mirror of
https://github.com/mozilla/gecko-dev.git
synced 2024-10-25 03:05:34 +00:00
131 lines
4.6 KiB
HTML
131 lines
4.6 KiB
HTML
<!DOCTYPE html>
|
|
<script src="/resources/testharness.js"></script>
|
|
<script src="/resources/testharnessreport.js"></script>
|
|
|
|
<meta http-equiv="content-security-policy" content="script-src 'nonce-abc'; img-src 'none'">
|
|
|
|
<body>
|
|
<!-- Basics -->
|
|
<script nonce="abc" id="testScript">
|
|
document.currentScript.setAttribute('executed', 'yay');
|
|
</script>
|
|
|
|
<script nonce="abc">
|
|
var script = document.querySelector('#testScript');
|
|
|
|
test(t => {
|
|
// Query Selector
|
|
assert_equals(document.querySelector('body [nonce]'), script);
|
|
assert_equals(document.querySelector('body [nonce=""]'), null);
|
|
assert_equals(document.querySelector('body [nonce=abc]'), script);
|
|
|
|
assert_equals(script.getAttribute('nonce'), 'abc');
|
|
assert_equals(script.nonce, 'abc');
|
|
}, "Reading 'nonce' content attribute and IDL attribute.");
|
|
|
|
// Clone node.
|
|
test(t => {
|
|
script.setAttribute('executed', 'boo');
|
|
var s2 = script.cloneNode();
|
|
assert_equals(s2.nonce, 'abc', 'IDL attribute');
|
|
assert_equals(s2.getAttribute('nonce'), 'abc');
|
|
}, "Cloned node retains nonce.");
|
|
|
|
async_test(t => {
|
|
var s2 = script.cloneNode();
|
|
document.head.appendChild(s2);
|
|
assert_equals(s2.nonce, 'abc');
|
|
assert_equals(s2.getAttribute('nonce'), 'abc');
|
|
window.addEventListener('load', t.step_func_done(_ => {
|
|
// The cloned script won't execute, as its 'already started' flag is set.
|
|
assert_equals(s2.getAttribute('executed'), 'boo');
|
|
}));
|
|
}, "Cloned node retains nonce when inserted.");
|
|
|
|
// Set the content attribute to 'foo'
|
|
test(t => {
|
|
script.setAttribute('nonce', 'foo');
|
|
assert_equals(script.getAttribute('nonce'), 'foo');
|
|
assert_equals(script.nonce, 'foo');
|
|
}, "Writing 'nonce' content attribute.");
|
|
|
|
// Set the IDL attribute to 'bar'
|
|
test(t => {
|
|
script.nonce = 'bar';
|
|
assert_equals(script.nonce, 'bar');
|
|
assert_equals(script.getAttribute('nonce'), 'foo');
|
|
}, "Writing 'nonce' IDL attribute.");
|
|
|
|
// Fragment parser.
|
|
var documentWriteTest = async_test("Document-written script executes.");
|
|
document.write(`<script nonce='abc'>
|
|
documentWriteTest.done();
|
|
test(t => {
|
|
var script = document.currentScript;
|
|
assert_equals(script.getAttribute('nonce'), 'abc');
|
|
assert_equals(script.nonce, 'abc');
|
|
}, "Document-written script's nonce value.");
|
|
</scr` + `ipt>`);
|
|
|
|
// Create node.
|
|
async_test(t => {
|
|
var s = document.createElement('script');
|
|
s.innerText = script.innerText;
|
|
s.nonce = 'abc';
|
|
document.head.appendChild(s);
|
|
assert_equals(s.nonce, 'abc');
|
|
assert_equals(s.getAttribute('nonce'), null);
|
|
|
|
window.addEventListener('load', t.step_func_done(_ => {
|
|
assert_equals(s.getAttribute('executed'), 'yay');
|
|
}));
|
|
}, "createElement.nonce.");
|
|
|
|
async_test(t => {
|
|
var s = document.createElement('script');
|
|
s.innerText = script.innerText;
|
|
s.nonce = 'zyx';
|
|
s.setAttribute('nonce', 'abc');
|
|
assert_equals(s.nonce, 'abc');
|
|
document.head.appendChild(s);
|
|
assert_equals(s.nonce, 'abc');
|
|
assert_equals(s.getAttribute('nonce'), 'abc');
|
|
|
|
window.addEventListener('load', t.step_func_done(_ => {
|
|
assert_equals(s.getAttribute('executed'), 'yay');
|
|
}));
|
|
}, "setAttribute('nonce') overwrites '.nonce' upon insertion.");
|
|
|
|
// Create node.
|
|
async_test(t => {
|
|
var s = document.createElement('script');
|
|
s.innerText = script.innerText;
|
|
s.setAttribute('nonce', 'abc');
|
|
assert_equals(s.getAttribute('nonce'), 'abc', "Pre-insertion content");
|
|
assert_equals(s.nonce, 'abc', "Pre-insertion IDL");
|
|
document.head.appendChild(s);
|
|
assert_equals(s.nonce, 'abc', "Post-insertion IDL");
|
|
assert_equals(s.getAttribute('nonce'), 'abc', "Post-insertion content");
|
|
|
|
window.addEventListener('load', t.step_func_done(_ => {
|
|
assert_equals(s.getAttribute('executed'), 'yay');
|
|
}));
|
|
}, "createElement.setAttribute.");
|
|
</script>
|
|
|
|
<!-- CSS Leakage -->
|
|
<style>
|
|
#cssTest { display: block; }
|
|
#cssTest[nonce=abc] { background: url(/security/resources/abe.png); }
|
|
</style>
|
|
<script nonce="abc" id="cssTest">
|
|
async_test(t => {
|
|
requestAnimationFrame(t.step_func_done(_ => {
|
|
var script = document.querySelector('#cssTest');
|
|
var style = getComputedStyle(script);
|
|
assert_equals(style['display'], 'block');
|
|
assert_equals(style['background-image'], "url(\"http://web-platform.test:8001/security/resources/abe.png\")");
|
|
}));
|
|
}, "Nonces leak via CSS side-channels.");
|
|
</script>
|