Skip to content

GitLab

T
tangled
Commit e86cafc8 authored by Andy Paicu's avatar Andy Paicu Committed by Commit Bot
Browse files
Options

Added a test to ensure that inherited CSP lists are copies 

When a new context is opened that inherits the CSP of the parent it
should make a copy of it. If any changes are done to the parent or child
CSP list they should be independant.

Spec change: https://github.com/w3c/webappsec-csp/pull/273

Bug: 789967
Change-Id: I27414e42f02e56d4903cf193192df9fb323093d2
Reviewed-on: https://chromium-review.googlesource.com/800691Reviewed-by: default avatarMike West <mkwst@chromium.org>
Commit-Queue: Andy Paicu <andypaicu@chromium.org>
Cr-Commit-Position: refs/heads/master@{#520910}
parent f7c95d3a
Hide whitespace changes
Inline Side-by-side
Showing with 49 additions and 0 deletions
third_party/WebKit/LayoutTests/external/wpt/content-security-policy/inheritance/inherited-csp-list-modifications-are-local.html 0 → 100644
View file @ e86cafc8
<!DOCTYPE html>
<head>
<meta http-equiv="Content-Security-Policy" content="script-src 'unsafe-inline' 'self'">
<script src="/resources/testharness.js"></script>
<script src="/resources/testharnessreport.js"></script>
<!-- Tests that mutations inside a context that inherits a copy of the CSP list
does not affect the parent context -->
</head>
<body>
<script>
var t1 = async_test("Test that parent document image loads");
var t2 = async_test("Test that embedded iframe document image does not load");
var t3 = async_test("Test that spv event is fired");
window.onmessage = function(e) {
if (e.data.type == 'spv') {
t3.step(function() {
assert_equals(e.data.violatedDirective, "img-src");
t3.done();
});
} else if (e.data.type == 'imgload') {
var img = document.createElement('img');
img.src = "../support/pass.png";
img.onload = function() { t1.done(); };
img.onerror = t1.unreached_func('Should have loaded the image');
document.body.appendChild(img);
t2.step(function() {
assert_false(e.data.loaded, "Should not have loaded image inside the frame because of its CSP");
t2.done();
});
}
}
var srcdoc = ['<meta http-equiv="Content-Security-Policy" content="img-src \'none\'">',
'<script>',
' window.addEventListener("securitypolicyviolation", function(e) {',
' window.top.postMessage({type: "spv", violatedDirective: e.violatedDirective}, "*");',
' });',
'</scr' + 'ipt>',
'<img src="../support/fail.png"',
' onload="window.top.postMessage({type: \'imgload\', loaded: true}, \'*\')"',
' onerror="window.top.postMessage({type: \'imgload\', loaded: false}, \'*\')">'].join('\n');
var i = document.createElement('iframe');
i.srcdoc = srcdoc;
document.body.appendChild(i);
</script>
</body>
</html>
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment