Bug 1316826 - Test for JS URLs and strict-dynamic. r=dveditz

MozReview-Commit-ID: EKmYoZbap25
2016-11-28 21:56:55 -05:00 · 2016-11-28 21:56:55 -05:00 · 29efcb86ac
--- a/dom/security/test/csp/file_strict_dynamic_js_url.html
+++ b/dom/security/test/csp/file_strict_dynamic_js_url.html
@ -0,0 +1,15 @@
+<!DOCTYPE HTML>
+<html>
+<head>
+  <title>Bug 1316826 - 'strict-dynamic' blocking DOM event handlers</title>
+</head>
+<body>
+<div id="testdiv">blocked</div>
+
+<a id="jslink" href='javascript:document.getElementById("testdiv").innerHTML = "allowed"'>click me</a>
+<script nonce="foo">
+  document.getElementById("jslink").click();
+</script>
+
+</body>
+</html>
--- a/dom/security/test/csp/mochitest.ini
+++ b/dom/security/test/csp/mochitest.ini
@ -189,6 +189,7 @@ support-files =
  file_upgrade_insecure_docwrite_iframe.sjs
  file_data-uri_blocked.html
  file_data-uri_blocked.html^headers^
+  file_strict_dynamic_js_url.html
  file_strict_dynamic_script_events.html
  file_strict_dynamic_script_events_xbl.html
  file_strict_dynamic_script_inline.html
--- a/dom/security/test/csp/test_strict_dynamic.html
+++ b/dom/security/test/csp/test_strict_dynamic.html
@ -84,7 +84,13 @@ var tests = [
    result: "blocked",
    file: "file_strict_dynamic_script_events_xbl.html",
    policy: "script-src 'strict-dynamic' 'nonce-foo'"
-  }
+  },
+  {
+    desc: "strict-dynamic with JS URLs should be blocked",
+    result: "blocked",
+    file: "file_strict_dynamic_js_url.html",
+    policy: "script-src 'strict-dynamic' 'nonce-foo'"
+  },
 ];

 var counter = 0;