Skip to content

GitLab

T
tangled
Commit 9ef9a71c authored by Antonio Sartori's avatar Antonio Sartori Committed by Commit Bot
Browse files
Options

Add WPT for CSP frame-src 'self' on sandboxed embedder 

The Content-Security-Policy keyword 'self' in a source expression is a
placeholder for allowing sources with the same origin as the
document. Even if the document is sandboxed (i.e. has a unique opaque
origin), the keyword 'self' should match the document URL's origin.

This test checks that a document with CSPs:
    Content-Security-Policy: sandbox; frame-src 'self'
can still embed a frame delivered by the same document URL's origin.

Bug: 1151323
Change-Id: Icba5fb8a15bca30ab807ca81ae97152122efb292
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2552593
Commit-Queue: Antonio Sartori <antoniosartori@chromium.org>
Reviewed-by: default avatarArthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#830203}
parent 238ee77b
Hide whitespace changes
Inline Side-by-side
Showing with 37 additions and 0 deletions
third_party/blink/web_tests/external/wpt/content-security-policy/frame-src/frame-src-sandboxed-allowed-expected.txt 0 → 100644
View file @ 9ef9a71c
This is a testharness.js-based test.
FAIL SubframeLoaded assert_unreached: unexpected securitypolicyviolation Reached unreachable code
Harness: the test ran to completion.
third_party/blink/web_tests/external/wpt/content-security-policy/frame-src/frame-src-sandboxed-allowed.html 0 → 100644
View file @ 9ef9a71c
<!DOCTYPE html>
<html>
<head>
<title>Frame-src: 'self' matches even if the parent's origin is unique.</title>
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
</head>
<body>
<script>
var t = async_test('SubframeLoaded');
window.addEventListener('securitypolicyviolation', t.step_func(function(e) {
if (e.violatedDirective === "frame-src") {
assert_unreached('unexpected securitypolicyviolation');
t.done();
}
}));
window.addEventListener("message", t.step_func(function(event) {
assert_equals(event.data, "PASS", 'unexpected message: ' + event.data);
t.done();
}));
f = document.createElement("iframe");
f.src = "/content-security-policy/support/postmessage-pass.html";
document.body.appendChild(f);
</script>
</body>
</html>
third_party/blink/web_tests/external/wpt/content-security-policy/frame-src/frame-src-sandboxed-allowed.html.headers 0 → 100644
View file @ 9ef9a71c
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Security-Policy: frame-src 'self'; sandbox allow-scripts
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment