blob: d190be849c0c783c7b5f7efd5e28b28dd8d3998a [file] [log] [blame]
<!DOCTYPE html>
<html>
<head>
<title>Embedded Enforcement: Required-CSP header.</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<script src="support/testharness-helper.sub.js"></script>
</head>
<body>
<script>
// When this test starts passing please merge with required_csp-header.html
var tests = [
{ "name": "Wrong value of `csp` should not trigger sending Required-CSP Header.",
"csp": "completely wrong csp",
"expected": null},
];
tests.forEach(test => {
async_test(t => {
var url = generateURLString(Host.SAME_ORIGIN, PolicyHeader.REQUIRED_CSP);
assert_required_csp(t, url, test.csp, test.expected);
}, "Test same origin: " + test.name);
async_test(t => {
var url = generateURLString(Host.SAME_ORIGIN, PolicyHeader.REQUIRED_CSP);
var redirect_url = generateRedirect(Host.SAME_ORIGIN, url);
assert_required_csp(t, redirect_url, test.csp, test.expected);
}, "Test same origin redirect: " + test.name);
async_test(t => {
var url = generateURLString(Host.SAME_ORIGIN, PolicyHeader.REQUIRED_CSP);
var redirect_url = generateRedirect(Host.CROSS_ORIGIN, url);
assert_required_csp(t, redirect_url, test.csp, test.expected);
}, "Test cross origin redirect: " + test.name);
async_test(t => {
var url = generateURLString(Host.CROSS_ORIGIN, PolicyHeader.REQUIRED_CSP);
var redirect_url = generateRedirect(Host.CROSS_ORIGIN, url);
assert_required_csp(t, redirect_url, test.csp, test.expected);
}, "Test cross origin redirect of cross origin iframe: " + test.name);
async_test(t => {
var i = document.createElement('iframe');
if (test.csp)
i.csp = test.csp;
i.src = generateURLString(Host.SAME_ORIGIN, PolicyHeader.REQUIRED_CSP);
var loaded = false;
window.addEventListener('message', t.step_func(e => {
if (e.source != i.contentWindow || !('required_csp' in e.data))
return;
if (!loaded) {
assert_equals(test.expected, e.data['required_csp']);
loaded = true;
i.csp = "default-src 'unsafe-inline'";
i.src = generateURLString(Host.CROSS_ORIGIN, PolicyHeader.REQUIRED_CSP);
} else {
// Once iframe has loaded, check that on change of `src` attribute
// Required-CSP value is based on latest `csp` attribute value.
assert_equals("default-src 'unsafe-inline'", e.data['required_csp']);
t.done();
}
}));
document.body.appendChild(i);
}, "Test Required-CSP value on `csp` change: " + test.name);
});
</script>
</body>
</html>