| <!DOCTYPE html> |
| <html> |
| <head> |
| <script src="/resources/testharness.js"></script> |
| <script src="/resources/testharnessreport.js"></script> |
| <script src="/security/contentSecurityPolicy/resources/cascade-helper.js"></script> |
| <meta http-equiv="content-security-policy" content="img-src http://127.0.0.1:8000 http://example.test:8000"> |
| </head> |
| <body> |
| <script> |
| async_test(t => { |
| assert_allowed_image_in_document(t, document, "http://example.test:8000/resources/square.png?img-in-top-level"); |
| }, "Image loaded in top-level blocked."); |
| |
| async_test(t => { |
| window.addEventListener("message", t.step_func(e => { |
| assert_equals(e.data, "blocked"); |
| t.done(); |
| })); |
| |
| var win = window.open("about:blank"); |
| win.document.write( |
| "<meta http-equiv='content-security-policy'" + |
| " content='img-src http://127.0.0.1:8000'>" + |
| "<script>" + |
| " var i = document.createElement('img');" + |
| " i.onload = _ => opener.postMessage('loaded', '*');" + |
| " i.onerror = _ => opener.postMessage('blocked', '*');" + |
| " i.src = 'http://example.test:8000/resources/square.png?data-frame'" + |
| "</scr" + "ipt>"); |
| }, "Image loaded via data: frame blocked."); |
| </script> |
| </body> |
| </html> |
