mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1635828 - Isolate HSTS per first-party when privacy.partition.network_state is set to true - part 2 - tests, r=timhuang 

Differential Revision: https://phabricator.services.mozilla.com/D74078
This commit is contained in:
Andrea Marchesini 2020-08-04 09:45:40 +00:00
Родитель c02bebbc3e
Коммит 263f055dd1
4 изменённых файлов: 88 добавлений и 0 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

1
security/manager/ssl/tests/mochitest/stricttransportsecurity/test_sts_privatebrowsing_perwindowpb.html
Просмотреть файл

@ -31,6 +31,7 @@
var mainWindow = window.browsingContext.topChromeWindow;
SpecialPowers.Services.prefs.setIntPref("browser.startup.page", 0);
SpecialPowers.Services.prefs.setBoolPref("privacy.partition.network_state", false);
var testframes = {
samedom: {

2
toolkit/components/antitracking/test/browser/browser.ini
Просмотреть файл

@ -155,3 +155,5 @@ support-files =
!/browser/components/originattributes/test/browser/file_thirdPartyChild.worker.xhr.html
!/browser/components/originattributes/test/browser/file_thirdPartyChild.xhr.html
[browser_staticPartition_network.js]
[browser_staticPartition_HSTS.js]
support-files = browser_staticPartition_HSTS.sjs

73
toolkit/components/antitracking/test/browser/browser_staticPartition_HSTS.js Normal file
Просмотреть файл

@ -0,0 +1,73 @@
/* Any copyright is dedicated to the Public Domain.
* http://creativecommons.org/publicdomain/zero/1.0/
*/
var unsecureEmptyURL =
"http://example.org/browser/toolkit/components/antitracking/test/browser/empty.html";
var secureURL =
"https://example.com/browser/toolkit/components/antitracking/test/browser/browser_staticPartition_HSTS.sjs";
var unsecureURL =
"http://example.com/browser/toolkit/components/antitracking/test/browser/browser_staticPartition_HSTS.sjs";
function cleanupHSTS() {
// Ensure to remove example.com from the HSTS list.
let sss = Cc["@mozilla.org/ssservice;1"].getService(
Ci.nsISiteSecurityService
);
sss.resetState(
Ci.nsISiteSecurityService.HEADER_HSTS,
NetUtil.newURI("http://example.com/"),
0
);
}
function promiseTabLoadEvent(aTab, aURL, aFinalURL) {
info("Wait for load tab event");
BrowserTestUtils.loadURI(aTab.linkedBrowser, aURL);
return BrowserTestUtils.browserLoaded(aTab.linkedBrowser, false, aFinalURL);
}
add_task(async function() {
for (let prefValue of [true, false]) {
await SpecialPowers.pushPrefEnv({
set: [["privacy.partition.network_state", prefValue]],
});
let tab = (gBrowser.selectedTab = BrowserTestUtils.addTab(gBrowser));
// Let's load the secureURL as first-party in order to activate HSTS.
await promiseTabLoadEvent(tab, secureURL, secureURL);
// Let's test HSTS: unsecure -> secure.
await promiseTabLoadEvent(tab, unsecureURL, secureURL);
ok(true, "unsecure -> secure, first-party works!");
// Let's load a first-party.
await promiseTabLoadEvent(tab, unsecureEmptyURL, unsecureEmptyURL);
let finalURL = await SpecialPowers.spawn(
tab.linkedBrowser,
[unsecureURL],
async url => {
return new content.Promise(resolve => {
let ifr = content.document.createElement("iframe");
ifr.onload = _ => {
resolve(ifr.contentWindow.location.href);
};
content.document.body.appendChild(ifr);
ifr.src = url;
});
}
);
if (prefValue) {
is(finalURL, unsecureURL, "HSTS doesn't work for 3rd parties");
} else {
is(finalURL, secureURL, "HSTS works for 3rd parties");
}
gBrowser.removeCurrentTab();
cleanupHSTS();
}
});

12
toolkit/components/antitracking/test/browser/browser_staticPartition_HSTS.sjs Normal file
Просмотреть файл

@ -0,0 +1,12 @@
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this file,
* You can obtain one at http://mozilla.org/MPL/2.0/. */
function handleRequest(request, response) {
let page = "<!DOCTYPE html><html><body><p>HSTS page</p></body></html>";
response.setStatusLine(request.httpVersion, "200", "OK");
response.setHeader("Strict-Transport-Security", "max-age=60");
response.setHeader("Content-Type", "text/html", false);
response.setHeader("Content-Length", page.length + "", false);
response.write(page);
}