Changeset 62779 in webkit


Ignore:
Timestamp:
Jul 8, 2010 5:00:31 AM (14 years ago)
Author:
jschuh@chromium.org
Message:

2010-07-08 Justin Schuh <​jschuh@chromium.org>

Reviewed by Alexey Proskuryakov.

XHR access control failure tests for header, method, and not-supported
​https://bugs.webkit.org/show_bug.cgi?id=41724

  • http/tests/xmlhttprequest/access-control-preflight-async-header-denied-expected.txt:
  • http/tests/xmlhttprequest/access-control-preflight-async-header-denied.html:
  • http/tests/xmlhttprequest/access-control-preflight-async-method-denied-expected.txt:
  • http/tests/xmlhttprequest/access-control-preflight-async-method-denied.html:
  • http/tests/xmlhttprequest/access-control-preflight-async-not-supported-expected.txt: Added.
  • http/tests/xmlhttprequest/access-control-preflight-async-not-supported.html: Added.
  • http/tests/xmlhttprequest/access-control-preflight-sync-header-denied-expected.txt:
  • http/tests/xmlhttprequest/access-control-preflight-sync-header-denied.html:
  • http/tests/xmlhttprequest/access-control-preflight-sync-method-denied-expected.txt:
  • http/tests/xmlhttprequest/access-control-preflight-sync-method-denied.html:
  • http/tests/xmlhttprequest/access-control-preflight-sync-not-supported-expected.txt: Added.
  • http/tests/xmlhttprequest/access-control-preflight-sync-not-supported.html: Added.
  • http/tests/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php:
Location:
trunk/LayoutTests
Files:
10 edited
4 copied

Legend:

Unmodified
Added
Removed

  • trunk/LayoutTests/ChangeLog

    r62778 r62779  
     12010-07-08  Justin Schuh  <jschuh@chromium.org>
     2
     3        Reviewed by Alexey Proskuryakov.
     4
     5        XHR access control failure tests for header, method, and not-supported
     6        https://bugs.webkit.org/show_bug.cgi?id=41724
     7
     8        * http/tests/xmlhttprequest/access-control-preflight-async-header-denied-expected.txt:
     9        * http/tests/xmlhttprequest/access-control-preflight-async-header-denied.html:
     10        * http/tests/xmlhttprequest/access-control-preflight-async-method-denied-expected.txt:
     11        * http/tests/xmlhttprequest/access-control-preflight-async-method-denied.html:
     12        * http/tests/xmlhttprequest/access-control-preflight-async-not-supported-expected.txt: Added.
     13        * http/tests/xmlhttprequest/access-control-preflight-async-not-supported.html: Added.
     14        * http/tests/xmlhttprequest/access-control-preflight-sync-header-denied-expected.txt:
     15        * http/tests/xmlhttprequest/access-control-preflight-sync-header-denied.html:
     16        * http/tests/xmlhttprequest/access-control-preflight-sync-method-denied-expected.txt:
     17        * http/tests/xmlhttprequest/access-control-preflight-sync-method-denied.html:
     18        * http/tests/xmlhttprequest/access-control-preflight-sync-not-supported-expected.txt: Added.
     19        * http/tests/xmlhttprequest/access-control-preflight-sync-not-supported.html: Added.
     20        * http/tests/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php:
     21
    1222010-07-08  Xiaomei Ji  <xji@chromium.org>
    223

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-async-header-denied-expected.txt

    r62576 r62779  
    1 CONSOLE MESSAGE: line 1: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin response header.
     1CONSOLE MESSAGE: line 1: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=header. Request header field X-NON-STANDARD is not allowed by Access-Control-Allow-Headers response header field.
    22PASS: Request successfully blocked.
    33

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-async-header-denied.html

    r57041 r62779  
    88}
    99
    10 if (window.layoutTestController) {
     10if (window.layoutTestController)
    1111    layoutTestController.dumpAsText();
    12 }
    1312
    1413(function() {
    … …  
    1716    try {
    1817        xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=reset", false);
    19         xhr.send("");
     18        xhr.send(null);
    2019    } catch(e) {
    2120        log("FAIL: Unable to reset server state: [" + e.message + "].");
    … …  
    2625
    2726    try {
    28         xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php", false);
     27        xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=header", true);
    2928        xhr.setRequestHeader("X-NON-STANDARD", "filler");
    3029    } catch(e) {
    … …  
    3332    }
    3433
    35     xhr.onreadystatechange = function() {
     34    xhr.onerror = function() {
    3635        xhr = new XMLHttpRequest();
    3736
    … …  
    3938            xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=complete", false);
    4039            try {
    41                 xhr.send("");
     40                xhr.send(null);
    4241            } catch(e) {
    4342                log("FAIL: Exception thrown. Cross-domain access is not allowed in second 'send'. [" + e.message + "].");
    … …  
    4948        log(xhr.responseText);
    5049    }
     50   
     51    xhr.onreadystatechange = function() {
     52        if (xhr.readyState == 4 && xhr.status == 200)
     53            log("FAIL: Cross-domain access allowed in first send without throwing an exception");
     54    }
    5155
    52     try {
    53         xhr.send("");
    54         log("FAIL: Cross-domain access allowed in first send without throwing an exception");
    55         return;
    56     } catch(e) {
    57         // Eat the exception.
    58     }
    59    
     56    xhr.send(null);
    6057})();
    6158</script>

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-async-method-denied-expected.txt

    r62576 r62779  
    1 CONSOLE MESSAGE: line 1: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin response header.
     1CONSOLE MESSAGE: line 1: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=method. Method DELETE is not allowed by Access-Control-Allow-Methods response header field.
    22PASS: Request successfully blocked.
    33

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-async-method-denied.html

    r57041 r62779  
    88}
    99
    10 if (window.layoutTestController) {
     10if (window.layoutTestController)
    1111    layoutTestController.dumpAsText();
    12 }
    1312
    1413(function() {
    … …  
    1716    try {
    1817        xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=reset", false);
    19         xhr.send("");
     18        xhr.send(null);
    2019    } catch(e) {
    2120        log("FAIL: Unable to reset server state: [" + e.message + "].");
    … …  
    2625
    2726    try {
    28         xhr.open("DELETE", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php", false);
     27        xhr.open("DELETE", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=method", true);
    2928    } catch(e) {
    3029        log("FAIL: Exception thrown. Cross-domain access is not allowed in first 'open'. [" + e.message + "].");
    … …  
    3231    }
    3332
    34     xhr.onreadystatechange = function() {
     33    xhr.onerror = function() {
    3534        xhr = new XMLHttpRequest();
    3635
    … …  
    3837            xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=complete", false);
    3938            try {
    40                 xhr.send("");
     39                xhr.send(null);
    4140            } catch(e) {
    4241                log("FAIL: Exception thrown. Cross-domain access is not allowed in second 'send'. [" + e.message + "].");
    … …  
    4948    }
    5049
    51     try {
    52         xhr.send("");
    53         log("FAIL: Cross-domain access allowed in first send without throwing an exception");
    54         return;
    55     } catch(e) {
    56         // Eat the exception.
     50    xhr.onreadystatechange = function() {
     51        if (xhr.readyState == 4 && xhr.status == 200)
     52            log("FAIL: Cross-domain access allowed in first send without throwing an exception");
    5753    }
    58    
     54
     55    xhr.send(null);
    5956})();
    6057</script>

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-async-not-supported.html

    r62778 r62779  
    88}
    99
    10 if (window.layoutTestController) {
     10if (window.layoutTestController)
    1111    layoutTestController.dumpAsText();
    12 }
    1312
    1413(function() {
    … …  
    1716    try {
    1817        xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=reset", false);
    19         xhr.send("");
     18        xhr.send(null);
    2019    } catch(e) {
    2120        log("FAIL: Unable to reset server state: [" + e.message + "].");
    … …  
    2625
    2726    try {
    28         xhr.open("DELETE", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php", false);
     27        xhr.open("PUT", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php", true);
    2928    } catch(e) {
    3029        log("FAIL: Exception thrown. Cross-domain access is not allowed in first 'open'. [" + e.message + "].");
    … …  
    3231    }
    3332
    34     xhr.onreadystatechange = function() {
     33    xhr.onerror = function() {
    3534        xhr = new XMLHttpRequest();
    3635
    … …  
    3837            xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=complete", false);
    3938            try {
    40                 xhr.send("");
     39                xhr.send(null);
    4140            } catch(e) {
    4241                log("FAIL: Exception thrown. Cross-domain access is not allowed in second 'send'. [" + e.message + "].");
    … …  
    4948    }
    5049
    51     try {
    52         xhr.send("");
    53         log("FAIL: Cross-domain access allowed in first send without throwing an exception");
    54         return;
    55     } catch(e) {
    56         // Eat the exception.
     50    xhr.onreadystatechange = function() {
     51        if (xhr.readyState == 4 && xhr.status == 200)
     52            log("FAIL: Cross-domain access allowed in first send without throwing an exception");
    5753    }
    58    
     54
     55    xhr.send("");
    5956})();
    6057</script>

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-sync-header-denied-expected.txt

    r62576 r62779  
    1 CONSOLE MESSAGE: line 1: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin response header.
     1CONSOLE MESSAGE: line 1: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=header. Request header field X-NON-STANDARD is not allowed by Access-Control-Allow-Headers response header field.
    22PASS: Request successfully blocked.
    33

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-sync-header-denied.html

    r57041 r62779  
    88}
    99
    10 if (window.layoutTestController) {
     10if (window.layoutTestController)
    1111    layoutTestController.dumpAsText();
    12 }
    1312
    1413(function() {
    … …  
    1716    try {
    1817        xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=reset", false);
    19         xhr.send("");
     18        xhr.send(null);
    2019    } catch(e) {
    2120        log("FAIL: Unable to reset server state: [" + e.message + "].");
    … …  
    2625
    2726    try {
    28         xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php", false);
     27        xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=header", false);
    2928        xhr.setRequestHeader("X-NON-STANDARD", "filler");
    3029    } catch(e) {
    … …  
    3433
    3534    try {
    36         xhr.send("");
     35        xhr.send(null);
    3736        log("FAIL: Cross-domain access allowed in first send without throwing an exception");
    3837        return;
    … …  
    5150
    5251    try {
    53         xhr.send("");
     52        xhr.send(null);
    5453    } catch(e) {
    5554        log("FAIL: Exception thrown. Cross-domain access is not allowed in second 'send'. [" + e.message + "].");

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-sync-method-denied-expected.txt

    r62576 r62779  
    1 CONSOLE MESSAGE: line 1: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php. Origin http://127.0.0.1:8000 is not allowed by Access-Control-Allow-Origin response header.
     1CONSOLE MESSAGE: line 1: XMLHttpRequest cannot load http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=method. Method DELETE is not allowed by Access-Control-Allow-Methods response header field.
    22PASS: Request successfully blocked.
    33

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-sync-method-denied.html

    r57041 r62779  
    88}
    99
    10 if (window.layoutTestController) {
     10if (window.layoutTestController)
    1111    layoutTestController.dumpAsText();
    12 }
    1312
    1413(function() {
    … …  
    1716    try {
    1817        xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=reset", false);
    19         xhr.send("");
     18        xhr.send(null);
    2019    } catch(e) {
    2120        log("FAIL: Unable to reset server state: [" + e.message + "].");
    … …  
    2625
    2726    try {
    28         xhr.open("DELETE", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php", false);
     27        xhr.open("DELETE", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=method", false);
    2928    } catch(e) {
    3029        log("FAIL: Exception thrown. Cross-domain access is not allowed in first 'open'. [" + e.message + "].");
    … …  
    3332
    3433    try {
    35         xhr.send("");
     34        xhr.send(null);
    3635        log("FAIL: Cross-domain access allowed in first send without throwing an exception");
    3736        return;
    … …  
    5049
    5150    try {
    52         xhr.send("");
     51        xhr.send(null);
    5352    } catch(e) {
    5453        log("FAIL: Exception thrown. Cross-domain access is not allowed in second 'send'. [" + e.message + "].");

  • trunk/LayoutTests/http/tests/xmlhttprequest/access-control-preflight-sync-not-supported.html

    r62778 r62779  
    88}
    99
    10 if (window.layoutTestController) {
     10if (window.layoutTestController)
    1111    layoutTestController.dumpAsText();
    12 }
    1312
    1413(function() {
    … …  
    1716    try {
    1817        xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php?state=reset", false);
    19         xhr.send("");
     18        xhr.send(null);
    2019    } catch(e) {
    2120        log("FAIL: Unable to reset server state: [" + e.message + "].");
    … …  
    2625
    2726    try {
    28         xhr.open("GET", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php", false);
    29         xhr.setRequestHeader("X-NON-STANDARD", "filler");
     27        xhr.open("PUT", "http://localhost:8000/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php", false);
    3028    } catch(e) {
    3129        log("FAIL: Exception thrown. Cross-domain access is not allowed in first 'open'. [" + e.message + "].");
    … …  
    3432
    3533    try {
    36         xhr.send("");
     34        xhr.send(null);
    3735        log("FAIL: Cross-domain access allowed in first send without throwing an exception");
    3836        return;
    … …  
    5149
    5250    try {
    53         xhr.send("");
     51        xhr.send(null);
    5452    } catch(e) {
    5553        log("FAIL: Exception thrown. Cross-domain access is not allowed in second 'send'. [" + e.message + "].");

  • trunk/LayoutTests/http/tests/xmlhttprequest/resources/access-control-preflight-denied-xsrf.php

    r57041 r62779  
    99    header("Access-Control-Allow-Credentials: true");
    1010    header("Access-Control-Allow-Methods: GET");
    11     header("Access-Control-Max-Age: 0");
     11    header("Access-Control-Max-Age: 1");
    1212    echo "FAILED: Issued a " . $_SERVER['REQUEST_METHOD'] . " request during state '" . $state . "'\n";
    1313    exit();
    … …  
    3333    if (file_exists($tmpFile)) unlink($tmpFile);
    3434    header("Access-Control-Allow-Origin: http://127.0.0.1:8000");
    35     header("Access-Control-Max-Age: 0");
     35    header("Access-Control-Max-Age: 1");
    3636    echo "Server state reset.\n";
    3737} else if ($state == "Uninitialized") {
    3838    if ($_SERVER['REQUEST_METHOD'] == "OPTIONS") {
    39         echo("Request Denied\n");
     39        if ($_GET['state'] == "method" || $_GET['state'] == "header") {
     40            header("Access-Control-Allow-Methods: GET");
     41            header("Access-Control-Allow-Origin: http://127.0.0.1:8000");
     42            header("Access-Control-Max-Age: 1");
     43        }
     44        echo("FAIL: This request should not be displayed.\n");
    4045        setState("Denied", $tmpFile);
    4146    } else {
    … …  
    4752        unlink($tmpFile);
    4853        header("Access-Control-Allow-Origin: http://127.0.0.1:8000");
    49         header("Access-Control-Max-Age: 0");
     54        header("Access-Control-Max-Age: 1");
    5055        echo "PASS: Request successfully blocked.\n";
    5156    } else {
Note: See TracChangeset for help on using the changeset viewer.