Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 05:41:12 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1316826 - Test for JS URLs and strict-dynamic. r=dveditz

Browse Source 
MozReview-Commit-ID: EKmYoZbap25
This commit is contained in:
Frederik Braun 2016-11-28 21:56:55 -05:00
parent 76e256d114
commit 29efcb86ac
3 changed files with 23 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
dom/security/test/csp/file_strict_dynamic_js_url.html Normal file
View File

@ -0,0 +1,15 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Bug 1316826 - 'strict-dynamic' blocking DOM event handlers</title>
</head>
<body>
<div id="testdiv">blocked</div>
<a id="jslink" href='javascript:document.getElementById("testdiv").innerHTML = "allowed"'>click me</a>
<script nonce="foo">
document.getElementById("jslink").click();
</script>
</body>
</html>

1
dom/security/test/csp/mochitest.ini
View File

@ -189,6 +189,7 @@ support-files =
file_upgrade_insecure_docwrite_iframe.sjs
file_data-uri_blocked.html
file_data-uri_blocked.html^headers^
file_strict_dynamic_js_url.html
file_strict_dynamic_script_events.html
file_strict_dynamic_script_events_xbl.html
file_strict_dynamic_script_inline.html

8
dom/security/test/csp/test_strict_dynamic.html
View File

@ -84,7 +84,13 @@ var tests = [
result: "blocked",
file: "file_strict_dynamic_script_events_xbl.html",
policy: "script-src 'strict-dynamic' 'nonce-foo'"
}
},
{
desc: "strict-dynamic with JS URLs should be blocked",
result: "blocked",
file: "file_strict_dynamic_js_url.html",
policy: "script-src 'strict-dynamic' 'nonce-foo'"
},
];
var counter = 0;