Magic-Mirror/gecko-dev
1
0
Fork 0
mirror of https://github.com/mozilla/gecko-dev.git synced 2024-11-25 22:01:30 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Bug 1251152 - Part 3: Test case. r=franziskus

Browse Source
This commit is contained in:
Henry Chang 2016-05-05 11:11:34 +08:00
parent a4d43fbbf9
commit dc7cba21ef
5 changed files with 49 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
dom/security/test/contentverifier/browser.ini
View File

@ -3,6 +3,8 @@ support-files =
file_contentserver.sjs
file_about_newtab.html
file_about_newtab_bad.html
file_about_newtab_bad_csp.html
file_about_newtab_bad_csp_signature
file_about_newtab_good_signature
file_about_newtab_bad_signature
file_about_newtab_broken_signature

25
dom/security/test/contentverifier/browser_verify_content_about_newtab.js
View File

@ -36,6 +36,7 @@ const URI_BROKEN_SIG = BASE + "sig=broken&key=good&file=good&header=good";
const URI_BAD_KEY = BASE + "sig=good&key=bad&file=good&header=good";
const URI_BAD_FILE = BASE + "sig=good&key=good&file=bad&header=good";
const URI_BAD_ALL = BASE + "sig=bad&key=bad&file=bad&header=bad";
const URI_BAD_CSP = BASE + "sig=bad-csp&key=good&file=bad-csp&header=good";
const URI_BAD_FILE_CACHED = BASE + "sig=good&key=good&file=bad&header=good&cached=true";
@ -54,6 +55,11 @@ const SCRIPT_WITHOUT_SRI_BLOCKED = "Script without SRI blocked";
const SCRIPT_WITH_SRI_BLOCKED = "Script with SRI blocked";
const SCRIPT_WITH_SRI_LOADED = "Script with SRI loaded";
const CSP_TEST_SUCCESS_STRING = "CSP violation test succeeded.";
// Needs to sync with pref "security.signed_content.CSP.default".
const SIGNED_CONTENT_CSP = `{"csp-policies":[{"report-only":false,"script-src":["https://example.com","'unsafe-inline'"],"style-src":["https://example.com"]}]}`;
const TESTS = [
// { newtab (aboutURI) or regular load (url) : url,
// testStrings : expected strings in the loaded page }
@ -76,6 +82,7 @@ const TESTS = [
SCRIPT_WITHOUT_SRI_BLOCKED,
SCRIPT_WITH_SRI_LOADED,
]},
{ "aboutURI" : URI_BAD_CSP, "testStrings" : [CSP_TEST_SUCCESS_STRING] },
{ "url" : URI_CLEANUP, "testStrings" : [CLEANUP_DONE] },
];
@ -113,6 +120,14 @@ function doTest(aExpectedStrings, reload, aUrl, aNewTabPref) {
"Me1+f7wRmkNrCUojZR1ZKmYM2BeiUOMlMoqk2O7+uwsn1DwNQSYP58TkvZt6"
]);
if (aNewTabPref === URI_BAD_CSP) {
// Use stricter CSP to test CSP violation.
yield pushPrefs(["security.signed_content.CSP.default", "script-src 'self'; style-src 'self'"]);
} else {
// Use weaker CSP to test normal content.
yield pushPrefs(["security.signed_content.CSP.default", "script-src 'self' 'unsafe-inline'; style-src 'self'"]);
}
// start the test
yield BrowserTestUtils.withNewTab({
gBrowser,
@ -132,6 +147,16 @@ function doTest(aExpectedStrings, reload, aUrl, aNewTabPref) {
is(aboutNewTabService.newTabURL, aNewTabPref,
"sanity check: default URL for about:newtab should return the new URL");
}
// Every valid remote newtab page must have built-in CSP.
let shouldHaveCSP = ((aUrl === ABOUT_NEWTAB_URI) &&
(aNewTabPref === URI_GOOD || aNewTabPref === URI_SRI));
if (shouldHaveCSP) {
is(browser.contentDocument.nodePrincipal.cspJSON, SIGNED_CONTENT_CSP,
"Valid remote newtab page must have built-in CSP.");
}
yield ContentTask.spawn(
browser, aExpectedStrings, function * (aExpectedStrings) {
for (let expectedString of aExpectedStrings) {

14
dom/security/test/contentverifier/file_about_newtab_bad_csp.html Normal file
View File

@ -0,0 +1,14 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Testpage for CSP violation (inline script)</title>
</head>
<body>
CSP violation test succeeded.
<script>
// This inline script would override the success string if loaded.
document.body.innerHTML = "CSP violation test failed.";
</script>
</body>
</html>

1
dom/security/test/contentverifier/file_about_newtab_bad_csp_signature Normal file
View File

@ -0,0 +1 @@
8qXVAqzuF3TsF6C750u_v_JiRu90WJXf_0xT9x0S4Fgmvolgtfu-KSWq3lYpmk2dxO8u64zaHM3iguZdWAqcSL82RFtV7OPiprt16omCbHCKfVi-Bt_rXILRlexgmRl_

7
dom/security/test/contentverifier/file_contentserver.sjs
View File

@ -24,6 +24,9 @@ const badKeyId = "OldRemoteNewTabKey";
const sriFile = path + "file_about_newtab_sri.html";
const sriSignature = path + "file_about_newtab_sri_signature";
const badCspFile = path + "file_about_newtab_bad_csp.html";
const badCspSignature = path + "file_about_newtab_bad_csp_signature";
const tempFileNames = [goodFileName, scriptFileName, cssFileName];
// we copy the file to serve as newtab to a temp directory because
@ -195,11 +198,15 @@ function handleRequest(request, response) {
signature = brokenSignature;
} else if (signatureType == "sri") {
signature = sriSignature;
} else if (signatureType == "bad-csp") {
signature = badCspSignature;
}
if (fileType == "bad") {
file = getFileName(badFile, "CurWorkD");
} else if (fileType == "sri") {
file = getFileName(sriFile, "CurWorkD");
} else if (fileType == "bad-csp") {
file = getFileName(badCspFile, "CurWorkD");
}
if (headerType == "good") {