// the encompassing ticket.
88+
assert_equals(e.originalPolicy, "script-src 'self' 'nonce-abc'",
89+
"Parent's policy is checked first");
90+
}), `Executing the javascript URL should violate the parent's CSP for
91+
${injectionSinkDescription}`);
92+
}
93+
94+
done();
95+
});
96+
});
97+
</script>
98+
</body>
99+
</html>

‎content-security-policy/navigation/to-javascript-parent-initiated-child-csp.html

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,6 @@
2222
// https://web-platform-tests.org/writing-tests/testharness-api.html#determining-when-all-tests-are-complete.
2323
setup({explicit_done: true});
2424

25-
function encodeURIWithApostrophes(uriWithApostrophes) {
26-
const encodedURI = encodeURI(uriWithApostrophes);
27-
// https://developer.mozilla.org/en-US/docs/Glossary/Percent-encoding
28-
return encodedURI.replaceAll("'","%27");
29-
}
30-
3125
const kIframeURLPath = "support/frame-with-csp.sub.html";
3226

3327
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/Sources#unsafe-inline

0 commit comments

Comments
 (0)