Changeset 263605 in webkit


Ignore:
Timestamp:
Jun 26, 2020 4:58:27 PM (4 years ago)
Author:
Chris Dumez
Message:

Update web-platform-tests/content-security-policy from upstream
​https://bugs.webkit.org/show_bug.cgi?id=213664

Reviewed by Darin Adler.

Update web-platform-tests/content-security-policy from upstream b076c305a256e7fb7.

LayoutTests/imported/w3c:

  • resources/resource-files.json:
  • web-platform-tests/content-security-policy/*: Updated.

LayoutTests:

  • tests-options.json:
Location:
trunk/LayoutTests
Files:
24 added
60 edited
1 copied
16 moved

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r263601 r263605  
     12020-06-26  Chris Dumez  <cdumez@apple.com>
     2
     3        Update web-platform-tests/content-security-policy from upstream
     4        https://bugs.webkit.org/show_bug.cgi?id=213664
     5
     6        Reviewed by Darin Adler.
     7
     8        Update web-platform-tests/content-security-policy from upstream b076c305a256e7fb7.
     9
     10        * tests-options.json:
     11
    1122020-06-26  Jer Noble  <jer.noble@apple.com>
    213

  • trunk/LayoutTests/TestExpectations

    r263594 r263605  
    750750imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_eval.html
    751751imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_new_function.html
    752 imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_discard_whitelist.html
    753752imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_different_nonce.html
    754 imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_whitelist.sub.html
    755753imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_report_only.html
    756754imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_eval.html
    … …  
    781779imported/w3c/web-platform-tests/content-security-policy/worker-src/shared-worker-src-script-fallback.sub.html
    782780imported/w3c/web-platform-tests/content-security-policy/worker-src/shared-worker-src-self-fallback.sub.html
     781
     782# Sometimes logs a line about trying to connect to an external URL.
     783imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document.sub.html [ Pass Failure ]
    783784
    784785# Web platform test infrastructure unable to support insecure connection

  • trunk/LayoutTests/imported/w3c/ChangeLog

    r263598 r263605  
     12020-06-26  Chris Dumez  <cdumez@apple.com>
     2
     3        Update web-platform-tests/content-security-policy from upstream
     4        https://bugs.webkit.org/show_bug.cgi?id=213664
     5
     6        Reviewed by Darin Adler.
     7
     8        Update web-platform-tests/content-security-policy from upstream b076c305a256e7fb7.
     9
     10        * resources/resource-files.json:
     11        * web-platform-tests/content-security-policy/*: Updated.
     12
    1132020-06-26  Chris Dumez  <cdumez@apple.com>
    214

  • trunk/LayoutTests/imported/w3c/resources/resource-files.json

    r262539 r263605  
    6161        "web-platform-tests/beacon/navigate.iFrame.sub.html",
    6262        "web-platform-tests/content-security-policy/README.html",
     63        "web-platform-tests/content-security-policy/embedded-enforcement/support/executor.html",
    6364        "web-platform-tests/content-security-policy/form-action/support/post-message-to-opener.sub.html",
    6465        "web-platform-tests/content-security-policy/form-action/support/post-message-to-parent.sub.html",
    … …  
    7273        "web-platform-tests/content-security-policy/generic/support/log-pass.html",
    7374        "web-platform-tests/content-security-policy/generic/support/sandboxed-eval.sub.html",
     75        "web-platform-tests/content-security-policy/inheritance/support/empty.html",
    7476        "web-platform-tests/content-security-policy/inheritance/support/navigate-self-to-blob.html",
    7577        "web-platform-tests/content-security-policy/inheritance/support/srcdoc-child-frame.html",

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/allow_csp_from-header.html

    r246330 r263605  
    4646        "expected": IframeLoad.EXPECT_BLOCK,
    4747        "blockedURI": null},
    48       { "name": "iframe from cross origin does not load without Allow-CSP-From header.",
     48      { "name": "Cross origin iframe with correct Allow-CSP-From header is allowed.",
    4949        "origin": Host.CROSS_ORIGIN,
    5050        "csp": "style-src 'unsafe-inline'; script-src 'unsafe-inline'",
    … …  
    5858        "expected": IframeLoad.EXPECT_BLOCK,
    5959        "blockedURI": null},
    60       { "name": "Allow-CSP-From header with a star value can be returned.",
     60      { "name": "Allow-CSP-From header with a star value allows cross origin frame.",
    6161        "origin": Host.CROSS_ORIGIN,
    6262        "csp": "script-src 'unsafe-inline'",

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/required_csp-header.html

    r246330 r263605  
    22<html>
    33<head>
    4 <title>Embedded Enforcement: Sec-Required-CSP header.</title>
     4  <title>Embedded Enforcement: Sec-Required-CSP header.</title>
     5  <!--
     6    This test is creating and navigating >=70 iframes. This can exceed the
     7    "short" timeout". See https://crbug.com/818324
     8  -->
     9  <meta name="timeout" content="long">
     10
    511  <script src="/resources/testharness.js"></script>
    612  <script src="/resources/testharnessreport.js"></script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/subsumption_algorithm-general.html

    r246330 r263605  
    99<body>
    1010  <script>
     11    // Note that the returned csp should always allow execution of an
     12    // inline script with nonce "abc" (as returned by
     13    // support/echo-policy-multiple.py), otherwise the test might
     14    // return false negatives.
    1115    var tests = [
    1216      { "name": "If there is no required csp, iframe should load.",
    … …  
    2832      { "name": "Iframe with less restricting CSP should be blocked.",
    2933        "required_csp": "style-src 'none'; script-src 'none'",
    30         "returned_csp": "style-src 'none'; script-src 'self'",
     34        "returned_csp": "style-src 'none'; script-src 'self' 'nonce-abc'",
    3135        "expected": IframeLoad.EXPECT_BLOCK },
    3236      { "name": "Iframe with a different CSP should be blocked.",

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/subsumption_algorithm-nonces.html

    r246330 r263605  
    1111    var tests = [
    1212      { "name": "Exact nonce subsumes.",
    13         "required_csp": "script-src 'nonce-abc'",
    14         "returned_csp_1": "script-src 'nonce-abc'",
     13        "required_csp": "style-src 'nonce-abc'",
     14        "returned_csp_1": "style-src 'nonce-abc'",
    1515        "expected": IframeLoad.EXPECT_LOAD },
    1616      { "name": "Any nonce subsumes.",
    … …  
    1919        "expected": IframeLoad.EXPECT_LOAD },
    2020      { "name": "A nonce has to be returned if required by the embedder.",
    21         "required_csp": "script-src 'nonce-abc'",
    22         "returned_csp_1": "script-src http://example1.com/foo",
     21        "required_csp": "style-src 'nonce-abc'",
     22        "returned_csp_1": "style-src http://example1.com/foo",
    2323        "expected": IframeLoad.EXPECT_BLOCK },
    2424      { "name": "Multiples nonces returned subsume.",
    … …  
    2828      // nonce intersection
    2929      { "name": "Nonce intersection is still done on exact match - non-matching nonces.",
    30         "required_csp": "script-src 'nonce-abc'",
    31         "returned_csp_1": "script-src 'nonce-def'",
    32         "returned_csp_2": "script-src 'nonce-xyz'",
    33         "expected": IframeLoad.EXPECT_BLOCK },
     30        "required_csp": "style-src 'none'",
     31        "returned_csp_1": "style-src 'nonce-def'",
     32        "returned_csp_2": "style-src 'nonce-xyz'",
     33        "expected": IframeLoad.EXPECT_LOAD },
    3434      { "name": "Nonce intersection is still done on exact match - matching nonces.",
    35         "required_csp": "style-src 'nonce-abc'",
     35        "required_csp": "style-src 'none'",
    3636        "returned_csp_1": "style-src 'nonce-def'",
    3737        "returned_csp_2": "style-src 'nonce-def' 'nonce-xyz'",
    38         "expected": IframeLoad.EXPECT_LOAD },
     38        "expected": IframeLoad.EXPECT_BLOCK },
    3939      // other expressions still have to work
    4040      { "name": "Other expressions still have to be subsumed - positive test.",
    … …  
    4343        "expected": IframeLoad.EXPECT_LOAD },
    4444      { "name": "Other expressions still have to be subsumed - negative test",
    45         "required_csp": "script-src http://example1.com/foo/ 'nonce-abc'",
    46         "returned_csp_1": "script-src http://not-example1.com/foo/ 'nonce-xyz'",
     45        "required_csp": "style-src http://example1.com/foo/ 'nonce-abc'",
     46        "returned_csp_1": "style-src http://not-example1.com/foo/ 'nonce-xyz'",
    4747        "expected": IframeLoad.EXPECT_BLOCK },
    4848    ];

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/subsumption_algorithm-strict_dynamic.html

    r246330 r263605  
    1010  <script>
    1111    var tests = [
     12      // Note that the returned csp should always allow execution of an
     13      // inline script with nonce "abc" (as returned by
     14      // support/echo-policy-multiple.py), otherwise the test might
     15      // return false negatives.
    1216      { "name": "'strict-dynamic' is ineffective for `style-src`.",
    1317        "required_csp": "style-src http://example1.com/foo/ 'self'",
    … …  
    2832      { "name": "'strict-dynamic' is effective only for `script-src`.",
    2933        "required_csp": "script-src http://example1.com/foo/ 'self'",
    30         "returned_csp_1": "script-src 'strict-dynamic' http://example1.com/foo/bar.html",
     34        "returned_csp_1": "script-src 'strict-dynamic' http://example1.com/foo/bar.html 'nonce-abc'",
    3135        "expected": IframeLoad.EXPECT_BLOCK },
    32       { "name": "'strict-dynamic' is proper handled for finding effective policy.",
     36      { "name": "'strict-dynamic' is properly handled for finding effective policy.",
    3337        "required_csp": "script-src http://example1.com/foo/ 'self'",
    34         "returned_csp_1": "script-src 'strict-dynamic' http://example1.com/foo/bar.html",
     38        "returned_csp_1": "script-src 'strict-dynamic' http://example1.com/foo/bar.html 'nonce-abc'",
    3539        "returned_csp_2": "script-src 'strict-dynamic' 'nonce-abc'",
    3640        "expected": IframeLoad.EXPECT_BLOCK },

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/subsumption_algorithm-unsafe_inline.html

    r246330 r263605  
    7070        "returned_csp_2": null,
    7171        "expected": IframeLoad.EXPECT_BLOCK },
    72       { "name": "Returned csp whitelists a nonce.",
     72      { "name": "Returned csp allows a nonce.",
    7373        "required_csp": "style-src http://example1.com/foo/ 'self' 'unsafe-inline'",
    7474        "returned_csp_1": "style-src 'unsafe-inline' 'nonce-abc'",
    7575        "returned_csp_2": "style-src 'nonce-abc'",
    7676        "expected": IframeLoad.EXPECT_BLOCK },
    77       { "name": "Returned csp whitelists a hash.",
     77      { "name": "Returned csp allows a hash.",
    7878        "required_csp": "style-src http://example1.com/foo/ 'self' 'unsafe-inline'",
    7979        "returned_csp_1": "style-src 'unsafe-inline' 'sha256-abc123'",

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/support/testharness-helper.sub.js

    r246330 r263605  
    130130        assert_equals(loaded[urlId], undefined);
    131131      }), 500);
    132       assert_throws("SecurityError", () => {
     132      assert_throws_dom("SecurityError", () => {
    133133        var x = i.contentWindow.location.href;
    134134      });

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/support/w3c-import.log

    r246330 r263605  
    1818/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/support/echo-policy-multiple.py
    1919/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/support/echo-required-csp.py
     20/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/support/executor.html
    2021/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/support/testharness-helper.sub.js

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/w3c-import.log

    r246330 r263605  
    1616List of files:
    1717/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/allow_csp_from-header.html
     18/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/blocked-iframe-are-cross-origin.html
    1819/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/idlharness.window.js
    1920/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/iframe-csp-attribute.html

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-ancestors/frame-ancestors-from-serviceworker.https.html

    r254133 r263605  
    1818        // Load iframe.
    1919        var iframe = document.createElement("iframe");
    20         function iframeLoaded(ev) {
     20        let timer;
     21        function pollForLoadCompletion() {
     22          timer = t.step_timeout(() => iframeMayBeLoaded({isPoll: true}), 10);
     23        }
     24        function iframeMayBeLoaded({isPoll}) {
    2125          var failed = false;
     26          clearTimeout(timer);
    2227          try {
    23             ev.target.contentWindow.location.href;
     28            let href = iframe.contentWindow.location.href;
     29            if (isPoll && (href === "about:blank" || iframe.contentDocument.readyState !== "complete")) {
     30              pollForLoadCompletion();
     31              return;
     32            }
    2433            failed = true;
    2534          } catch (ex) {}
    2635          t.step_func_done(() => assert_false(failed, "The IFrame should have been blocked. It wasn't."))();
    2736        };
    28         iframe.addEventListener("load", iframeLoaded);
    29         iframe.addEventListener("error", iframeLoaded);
     37        iframe.addEventListener("load", () => iframeMayBeLoaded({isPoll: false}));
     38        iframe.addEventListener("error", () => iframeMayBeLoaded({isPoll: false}));
    3039        iframe.src = "/content-security-policy/frame-ancestors/support/service-worker/frame-ancestors-none.html";
    3140        document.body.appendChild(iframe);
     41        pollForLoadCompletion();
    3242      });
    3343  </script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-ancestors/frame-ancestors-overrides-xfo.html

    r246330 r263605  
    1919            var i = document.createElement('iframe');
    2020            i.src = "support/frame-ancestors-and-x-frame-options.sub.html?policy=other-origin.com&xfo=SAMEORIGIN";
    21             i.onload = t.step_func_done(function () {
     21            checkDone = t.step_func(function() {
     22                clearTimeout(timer);
     23                try {
     24                    if (i.contentWindow.location.href === "about:blank" ||
     25                        (i.contentDocument && i.contentDocument.readyState !== "complete")) {
     26                        timer = t.step_timeout(checkDone, 10);
     27                        return;
     28                    }
     29                } catch(e) {}
    2230                assert_equals(i.contentDocument, null);
     31                t.done();
    2332            });
     33            i.onload = checkDone;
     34            let timer = t.step_timeout(checkDone, 10);
    2435            document.body.appendChild(i);
    2536        }, "A 'frame-ancestors' CSP directive overrides an 'x-frame-options' header which would allow the page.");

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-ancestors/support/frame-ancestors-test.sub.js

    r254133 r263605  
    4848}
    4949
     50let timer;
     51function pollForLoadCompletion({iframe, expectBlock}) {
     52    let fn = iframeLoaded({expectBlock, isPoll: true});
     53    timer = test.step_timeout(() => fn({target: iframe}), 10);
     54}
     55
    5056function injectIFrame(policy, sameOrigin, expectBlock) {
    5157    var iframe = document.createElement("iframe");
    52     iframe.addEventListener("load", iframeLoaded(expectBlock));
    53     iframe.addEventListener("error", iframeLoaded(expectBlock));
     58    iframe.addEventListener("load", iframeLoaded({expectBlock, isPoll: false}));
     59    iframe.addEventListener("error", iframeLoaded({expectBlock, isPoll: false}));
    5460
    5561    var url = "/content-security-policy/frame-ancestors/support/frame-ancestors.sub.html?policy=" + policy;
    … …  
    6167    iframe.src = url;
    6268    document.body.appendChild(iframe);
     69    pollForLoadCompletion({iframe, expectBlock});
    6370}
    6471
    65 function iframeLoaded(expectBlock) {
     72function iframeLoaded({isPoll, expectBlock}) {
    6673    return function(ev) {
     74        clearTimeout(timer);
    6775        var failed = true;
    6876        var message = "";
    6977        try {
    70             ev.target.contentWindow.location.href;
     78            let url = ev.target.contentWindow.location.href;
     79            if (isPoll && (url === "about:blank" || ev.target.contentDocument.readyState !== "complete")) {
     80                pollForLoadCompletion({iframe: ev.target, expectBlock});
     81                return;
     82            }
    7183            if (expectBlock) {
    7284                message = "The IFrame should have been blocked (or cross-origin). It wasn't.";

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document-meta.sub.html

    r263601 r263605  
    1010        iframe.name = "theiframe";
    1111        iframe.src =
    12           "http://www1.{{host}}/content-security-policy/support/frame.html#0";
    13         let iframeLoaded = new Promise(resolve => { iframe.onload = resolve; });
     12          "http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/frame-src/support/frame.html?0";
     13        let iframeLoaded = new Promise(resolve => { iframe.onload = resolve });
    1414        document.body.appendChild(iframe);
    1515        await iframeLoaded;
    … …  
    2727      {
    2828        let violation = new Promise(resolve => {
    29           window.addEventListener('securitypolicyviolation', resolve);
     29          window.addEventListener('securitypolicyviolation', () => resolve());
    3030        });
    3131        iframe.src =
    32           "http://www1.{{host}}/content-security-policy/support/frame.html#1";
     32          "http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/frame-src/support/frame.html?1";
    3333        await violation;
    3434      }
    … …  
    4040        });
    4141        window.open(
    42           "http://www1.{{host}}/content-security-policy/support/frame.html#2",
     42          "http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/frame-src/support/frame.html?2",
    4343          "theiframe");
    4444        await violation;

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document.sub.html

    r263601 r263605  
    55<script>
    66    let crossOriginUrl =
    7       "http://www1.{{host}}/content-security-policy/support/frame.html";
     7      "http://www1.{{host}}:{{ports[http][0]}}/content-security-policy/support/frame.html";
    88
    99    async_test(async test => {

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/w3c-import.log

    r254133 r263605  
    2222/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-redirect.html
    2323/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-redirect.html.headers
    24 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document-meta.html
    25 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document.html
     24/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document-meta.sub.html
    2625/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document.html.headers
     26/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document.sub.html
    2727/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-self-unique-origin.html

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/generic/eval-typecheck-callout-order.tentative.html

    r246330 r263605  
    1111    <script nonce='abc'>
    1212    test(function() {
    13       assert_throws(new EvalError, function() {
     13      assert_throws_js(EvalError, function() {
    1414        eval("0");
    1515      }, "eval of a string should reach host callout");

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/iframe-all-local-schemes.sub-expected.txt

    r246330 r263605  
    44PASS <iframe src='blob:...'>'s inherits policy.
    55PASS <iframe src='data:...'>'s inherits policy.
    6 PASS <iframe src='javascript:...'>'s inherits policy.
     6PASS <iframe src='javascript:...'>'s inherits policy (static <img> is blocked)
     7PASS <iframe src='javascript:...'>'s inherits policy (dynamically inserted <img> is blocked)
    78PASS <iframe sandbox src='blob:...'>'s inherits policy. (opaque origin sandbox)
    89

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/iframe-all-local-schemes.sub.html

    r246330 r263605  
    8181
    8282    document.body.appendChild(i);
    83   }, "<iframe src='javascript:...'>'s inherits policy.");
     83  }, "<iframe src='javascript:...'>'s inherits policy (static <img> is blocked)");
     84
     85  // Same as the previous javascript-URL test, but instead of loading the <img>
     86  // from the new document, this one is created from the initial empty document,
     87  // while evaluating the javascript-url.
     88  // See https://crbug.com/1064676
     89  async_test(t => {
     90    let url = `javascript:
     91      let img = document.createElement('img');
     92      img.onload = () => window.top.postMessage('load', '*');
     93      img.onerror = () => window.top.postMessage('error', '*');
     94      img.src = '{{location[server]}}/images/red-16x16.png';
     95      document.body.appendChild(img);
     96    `;
     97    var i = document.createElement('iframe');
     98    i.src = encodeURI(url.replace(/\n/g, ""));
     99    wait_for_error_from_frame(i, t);
     100
     101    document.body.appendChild(i);
     102  }, "<iframe src='javascript:...'>'s inherits policy (dynamically inserted <img> is blocked)");
    84103
    85104  async_test(t => {

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/w3c-import.log

    r246330 r263605  
    1515------------------------------------------------------------------------
    1616List of files:
     17/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/empty.html
    1718/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/navigate-self-to-blob.html
    1819/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/support/navigate-self-to-blob.html.sub.headers

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/w3c-import.log

    r246330 r263605  
    1818/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/blob-url-in-main-window-self-navigate-inherits.sub.html
    1919/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/document-write-iframe.html
     20/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/frame-src-javascript-url.html
    2021/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/iframe-all-local-schemes-inherit-self.sub.html
    2122/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/iframe-all-local-schemes.sub.html

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inheritance/window.html

    r246330 r263605  
    2424    img.onerror = t.step_func_done(_ => w.close());
    2525    img.onload = t.unreached_func();
     26    img.src = "/images/red-16x16.png";
    2627    w.document.body.appendChild(img);
    27     img.src = "/images/red-16x16.png";
    2828  }, "window.open() inherits policy.");
    2929

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inside-worker/support/connect-src-self.sub.js

    r254133 r263605  
    5555
    5656  // TODO(mkwst): A 'securitypolicyviolation' event should fire.
    57   return promise_rejects(t, new TypeError, fetch(url));
     57  return promise_rejects_js(t, TypeError, fetch(url));
    5858}, "Same-origin => cross-origin 'fetch()' in " + self.location.protocol + self.location.search);
    5959

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/inside-worker/support/script-src-self.sub.js

    r254133 r263605  
    44test(t => {
    55  self.a = false;
    6   assert_throws("NetworkError",
    7                 _ => importScripts("http://{{hosts[alt][]}}:{{ports[http][1]}}/content-security-policy/support/var-a.js"),
    8                 "importScripts should throw `NetworkError`");
     6  assert_throws_dom("NetworkError",
     7                    _ => importScripts("http://{{hosts[alt][]}}:{{ports[http][1]}}/content-security-policy/support/var-a.js"),
     8                    "importScripts should throw `NetworkError`");
    99  assert_false(self.a);
    1010}, "Cross-origin `importScripts()` blocked in " + self.location.protocol + self.location.search);
    1111
    1212test(t => {
    13   assert_throws(EvalError(),
    14                 _ => eval("1 + 1"),
    15                 "`eval()` should throw 'EvalError'.");
     13  assert_throws_js(EvalError,
     14                   _ => eval("1 + 1"),
     15                   "`eval()` should throw 'EvalError'.");
    1616
    17   assert_throws(EvalError(),
    18                 _ => new Function("1 + 1"),
    19                 "`new Function()` should throw 'EvalError'.");
     17  assert_throws_js(EvalError,
     18                   _ => new Function("1 + 1"),
     19                   "`new Function()` should throw 'EvalError'.");
    2020}, "`eval()` blocked in " + self.location.protocol + self.location.search);
    2121

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-expected.txt

    r263601 r263605  
    1 async_test(t => { requestAnimationFrame(t.step_func_done(_ => { var script = document.querySelector('#cssTest'); var style = getComputedStyle(script); assert_equals(style['display'], 'block'); assert_equals(style['background-image'], 'none'); })); }, "Nonces don't leak via CSS side-channels.");
    21
    32FAIL Reading 'nonce' content attribute and IDL attribute. assert_equals: expected Element node <script nonce="abc" id="testScript" executed="yay">
    … …  
    1211FAIL setAttribute('nonce') overwrites '.nonce' upon insertion. assert_equals: expected "" but got "abc"
    1312FAIL createElement.setAttribute. assert_equals: Post-insertion content expected "" but got "abc"
    14 FAIL Custom elements expose the correct events. assert_equals: expected 3 but got 2
     13FAIL Custom elements expose the correct events. assert_object_equals: AttributeChanged 2 value is undefined, expected object
    1514FAIL Nonces don't leak via CSS side-channels. assert_equals: expected "none" but got "url(\"http://localhost:8800/security/resources/abe.png\")"
    1615

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub-expected.txt

    r263601 r263605  
    1 async_test(t => { requestAnimationFrame(t.step_func_done(_ => { var script = document.querySelector('#cssTest'); var style = getComputedStyle(script); assert_equals(style['display'], 'block'); assert_equals(style['background-image'], "url(\"http://localhost:8800/security/resources/abe.png\")"); })); }, "Nonces leak via CSS side-channels.");
    21
    32PASS Reading 'nonce' content attribute and IDL attribute.

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub.html

    r263601 r263605  
    7373      s.innerText = script.innerText;
    7474      s.nonce = 'abc';
     75      assert_equals(s.nonce, 'abc');
     76      assert_equals(s.getAttribute('nonce'), null);
    7577      document.head.appendChild(s);
    7678      assert_equals(s.nonce, 'abc');
    … …  
    120122</style>
    121123<script nonce="abc" id="cssTest">
    122     async_test(t => {
    123       requestAnimationFrame(t.step_func_done(_ => {
    124         var script = document.querySelector('#cssTest');
    125         var style = getComputedStyle(script);
    126         assert_equals(style['display'], 'block');
    127         assert_equals(style['background-image'], "url(\"http://{{domains[]}}:{{ports[http][0]}}/security/resources/abe.png\")");
    128       }));
     124    test(t => {
     125      const script = document.querySelector('#cssTest');
     126      t.add_cleanup(() => script.remove());
     127      var style = getComputedStyle(script);
     128      assert_equals(style['display'], 'block');
     129      assert_equals(style['background-image'], "url(\"http://{{domains[]}}:{{ports[http][0]}}/security/resources/abe.png\")");
    129130    }, "Nonces leak via CSS side-channels.");
    130131</script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden.html

    r263601 r263605  
    7474      s.innerText = script.innerText;
    7575      s.nonce = 'abc';
     76      assert_equals(s.nonce, 'abc');
     77      assert_equals(s.getAttribute('nonce'), null);
    7678      document.head.appendChild(s);
    7779      assert_equals(s.nonce, 'abc');
    … …  
    148150<script nonce="abc">
    149151  test(t => {
     152    assert_object_equals(eventList[0], { type: "AttributeChanged", name: "nonce", oldValue: null, newValue: "abc" }, "AttributeChanged 1");
     153    assert_object_equals(eventList[1], { type: "Connected" }, "Connected");
     154    assert_object_equals(eventList[2], { type: "AttributeChanged", name: "nonce", oldValue: "abc", newValue: "" }, "AttributeChanged 2");
    150155    assert_equals(eventList.length, 3);
    151     assert_object_equals(eventList[0], { type: "AttributeChanged", name: "nonce", oldValue: null, newValue: "abc" });
    152     assert_object_equals(eventList[1], { type: "Connected" });
    153     assert_object_equals(eventList[2], { type: "AttributeChanged", name: "nonce", oldValue: "abc", newValue: "" });
    154156  }, "Custom elements expose the correct events.");
    155157</script>
    … …  
    161163</style>
    162164<script nonce="abc" id="cssTest">
    163     async_test(t => {
    164       requestAnimationFrame(t.step_func_done(_ => {
    165         var script = document.querySelector('#cssTest');
    166         var style = getComputedStyle(script);
    167         assert_equals(style['display'], 'block');
    168         assert_equals(style['background-image'], 'none');
    169       }));
     165    test(t => {
     166      const script = document.querySelector('#cssTest');
     167      t.add_cleanup(() => script.remove());
     168      var style = getComputedStyle(script);
     169      assert_equals(style['display'], 'block');
     170      assert_equals(style['background-image'], 'none');
    170171    }, "Nonces don't leak via CSS side-channels.");
    171172</script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-expected.txt

    r263601 r263605  
    55FAIL Cloned node retains nonce. assert_equals: IDL attribute expected (string) "abc" but got (undefined) undefined
    66FAIL Cloned node retains nonce when inserted. assert_equals: expected (string) "abc" but got (undefined) undefined
    7 FAIL Writing 'nonce' content attribute. assert_equals: expected (string) "abc" but got (undefined) undefined
     7FAIL Writing 'nonce' content attribute. assert_equals: expected (string) "foo" but got (undefined) undefined
    88PASS Writing 'nonce' IDL attribute.
    99PASS Document-written script executes.
    … …  
    1111FAIL createElement.nonce. assert_equals: expected (object) null but got (string) "abc"
    1212FAIL createElement.setAttribute. assert_equals: Post-insertion content expected "" but got "abc"
    13 FAIL Nonces don't leak via CSS side-channels. assert_equals: expected "none" but got "url(\"http://localhost:8800/security/resources/abe.png\")"
    1413

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-meta.sub-expected.txt

    r263601 r263605  
    44FAIL Cloned node retains nonce. assert_equals: IDL attribute expected (string) "abc" but got (undefined) undefined
    55FAIL Cloned node retains nonce when inserted. assert_equals: expected (string) "abc" but got (undefined) undefined
    6 FAIL Writing 'nonce' content attribute. assert_equals: expected (string) "abc" but got (undefined) undefined
     6FAIL Writing 'nonce' content attribute. assert_equals: expected (string) "foo" but got (undefined) undefined
    77PASS Writing 'nonce' IDL attribute.
    88PASS Document-written script executes.
    … …  
    1010PASS createElement.nonce.
    1111PASS createElement.setAttribute.
    12 PASS Nonces don't leak via CSS side-channels.
    1312

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-meta.sub.html

    r263601 r263605  
    5050      script.setAttribute('nonce', 'foo');
    5151      assert_equals(script.getAttribute('nonce'), 'foo');
    52       assert_equals(script.nonce, 'abc');
     52      assert_equals(script.nonce, 'foo');
    5353    }, "Writing 'nonce' content attribute.");
    5454
    … …  
    7878      innerScript.nonce = 'abc';
    7979      s.appendChild(innerScript);
     80      assert_equals(innerScript.nonce, 'abc');
     81      assert_equals(innerScript.getAttribute('nonce'), null, 'innerScript.getAttribute nonce');
    8082      document.body.appendChild(s);
    8183      assert_equals(innerScript.nonce, 'abc');
    … …  
    9799    }, "createElement.setAttribute.");
    98100</script>
    99 
    100 <!-- CSS Leakage -->
    101 <style>
    102     #cssTest { display: block; }
    103     #cssTest[nonce=abc] { background: url(/security/resources/abe.png); }
    104 </style>
    105 <svg xmlns="http://www.w3.org/2000/svg">
    106   <script nonce="abc" id="cssTest">
    107       async_test(t => {
    108         requestAnimationFrame(t.step_func_done(_ => {
    109           var script = document.querySelector('#cssTest');
    110           var style = getComputedStyle(script);
    111           assert_equals(style['display'], 'block');
    112           assert_equals(style['background-image'], "url(\"http://{{domains[]}}:{{ports[http][0]}}/security/resources/abe.png\")");
    113         }));
    114       }, "Nonces don't leak via CSS side-channels.");
    115   </script>
    116 </svg>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden.html

    r263601 r263605  
    5050      script.setAttribute('nonce', 'foo');
    5151      assert_equals(script.getAttribute('nonce'), 'foo');
    52       assert_equals(script.nonce, 'abc');
     52      assert_equals(script.nonce, 'foo');
    5353    }, "Writing 'nonce' content attribute.");
    5454
    … …  
    9797    }, "createElement.setAttribute.");
    9898</script>
    99 
    100 <!-- CSS Leakage -->
    101 <style>
    102     #cssTest { display: block; }
    103     #cssTest[nonce=abc] { background: url(/security/resources/abe.png); }
    104 </style>
    105 <svg xmlns="http://www.w3.org/2000/svg">
    106   <script nonce="abc" id="cssTest">
    107       async_test(t => {
    108         requestAnimationFrame(t.step_func_done(_ => {
    109           var script = document.querySelector('#cssTest');
    110           var style = getComputedStyle(script);
    111           assert_equals(style['display'], 'block');
    112           assert_equals(style['background-image'], 'none');
    113         }));
    114       }, "Nonces don't leak via CSS side-channels.");
    115   </script>
    116 </svg>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/w3c-import.log

    r246330 r263605  
    1515------------------------------------------------------------------------
    1616List of files:
    17 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.tentative.sub.html
    18 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden.tentative.html
    19 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden.tentative.html.headers
    20 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-meta.tentative.sub.html
    21 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden.tentative.html
    22 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden.tentative.html.headers
     17/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/nonces.html
     18/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/nonces.html.headers
     19/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden-meta.sub.html
     20/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden.html
     21/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/script-nonces-hidden.html.headers
     22/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden-meta.sub.html
     23/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden.html
     24/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/nonce-hiding/svgscript-nonces-hidden.html.headers

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-url-allowed.html

    r246330 r263605  
    55    <script src="/resources/testharness.js"></script>
    66    <script src="/resources/testharnessreport.js"></script>
    7     <!-- Content-Security-Policy: object-src 'self'; script-src 'self' 'unsafe-inline'; report-uri ../support/report.py?op=put&reportID={{$id}} -->
     7    <!--
     8      Content-Security-Policy:
     9        object-src 'self';
     10        script-src 'self' 'unsafe-inline';
     11        report-uri ../support/report.py?op=put&reportID={{$id}}
     12    -->
    813</head>
    914
    1015<body>
    1116    <object type="image/png" data="/content-security-policy/support/pass.png"></object>
    12 
    13     <!-- we rely on the report because we can't rely on the onload event for
    14          "allowed" tests as it is not fired for object and embed -->
    15     <script async defer src='../support/checkReport.sub.js?reportExists=false'></script>
     17    <!--
     18      We rely on the report because we can't rely on the onload event for
     19      "allowed" tests as it is not fired for object and embed
     20    -->
     21    <script src='../support/checkReport.sub.js?reportExists=false'></script>
    1622</body>
    1723

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/object-src/object-src-url-embed-allowed.html

    r246330 r263605  
    55    <script src="/resources/testharness.js"></script>
    66    <script src="/resources/testharnessreport.js"></script>
    7     <!-- Content-Security-Policy: object-src 'self'; script-src 'self' 'unsafe-inline'; report-uri ../support/report.py?op=put&reportID={{$id}} -->
     7    <!--
     8      Content-Security-Policy:
     9        object-src 'self';
     10        script-src 'self' 'unsafe-inline';
     11        report-uri ../support/report.py?op=put&reportID={{$id}}
     12    -->
    813</head>
    914
    … …  
    1116  <embed height="40" width="40" type="image/png"
    1217         src="/content-security-policy/support/pass.png"></embed>
    13 
    14          <!-- we rely on the report because we can't rely on the onload event for
    15               "allowed" tests as it is not fired for object and embed -->
    16     <script async defer src='../support/checkReport.sub.js?reportExists=false'></script>
     18  <!--
     19    We rely on the report because we can't rely on the onload event for
     20    "allowed" tests as it is not fired for object and embed
     21  -->
     22  <script src='../support/checkReport.sub.js?reportExists=false'></script>
    1723</body>
    1824

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-only-sends-reports-to-first-endpoint.https.sub.html

    r263601 r263605  
    22<html>
    33<head>
    4   <title>Test that report-to overrides report-uri. This tests report-uri before report-to in the policy</title>
     4  <title>Test that report-to ignores tokens after the first one</title>
    55  <script src='/resources/testharness.js'></script>
    66  <script src='/resources/testharnessreport.js'></script>
    … …  
    2020       onload='t1.unreached_func("The image should not have loaded");'
    2121       onerror='t1.done();'>
    22   <!-- report-to overrides the report-uri so the report goes to a different endpoint and we should not have any reports sent to this endpoint -->
    23   <script async defer src='../support/checkReport.sub.js?reportExists=false></script>
     22  <!-- The second token of the report-to directive should be ignored, since the directive only supports one token. So we should not have any reports sent to this endpoint. -->
     23  <script async defer src='../support/checkReport.sub.js?reportExists=false'></script>
    2424</body>
    2525</html>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html

    r246330 r263605  
    2121       onerror='t1.done();'>
    2222  <!-- report-to overrides the report-uri so the report goes to a different endpoint and we should not have any reports sent to this endpoint -->
    23   <script async defer src='../support/checkReport.sub.js?reportExists=false></script>
     23  <script async defer src='../support/checkReport.sub.js?reportExists=false'></script>
    2424</body>
    2525</html>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-2.https.sub.html

    r246330 r263605  
    2121       onerror='t1.done();'>
    2222  <!-- report-to overrides the report-uri so the report goes to a different endpoint and we should not have any reports sent to this endpoint -->
    23   <script async defer src='../support/checkReport.sub.js?reportExists=false></script>
     23  <script async defer src='../support/checkReport.sub.js?reportExists=false'></script>
    2424</body>
    2525</html>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-sends-reports-on-violation.https.sub.html

    r246330 r263605  
    2828          assert_equals(reports[0].url, document_url);
    2929          assert_equals(reports[0].body.documentURL, document_url);
    30           assert_equals(reports[0].body.referrer, null);
     30          assert_equals(reports[0].body.referrer, "");
    3131          assert_equals(reports[0].body.blockedURL,
    3232                        base_url + "support/fail.png");
    … …  
    3535                        "script-src 'self' 'unsafe-inline'; img-src 'none'; report-to csp-group");
    3636          assert_equals(reports[0].body.sourceFile, document_url);
    37           assert_equals(reports[0].body.sample, null);
     37          assert_equals(reports[0].body.sample, "");
    3838          assert_equals(reports[0].body.disposition, "enforce");
    3939          assert_equals(reports[0].body.statusCode, 0);

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/w3c-import.log

    r246330 r263605  
    1919/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-only-sends-reports-on-violation.https.sub.html
    2020/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-only-sends-reports-on-violation.https.sub.html.sub.headers
     21/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-only-sends-reports-to-first-endpoint.https.sub.html
     22/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-only-sends-reports-to-first-endpoint.https.sub.html.sub.headers
    2123/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html
    2224/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting-api/reporting-api-report-to-overrides-report-uri-1.https.sub.html.sub.headers

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-original-url.sub.html

    r246330 r263605  
    3535    var i = document.createElement('img');
    3636    var url = "{{location[scheme]}}://{{domains[www1]}}:{{ports[http][0]}}/common/redirect.py?location=" + encodeURIComponent("{{location[scheme]}}://{{location[host]}}/content-security-policy/support/fail.png?t=3");
    37     createListener("{{location[scheme]}}://{{location[host]}}/content-security-policy/support/fail.png?t=3", t);
     37    createListener(url, t);
    3838    i.src = url;
    3939}, "Block after redirect, same-origin = original URL in report");
    … …  
    4242    var i = document.createElement('img');
    4343    var url = "{{location[scheme]}}://{{domains[www1]}}:{{ports[http][0]}}/common/redirect.py?location=" + encodeURIComponent("{{location[scheme]}}://{{domains[www2]}}:{{ports[http][0]}}/content-security-policy/support/fail.png?t=4");
    44     createListener("{{location[scheme]}}://{{domains[www2]}}:{{ports[http][0]}}", t);
     44    createListener(url, t);
    4545    i.src = url;
    4646}, "Block after redirect, cross-origin = original URL in report");

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/support/w3c-import.log

    r246330 r263605  
    1717/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/support/generate-csp-report.html
    1818/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/support/generate-csp-report.html.sub.headers
     19/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/support/redirect-throw-function.sub.py
    1920/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/support/set-cookie.py
     21/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/support/throw-function.js

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/w3c-import.log

    r254133 r263605  
    1717/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/multiple-report-policies.html
    1818/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/multiple-report-policies.html.sub.headers
     19/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/post-redirect-stacktrace.https.html
     20/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/post-redirect-stacktrace.https.html.headers
    1921/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-and-enforce.html
    2022/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-and-enforce.html.sub.headers
    … …  
    2527/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-blocked-uri.html
    2628/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-blocked-uri.html.sub.headers
     29/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-clips-sample.https.html
    2730/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-cross-origin-no-cookies.sub.html
    2831/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-cross-origin-no-cookies.sub.html.sub.headers
    … …  
    3538/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-only-unsafe-eval.html
    3639/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-only-unsafe-eval.html.sub.headers
     40/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-original-url-on-mixed-content-frame.https.sub.html
     41/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-original-url-on-mixed-content-frame.https.sub.html.sub.headers
    3742/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-original-url.sub.html
    3843/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/reporting/report-original-url.sub.html.sub.headers

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-1_4.html

    r246330 r263605  
    2020        var evalRan = false;
    2121
    22         test(function() {assert_throws(new EvalError(), function() { eval('evalRan = true;') })}, "eval() should throw without 'unsafe-eval' keyword source in script-src directive.");
     22        test(function() {assert_throws_js(EvalError, function() { eval('evalRan = true;') })}, "eval() should throw without 'unsafe-eval' keyword source in script-src directive.");
    2323
    2424        test(function() {assert_false(evalRan);})

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-1_4_2.html

    r246330 r263605  
    2020
    2121        test(function() {
    22             assert_throws(
    23                 new EvalError(),
     22            assert_throws_js(
     23                EvalError,
    2424                function() {
    2525                    var funq = new Function('');

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-sri_hash.sub-expected.txt

    r254133 r263605  
    1010PASS multiple mismatched integrity
    1111PASS partially matching integrity
    12 FAIL crossorigin no integrity but whitelisted host assert_unreached: Script should load! http://127.0.0.1:8800/content-security-policy/script-src/crossoriginScript.js Reached unreachable code
    13 FAIL crossorigin mismatched integrity but whitelisted host assert_unreached: Script should load! http://127.0.0.1:8800/content-security-policy/script-src/crossoriginScript.js Reached unreachable code
     12FAIL crossorigin no integrity but allowed host assert_unreached: Script should load! http://127.0.0.1:8800/content-security-policy/script-src/crossoriginScript.js Reached unreachable code
     13FAIL crossorigin mismatched integrity but allowed host assert_unreached: Script should load! http://127.0.0.1:8800/content-security-policy/script-src/crossoriginScript.js Reached unreachable code
    1414FAIL External script in a script tag with matching SRI hash should run. assert_true: External script ran. expected true got false
    1515

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-sri_hash.sub.html

    r254133 r263605  
    5050            'sha256-L7/UQ9VWpyG7C9RDEC4ctS5hI3Zcw+ta+haPGlByG9c= sha256-xyz',
    5151            false ],
    52           [ 'crossorigin no integrity but whitelisted host',
     52          [ 'crossorigin no integrity but allowed host',
    5353            crossorigin_base + '/content-security-policy/script-src/crossoriginScript.js',
    5454            '',
    5555            true ],
    56           [ 'crossorigin mismatched integrity but whitelisted host',
     56          [ 'crossorigin mismatched integrity but allowed host',
    5757            crossorigin_base + '/content-security-policy/script-src/crossoriginScript.js',
    5858            'sha256-kKJ5c48yxzaaSBupJSCmY50hkD8xbVgZgLHLtmnkeAo=',

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_discard_source_expressions.html

    r263601 r263605  
    33
    44<head>
    5     <title>Whitelists are discarded with `strict-dynamic` in the script-src directive.</title>
     5    <title>Source expressions are discarded with `strict-dynamic` in the script-src directive.</title>
    66    <script src='/resources/testharness.js' nonce='dummy'></script>
    77    <script src='/resources/testharnessreport.js' nonce='dummy'></script>
    … …  
    1111
    1212<body>
    13     <h1>Whitelists are discarded with `strict-dynamic` in the script-src directive.</h1>
     13    <h1>Source expressions are discarded with `strict-dynamic` in the script-src directive.</h1>
    1414    <div id='log'></div>
    1515
    … …  
    1717        async_test(function(t) {
    1818            window.addEventListener('message', t.step_func(function(e) {
    19                 if (e.data === 'whitelistedScript') {
    20                     assert_unreached('Whitelisted script without a correct nonce is not allowed with `strict-dynamic`.');
     19                if (e.data === 'allowedScript') {
     20                    assert_unreached('Allowed scripts without a correct nonce are not permitted with `strict-dynamic`.');
    2121                }
    2222            }));
    … …  
    2424                assert_equals(e.effectiveDirective, 'script-src-elem');
    2525            }));
    26         }, 'Whitelisted script without a correct nonce is not allowed with `strict-dynamic`.');
     26        }, 'Allowed scripts without a correct nonce are not permitted with `strict-dynamic`.');
    2727    </script>
    28     <script id='whitelistedScript' src='simpleSourcedScript.js'></script>
     28    <script id='allowedScript' src='simpleSourcedScript.js'></script>
    2929
    3030</body>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.html

    r263601 r263605  
    33
    44<head>
    5     <title>Whitelists in a separate policy are honored with `strict-dynamic` in the script-src directive.</title>
     5    <title>Source expressions in a separate policy are honored with `strict-dynamic` in the script-src directive.</title>
    66    <script src='/resources/testharness.js' nonce='dummy'></script>
    77    <script src='/resources/testharnessreport.js' nonce='dummy'></script>
    … …  
    1414
    1515<body>
    16     <h1>Whitelists in a separate policy are honored with `strict-dynamic` in the script-src directive.</h1>
     16    <h1>Source expressions in a separate policy are honored with `strict-dynamic` in the script-src directive.</h1>
    1717    <div id='log'></div>
    1818
    … …  
    2020        async_test(function(t) {
    2121            window.addEventListener('message', t.step_func(function(e) {
    22                 if (e.data === 'whitelisted-appendChild') {
     22                if (e.data === 'allowed-appendChild') {
    2323                    t.done();
    2424                }
    2525            }));
    2626            window.addEventListener('securitypolicyviolation', t.step_func(function(violation) {
    27                 if (violation.blockedURI.split('?')[1] !== 'whitelisted-appendChild') {
     27                if (violation.blockedURI.split('?')[1] !== 'allowed-appendChild') {
    2828                    return;
    2929                }
    30                 assert_unreached('Script injected via `appendChild` is allowed with `strict-dynamic` + a nonce+whitelist double policy.');
     30                assert_unreached('Script injected via `appendChild` is permitted with `strict-dynamic` + a nonce+allowed double policy.');
    3131            }));
    3232
    3333            var e = document.createElement('script');
    34             e.id = 'whitelisted-appendChild';
     34            e.id = 'allowed-appendChild';
    3535            e.src = 'simpleSourcedScript.js?' + e.id;
    3636            e.onerror = t.unreached_func('Error should not be triggered.');
    3737            document.body.appendChild(e);
    38         }, 'Script injected via `appendChild` is allowed with `strict-dynamic` + a nonce+whitelist double policy.');
     38        }, 'Script injected via `appendChild` is permitted with `strict-dynamic` + a nonce+allowed double policy.');
    3939    </script>
    4040
    … …  
    4242        async_test(function(t) {
    4343            window.addEventListener('securitypolicyviolation', t.step_func(function(violation) {
    44                 if (violation.blockedURI.split('?')[1] !== 'nonWhitelisted-appendChild') {
     44                if (violation.blockedURI.split('?')[1] !== 'nonAllowed-appendChild') {
    4545                    return;
    4646                }
    … …  
    5151
    5252            var e = document.createElement('script');
    53             e.id = 'nonWhitelisted-appendChild';
     53            e.id = 'nonAllowed-appendChild';
    5454            e.src = '{{location[scheme]}}://{{domains[www2]}}:{{ports[http][0]}}/nonexisting.js?' + e.id;
    5555            e.onload = t.unreached_func('OnLoad should not be triggered.');
    5656            document.body.appendChild(e);
    57         }, 'Non-whitelisted script injected via `appendChild` is not allowed with `strict-dynamic` + a nonce+whitelist double policy.');
     57        }, 'Non-allowed script injected via `appendChild` is not permitted with `strict-dynamic` + a nonce+allowed double policy.');
    5858    </script>
    5959</body>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_eval.html

    r246330 r263605  
    2323            }));
    2424
    25             assert_throws(new Error(),
     25            assert_throws_js(Error,
    2626                function() {
    2727                    try {

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_in_img-src.html

    r246330 r263605  
    33
    44<head>
    5     <title>`strict-dynamic` does not drop whitelists in `img-src`.</title>
     5    <title>`strict-dynamic` does not drop allowed source expressions in `img-src`.</title>
    66    <script src='/resources/testharness.js' nonce='dummy'></script>
    77    <script src='/resources/testharnessreport.js' nonce='dummy'></script>
    … …  
    1111
    1212<body>
    13     <h1>`strict-dynamic` does not drop whitelists in `img-src`.</h1>
     13    <h1>`strict-dynamic` does not drop allowed source expressions in `img-src`.</h1>
    1414    <div id='log'></div>
    1515
    … …  
    2121        async_test(function(t) {
    2222            var e = document.createElement('img');
    23             e.id = 'whitelistedImage';
     23            e.id = 'allowedImage';
    2424            e.src = '/content-security-policy/support/pass.png';
    2525            e.onerror = t.unreached_func('Error should not be triggered.');
    2626            e.onload = t.step_func_done();
    2727            document.body.appendChild(e);
    28         }, '`strict-dynamic` does not drop whitelists in `img-src`.');
     28        }, '`strict-dynamic` does not drop allowed source expressions in `img-src`.');
    2929    </script>
    3030</body>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_new_function.html

    r246330 r263605  
    2323            }));
    2424
    25             assert_throws(new Error(),
     25            assert_throws_js(Error,
    2626                function() {
    2727                    try {

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/w3c-import.log

    r254133 r263605  
    5757/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_new_function.html
    5858/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_and_unsafe_eval_new_function.html.headers
    59 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_discard_whitelist.html
    60 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_discard_whitelist.html.headers
     59/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_discard_source_expressions.html
     60/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_discard_source_expressions.html.headers
    6161/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_different_nonce.html
    6262/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_different_nonce.html.headers
    63 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_whitelist.sub.html
    64 /LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_whitelist.sub.html.headers
     63/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.html
     64/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_honor_source_expressions.html.headers
    6565/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_report_only.html
    6666/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/script-src/script-src-strict_dynamic_double_policy_report_only.html.headers

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/constructor-required-fields-expected.txt

    r246330 r263605  
    22PASS SecurityPolicyViolationEvent constructor should throw with no parameters
    33PASS SecurityPolicyViolationEvent constructor works with an init dict
    4 FAIL SecurityPolicyViolationEvent constructor requires documentURI assert_throws: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
     4FAIL SecurityPolicyViolationEvent constructor requires documentURI assert_throws_js: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    55          // documentURI: "http://example.com",
    66          referrer: "http://example.com",
    … …  
    1616          columnNumber: 1,
    1717      })}" did not throw
    18 FAIL SecurityPolicyViolationEvent constructor requires violatedDirective assert_throws: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
     18FAIL SecurityPolicyViolationEvent constructor requires violatedDirective assert_throws_js: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    1919          documentURI: "http://example.com",
    2020          referrer: "http://example.com",
    … …  
    3030          columnNumber: 1,
    3131      })}" did not throw
    32 FAIL SecurityPolicyViolationEvent constructor requires effectiveDirective assert_throws: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
     32FAIL SecurityPolicyViolationEvent constructor requires effectiveDirective assert_throws_js: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    3333          documentURI: "http://example.com",
    3434          referrer: "http://example.com",
    … …  
    4444          columnNumber: 1,
    4545      })}" did not throw
    46 FAIL SecurityPolicyViolationEvent constructor requires originalPolicy assert_throws: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
     46FAIL SecurityPolicyViolationEvent constructor requires originalPolicy assert_throws_js: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    4747          documentURI: "http://example.com",
    4848          referrer: "http://example.com",
    … …  
    5858          columnNumber: 1,
    5959      })}" did not throw
    60 FAIL SecurityPolicyViolationEvent constructor requires disposition assert_throws: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
     60FAIL SecurityPolicyViolationEvent constructor requires disposition assert_throws_js: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    6161          documentURI: "http://example.com",
    6262          referrer: "http://example.com",
    … …  
    7272          columnNumber: 1,
    7373      })}" did not throw
    74 FAIL SecurityPolicyViolationEvent constructor requires statusCode assert_throws: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
     74FAIL SecurityPolicyViolationEvent constructor requires statusCode assert_throws_js: function "function () { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    7575          documentURI: "http://example.com",
    7676          referrer: "http://example.com",

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/constructor-required-fields.html

    r246330 r263605  
    55    // basic tests.
    66    test(function() {
    7       assert_throws(TypeError(),
    8                     function() { new SecurityPolicyViolationEvent(); });
     7      assert_throws_js(TypeError,
     8                       function() { new SecurityPolicyViolationEvent(); });
    99    }, "SecurityPolicyViolationEvent constructor should throw with no parameters");
    1010
    … …  
    2828    // missing required members
    2929    test(function() {
    30       assert_throws(TypeError(),
     30      assert_throws_js(TypeError,
    3131        function() { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    3232          // documentURI: "http://example.com",
    … …  
    4646
    4747    test(function() {
    48       assert_throws(TypeError(),
     48      assert_throws_js(TypeError,
    4949        function() { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    5050          documentURI: "http://example.com",
    … …  
    6464
    6565    test(function() {
    66       assert_throws(TypeError(),
     66      assert_throws_js(TypeError,
    6767        function() { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    6868          documentURI: "http://example.com",
    … …  
    8282
    8383    test(function() {
    84       assert_throws(TypeError(),
     84      assert_throws_js(TypeError,
    8585        function() { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    8686          documentURI: "http://example.com",
    … …  
    100100
    101101    test(function() {
    102       assert_throws(TypeError(),
     102      assert_throws_js(TypeError,
    103103        function() { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    104104          documentURI: "http://example.com",
    … …  
    118118
    119119    test(function() {
    120       assert_throws(TypeError(),
     120      assert_throws_js(TypeError,
    121121        function() { new SecurityPolicyViolationEvent("securitypolicyviolation", {
    122122          documentURI: "http://example.com",

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/upgrade-insecure-requests-reporting.https-expected.txt

    r246330 r263605  
    11
    2 FAIL Upgraded image is reported Can't find variable: generateURL
    3 FAIL Upgraded iframe is reported Can't find variable: generateURL
    4 FAIL Navigated iframe is upgraded and reported Can't find variable: generateURL
    52
     3Harness Error (TIMEOUT), message = null
     4
     5TIMEOUT Upgraded image is reported Test timed out
     6TIMEOUT Upgraded iframe is reported Test timed out
     7TIMEOUT Navigated iframe is upgraded and reported Test timed out
     8

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/securitypolicyviolation/upgrade-insecure-requests-reporting.https.html

    r246330 r263605  
    22<script src="/resources/testharness.js"></script>
    33<script src="/resources/testharnessreport.js"></script>
    4 <script src="/upgrade-insecure-requests/support/testharness-helper.sub.js"></script>
     4<script src="/common/security-features/resources/common.sub.js"></script>
    55<body></body>
    66<script>
    … …  
    1515
    1616    async_test(t => {
    17       var url = generateURL(Host.SAME_ORIGIN, Protocol.INSECURE, ResourceType.IMAGE).url;
     17      var url = getRequestURLs("img-tag",
     18                               "same-http-downgrade",
     19                               "no-redirect").testUrl;
    1820      var i = document.createElement('img');
    1921      var loaded = false;
    … …  
    3638
    3739    async_test(t => {
    38       var url = generateURL(Host.SAME_ORIGIN, Protocol.INSECURE, ResourceType.FRAME).url;
     40      var url = getRequestURLs("iframe-tag",
     41                               "same-http-downgrade",
     42                               "no-redirect").testUrl;
    3943      var i = document.createElement('iframe');
    4044      var loaded = false;
    … …  
    6064    async_test(t => {
    6165      // Load an HTTPS iframe, then navigate it to an HTTP URL and check that the HTTP URL is both upgraded and reported.
    62       var url = generateURL(Host.SAME_ORIGIN, Protocol.SECURE, ResourceType.FRAME).url;
    63       var navigate_to = generateURL(Host.CROSS_ORIGIN, Protocol.INSECURE, ResourceType.FRAME).url;
     66      var url = getRequestURLs("iframe-tag",
     67                               "same-https",
     68                               "no-redirect").testUrl;
     69      var navigate_to = getRequestURLs("iframe-tag",
     70                                       "cross-http-downgrade",
     71                                       "no-redirect").testUrl;
    6472      var upgraded = new URL(navigate_to);
    6573      upgraded.protocol = "https";

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/style-src/stylenonce-allowed.sub.html

    r246330 r263605  
    5252
    5353    </script>
    54     <p>Style correctly whitelisted via a 'nonce-*' expression in 'style-src' should be applied to the page.</p>
     54    <p>Style correctly allowed via a 'nonce-*' expression in 'style-src' should be applied to the page.</p>
    5555    <div id="log"></div>
    5656</body>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/checkReport.sub.js

    r246330 r263605  
    4848  // received to conclude that no report has been generated. These timeouts must
    4949  // not exceed the test timeouts set by vendors otherwise the test would fail.
    50   var timeout = document.querySelector("meta[name=timeout][content=long]") ? 25 : 5;
     50  var timeout = document.querySelector("meta[name=timeout][content=long]") ? 20 : 3;
    5151  var reportLocation = location.protocol + "//" + location.host + "/content-security-policy/support/report.py?op=retrieve_report&timeout=" + timeout + "&reportID=" + reportID;
    5252

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/support/testharness-helper.js

    r246330 r263605  
    1111}
    1212
    13 function waitUntilCSPEventForURL(test, url) {
     13function waitUntilCSPEventForURLOrLine(test, url, line) {
    1414  return new Promise((resolve, reject) => {
    1515    self.addEventListener("securitypolicyviolation", test.step_func(e => {
    16       if (e.blockedURI == url)
     16      if (e.blockedURI == url && (!line || line == e.lineNumber))
    1717        resolve(e);
    1818    }));
    … …  
    2020}
    2121
     22function waitUntilCSPEventForURL(test, url) {
     23  return waitUntilCSPEventForURLOrLine(test, url);
     24}
     25
    2226function waitUntilCSPEventForEval(test, line) {
    23   return new Promise((resolve, reject) => {
    24     self.addEventListener("securitypolicyviolation", test.step_func(e => {
    25       if (e.blockedURI == "eval" && e.lineNumber == line)
    26         resolve(e);
    27     }));
    28   });
     27  return waitUntilCSPEventForURLOrLine(test, "eval", line);
     28}
     29
     30function waitUntilCSPEventForTrustedTypes(test) {
     31  return waitUntilCSPEventForURLOrLine(test, "trusted-types-sink");
    2932}
    3033
    … …  
    97100    // TODO(mkwst): We shouldn't be throwing here. We should be firing an
    98101    // `error` event on the Worker. https://crbug.com/663298
    99     assert_throws("SecurityError", function () {
     102    assert_throws_dom("SecurityError", function () {
    100103      var w = new Worker(url);
    101104    });
    … …  
    116119    // TODO(mkwst): We shouldn't be throwing here. We should be firing an
    117120    // `error` event on the SharedWorker. https://crbug.com/663298
    118     assert_throws("SecurityError", function () {
     121    assert_throws_dom("SecurityError", function () {
    119122      var w = new SharedWorker(url);
    120123    });
    … …  
    134137          assert_equals(e.effectiveDirective, "worker-src");
    135138        })),
    136       promise_rejects(t, "SecurityError", navigator.serviceWorker.register(url, { scope: url }))
     139      promise_rejects_dom(t, "SecurityError", navigator.serviceWorker.register(url, { scope: url }))
    137140    ]);
    138141  }, description);

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/worker-src/dedicated-none.sub-expected.txt

    r246330 r263605  
    11
    2 FAIL Same-origin dedicated worker blocked by host-source expression. assert_throws: function "function () {
     2FAIL Same-origin dedicated worker blocked by host-source expression. assert_throws_dom: function "function () {
    33      var w = new Worker(url);
    44    }" did not throw
    5 FAIL blob: dedicated worker blocked by 'blob:'. assert_throws: function "function () {
     5FAIL blob: dedicated worker blocked by 'blob:'. assert_throws_dom: function "function () {
    66      var w = new Worker(url);
    77    }" did not throw

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-child-fallback.sub.html

    r246330 r263605  
    55<script src=/resources/testharnessreport.js></script>
    66<script src="../support/testharness-helper.js"></script>
    7 <!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
     7<!-- Ideally we would use "script-src 'none'" alone but we have to allow the actual script that spawns the workers, hence the nonce.-->
    88<meta http-equiv="Content-Security-Policy" content="child-src 'self'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
    99<script src="../support/dedicated-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin dedicated worker allowed by child-src 'self'."></script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub.html

    r246330 r263605  
    55<script src=/resources/testharnessreport.js></script>
    66<script src="../support/testharness-helper.js"></script>
    7 <!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
     7<!-- Ideally we would use "script-src 'none'" alone but we have to allow the actual script that spawns the workers, hence the nonce.-->
    88<meta http-equiv="Content-Security-Policy" content="worker-src 'self'; child-src 'none'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
    99<script src="../support/dedicated-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin dedicated worker allowed by worker-src 'self'."></script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/worker-src/service-worker-src-child-fallback.https.sub.html

    r246330 r263605  
    55<script src=/resources/testharnessreport.js></script>
    66<script src="../support/testharness-helper.js"></script>
    7 <!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
     7<!-- Ideally we would use "script-src 'none'" alone but we have to allow the actual script that spawns the workers, hence the nonce.-->
    88<meta http-equiv="Content-Security-Policy" content="child-src 'self'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
    99<script src="../support/service-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin service worker allowed by child-src 'self'."></script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/worker-src/service-worker-src-self-fallback.https.sub.html

    r246330 r263605  
    55<script src=/resources/testharnessreport.js></script>
    66<script src="../support/testharness-helper.js"></script>
    7 <!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
     7<!-- Ideally we would use "script-src 'none'" alone but we have to allow the actual script that spawns the workers, hence the nonce.-->
    88<meta http-equiv="Content-Security-Policy" content="worker-src 'self'; child-src 'none'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
    99<script src="../support/service-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin service worker allowed by worker-src 'self'."></script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/worker-src/shared-worker-src-child-fallback.sub.html

    r246330 r263605  
    55<script src=/resources/testharnessreport.js></script>
    66<script src="../support/testharness-helper.js"></script>
    7 <!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
     7<!-- Ideally we would use "script-src 'none'" alone but we have to allow the actual script that spawns the workers, hence the nonce.-->
    88<meta http-equiv="Content-Security-Policy" content="child-src 'self'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
    99<script src="../support/shared-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin shared worker allowed by child-src 'self'."></script>

  • trunk/LayoutTests/imported/w3c/web-platform-tests/content-security-policy/worker-src/shared-worker-src-self-fallback.sub.html

    r246330 r263605  
    55<script src=/resources/testharnessreport.js></script>
    66<script src="../support/testharness-helper.js"></script>
    7 <!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
     7<!-- Ideally we would use "script-src 'none'" alone but we have to allow the actual script that spawns the workers, hence the nonce.-->
    88<meta http-equiv="Content-Security-Policy" content="worker-src 'self'; child-src 'none'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
    99<script src="../support/shared-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin shared worker allowed by worker-src 'self'."></script>

  • trunk/LayoutTests/platform/gtk/TestExpectations

    r263465 r263605  
    11721172
    11731173webkit.org/b/206586 imported/w3c/web-platform-tests/content-security-policy/frame-ancestors/frame-ancestors-from-serviceworker.https.html [ Failure ]
    1174 webkit.org/b/206586 imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document-meta.html [ Failure ]
    11751174
    11761175webkit.org/b/206588 fast/history/page-cache-media-recorder.html [ Failure ]

  • trunk/LayoutTests/platform/wpe/TestExpectations

    r263451 r263605  
    503503
    504504webkit.org/b/206586 imported/w3c/web-platform-tests/content-security-policy/frame-ancestors/frame-ancestors-from-serviceworker.https.html [ Failure ]
    505 webkit.org/b/206586 imported/w3c/web-platform-tests/content-security-policy/frame-src/frame-src-same-document-meta.html [ Failure ]
    506505
    507506webkit.org/b/197473 imported/w3c/web-platform-tests/resource-timing/resource-timing-level1.sub.html [ Failure ]

  • trunk/LayoutTests/tests-options.json

    r263059 r263605  
    561561        "slow"
    562562    ],
     563    "imported/w3c/web-platform-tests/content-security-policy/embedded-enforcement/required_csp-header.html": [
     564        "slow"
     565    ],
    563566    "imported/w3c/web-platform-tests/content-security-policy/frame-ancestors/report-blocked-frame.sub.html": [
    564567        "slow"
Note: See TracChangeset for help on using the changeset viewer.