mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1469150 - Tests added to check scripts with valid nonce is allowed if URL redirects. r=ckerschb 

Reviewers: ckerschb

Reviewed By: ckerschb

Subscribers: ckerschb

Bug #: 1469150

Differential Revision: https://phabricator.services.mozilla.com/D1721

--HG--
extra : rebase_source : f600e601123f90ad3ab08b4fef6a791183419cd4
extra : amend_source : 854510827f78b43bf40cdbf7d782c25981190cf1
This commit is contained in:
vinoth 2018-06-22 20:38:05 +03:00
Родитель d2f222b912
Коммит 22ce31c828
4 изменённых файлов: 98 добавлений и 0 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

25
dom/security/test/csp/file_nonce_redirector.sjs Normal file
Просмотреть файл

@ -0,0 +1,25 @@
// custom *.sjs file for
// Bug 1469150:Scripts with valid nonce get blocked if URL redirects.
const URL_PATH = "example.com/tests/dom/security/test/csp/";
function handleRequest(request, response) {
response.setHeader("Cache-Control", "no-cache", false);
let queryStr = request.queryString;
if (queryStr === "redirect") {
response.setStatusLine("1.1", 302, "Found");
response.setHeader("Location",
"https://" + URL_PATH + "file_nonce_redirector.sjs?load", false);
return;
}
if (queryStr === "load") {
response.setHeader("Content-Type", "application/javascript", false);
response.write("console.log('script loaded');");
return;
}
// we should never get here - return something unexpected
response.write("d'oh");
}

23
dom/security/test/csp/file_nonce_redirects.html Normal file
Просмотреть файл

@ -0,0 +1,23 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset='utf-8'>
<meta http-equiv="Content-Security-Policy" content="script-src 'nonce-abcd1234'">
<title>Bug 1469150:Scripts with valid nonce get blocked if URL redirects</title>
</head>
<body>
<script nonce='abcd1234' id='redirectScript'></script>
<script nonce='abcd1234' type='application/javascript'>
var redirectScript = document.getElementById('redirectScript');
redirectScript.onload = function(e) {
window.parent.postMessage({result: 'script-loaded'}, '*');
};
redirectScript.onerror = function(e) {
window.parent.postMessage({result: 'script-blocked'}, '*');
}
redirectScript.src = 'file_nonce_redirector.sjs?redirect';
</script>
</body>
</html>

3
dom/security/test/csp/mochitest.ini
Просмотреть файл

@ -94,6 +94,8 @@ support-files =
file_policyuri_regression_from_multipolicy_policy
file_nonce_source.html
file_nonce_source.html^headers^
file_nonce_redirects.html
file_nonce_redirector.sjs
file_bug941404.html
file_bug941404_xhr.html
file_bug941404_xhr.html^headers^
@ -265,6 +267,7 @@ skip-if = verify
[test_frame_ancestors_ro.html]
[test_policyuri_regression_from_multipolicy.html]
[test_nonce_source.html]
[test_nonce_redirects.html]
[test_bug941404.html]
[test_form-action.html]
[test_hash_source.html]

47
dom/security/test/csp/test_nonce_redirects.html Normal file
Просмотреть файл

@ -0,0 +1,47 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Bug 1469150:Scripts with valid nonce get blocked if URL redirects</title>
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="testframe"></iframe>
<script class="testbody" type="text/javascript">
/* Description of the test:
* We load a script with a matching nonce, which redirects
* and we make sure that script is allowed.
*/
SimpleTest.waitForExplicitFinish();
function finishTest() {
window.removeEventListener("message", receiveMessage);
SimpleTest.finish();
}
function checkResults(aResult) {
if (aResult === "script-loaded") {
ok(true, "expected result: script loaded");
}
else {
ok(false, "unexpected result: script blocked");
}
finishTest();
}
window.addEventListener("message", receiveMessage);
function receiveMessage(event) {
checkResults(event.data.result);
}
document.getElementById("testframe").src = "file_nonce_redirects.html";
</script>
</body>
</html>