Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-28 15:23:51 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1381761 - Test data: URIs inherit the CSP even if treated as unique, opaque origins. r=dveditz

Browse Source
This commit is contained in:
Christoph Kerschbaumer 2017-08-04 14:10:38 +02:00
parent 9427f1bbd8
commit 8b999864f0
3 changed files with 57 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
dom/security/test/csp/file_data_csp_inheritance.html Normal file
View File

@ -0,0 +1,21 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Bug 1381761 - Treating 'data:' documents as unique, opaque origins should still inherit the CSP</title>
<meta charset="utf-8">
<meta http-equiv="Content-Security-Policy" content= "img-src 'none'"/>
</head>
<body>
<iframe id="dataFrame" src="data:text/html,<body>should inherit csp</body>"></iframe>
<script type="application/javascript">
// get the csp in JSON notation from the principal
var frame = document.getElementById("dataFrame");
var principal = SpecialPowers.wrap(frame.contentDocument).nodePrincipal;
var cspJSON = principal.cspJSON;
var result = principal.cspJSON ? "dataInheritsCSP" : "dataDoesNotInheritCSP";
window.parent.postMessage({result}, "*");
</script>
</body>
</html>

2
dom/security/test/csp/mochitest.ini
View File

@ -216,6 +216,7 @@ support-files =
file_ignore_xfo.html^headers^
file_ro_ignore_xfo.html
file_ro_ignore_xfo.html^headers^
file_data_csp_inheritance.html
file_data_csp_merge.html
[test_base-uri.html]
@ -308,4 +309,5 @@ tags = mcb
[test_websocket_self.html]
skip-if = toolkit == 'android'
[test_ignore_xfo.html]
[test_data_csp_inheritance.html]
[test_data_csp_merge.html]

34
dom/security/test/csp/test_data_csp_inheritance.html Normal file
View File

@ -0,0 +1,34 @@
<!DOCTYPE HTML>
<html>
<head>
<title>Bug 1381761 - Treating 'data:' documents as unique, opaque origins should still inherit the CSP</title>
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="testframe"></iframe>
<script class="testbody" type="text/javascript">
SimpleTest.waitForExplicitFinish();
/* Description of the test:
* We load an iframe using a meta CSP which includes another iframe
* using a data: URI. We make sure the CSP gets inherited into
* the data: URI iframe.
*/
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
window.removeEventListener("message", receiveMessage);
is(event.data.result, "dataInheritsCSP",
"data: URI iframe inherits CSP from including context");
SimpleTest.finish();
}
document.getElementById("testframe").src = "file_data_csp_inheritance.html";
</script>
</body>
</html>