зеркало из https://github.com/mozilla/gecko-dev.git
Bug 663567 - Mochitest verifying that content added by XSLT stylesheet is subject to document's CSP. r=grobinson, r=sstamm
This commit is contained in:
Christoph Kerschbaumer
Родитель
ebed3ab7dc
Коммит
3321581523
|
|
@ -651,6 +651,12 @@ MOCHITEST_FILES_C= \
|
|||
test_CSP_bug888172.html \
|
||||
file_CSP_bug888172.html \
|
||||
file_CSP_bug888172.sjs \
|
||||
test_CSP_bug663567.html \
|
||||
file_CSP_bug663567_allows.xml \
|
||||
file_CSP_bug663567_allows.xml^headers^ \
|
||||
file_CSP_bug663567_allows.xsl \
|
||||
file_CSP_bug663567_blocks.xml \
|
||||
file_CSP_bug663567_blocks.xml^headers^ \
|
||||
$(NULL)
|
||||
|
||||
# OOP tests don't work on Windows (bug 763081) or native-fennec
|
||||
|
|
|
|||
|
|
@ -0,0 +1,28 @@
|
|||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
<?xml-stylesheet type="text/xsl" href="file_CSP_bug663567_allows.xsl"?>
|
||||
<catalog>
|
||||
<cd>
|
||||
<title>Empire Burlesque</title>
|
||||
<artist>Bob Dylan</artist>
|
||||
<country>USA</country>
|
||||
<company>Columbia</company>
|
||||
<price>10.90</price>
|
||||
<year>1985</year>
|
||||
</cd>
|
||||
<cd>
|
||||
<title>Hide your heart</title>
|
||||
<artist>Bonnie Tyler</artist>
|
||||
<country>UK</country>
|
||||
<company>CBS Records</company>
|
||||
<price>9.90</price>
|
||||
<year>1988</year>
|
||||
</cd>
|
||||
<cd>
|
||||
<title>Greatest Hits</title>
|
||||
<artist>Dolly Parton</artist>
|
||||
<country>USA</country>
|
||||
<company>RCA</company>
|
||||
<price>9.90</price>
|
||||
<year>1982</year>
|
||||
</cd>
|
||||
</catalog>
|
||||
|
|
@ -0,0 +1 @@
|
|||
Content-Security-Policy: default-src 'self'
|
||||
|
|
@ -0,0 +1,27 @@
|
|||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
<!-- Edited by XMLSpy® -->
|
||||
<xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.org/1999/XSL/Transform">
|
||||
|
||||
<xsl:template match="/">
|
||||
<html>
|
||||
<body>
|
||||
<h2 id="xsltheader">this xml file should be formatted using an xsl file(lower iframe should contain xml dump)!</h2>
|
||||
<table border="1">
|
||||
<tr bgcolor="#990099">
|
||||
<th>Title</th>
|
||||
<th>Artist</th>
|
||||
<th>Price</th>
|
||||
</tr>
|
||||
<xsl:for-each select="catalog/cd">
|
||||
<tr>
|
||||
<td><xsl:value-of select="title"/></td>
|
||||
<td><xsl:value-of select="artist"/></td>
|
||||
<td><xsl:value-of select="price"/></td>
|
||||
</tr>
|
||||
</xsl:for-each>
|
||||
</table>
|
||||
</body>
|
||||
</html>
|
||||
</xsl:template>
|
||||
</xsl:stylesheet>
|
||||
|
||||
|
|
@ -0,0 +1,28 @@
|
|||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
<?xml-stylesheet type="text/xsl" href="http://example.org/tests/content/base/test/file_CSP_bug663567_blocks.xsl"?>
|
||||
<catalog>
|
||||
<cd>
|
||||
<title>Empire Burlesque</title>
|
||||
<artist>Bob Dylan</artist>
|
||||
<country>USA</country>
|
||||
<company>Columbia</company>
|
||||
<price>10.90</price>
|
||||
<year>1985</year>
|
||||
</cd>
|
||||
<cd>
|
||||
<title>Hide your heart</title>
|
||||
<artist>Bonnie Tyler</artist>
|
||||
<country>UK</country>
|
||||
<company>CBS Records</company>
|
||||
<price>9.90</price>
|
||||
<year>1988</year>
|
||||
</cd>
|
||||
<cd>
|
||||
<title>Greatest Hits</title>
|
||||
<artist>Dolly Parton</artist>
|
||||
<country>USA</country>
|
||||
<company>RCA</company>
|
||||
<price>9.90</price>
|
||||
<year>1982</year>
|
||||
</cd>
|
||||
</catalog>
|
||||
|
|
@ -0,0 +1 @@
|
|||
Content-Security-Policy: default-src 'self'
|
||||
|
|
@ -0,0 +1,82 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<title>Test if XSLT stylesheet is subject to document's CSP</title>
|
||||
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
|
||||
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
||||
</head>
|
||||
<body>
|
||||
<p id="display"></p>
|
||||
<div id="content" style="display: none"></div>
|
||||
<iframe style="width:100%;" id='xsltframe'></iframe>
|
||||
<iframe style="width:100%;" id='xsltframe2'></iframe>
|
||||
|
||||
<script class="testbody" type="text/javascript">
|
||||
|
||||
SimpleTest.waitForExplicitFinish();
|
||||
|
||||
// define the expected output of this test
|
||||
var header = "this xml file should be formatted using an xsl file(lower iframe should contain xml dump)!";
|
||||
|
||||
var finishedTests = 0;
|
||||
var numberOfTests = 2;
|
||||
|
||||
var checkExplicitFinish = function() {
|
||||
finishedTests++;
|
||||
if (finishedTests == numberOfTests) {
|
||||
SimpleTest.finish();
|
||||
}
|
||||
}
|
||||
|
||||
function checkAllowed () {
|
||||
/* The policy for this test is:
|
||||
* Content-Security-Policy: default-src 'self'
|
||||
*
|
||||
* we load the xsl file using:
|
||||
* <?xml-stylesheet type="text/xsl" href="file_CSP_bug663467_allows.xsl"?>
|
||||
*/
|
||||
try {
|
||||
var cspframe = document.getElementById('xsltframe');
|
||||
var xsltAllowedHeader = cspframe.contentWindow.document.getElementById('xsltheader').innerHTML;
|
||||
is(xsltAllowedHeader, header, "XSLT loaded from 'self' should be allowed!");
|
||||
}
|
||||
catch (e) {
|
||||
ok(false, "Error: could not access content in xsltframe!")
|
||||
}
|
||||
checkExplicitFinish();
|
||||
}
|
||||
|
||||
function checkBlocked () {
|
||||
/* The policy for this test is:
|
||||
* Content-Security-Policy: default-src 'self'
|
||||
*
|
||||
* we load the xsl file using:
|
||||
* <?xml-stylesheet type="text/xsl"
|
||||
* href="http://example.org/tests/content/base/test/file_CSP_bug663467_blocks.xsl"?>
|
||||
*/
|
||||
try {
|
||||
var cspframe = document.getElementById('xsltframe2');
|
||||
var xsltBlockedHeader = cspframe.contentWindow.document.getElementById('xsltheader');
|
||||
is(xsltBlockedHeader, null, "XSLT loaded from different host should be blocked!");
|
||||
}
|
||||
catch (e) {
|
||||
ok(false, "Error: could not access content in xsltframe2!")
|
||||
}
|
||||
checkExplicitFinish();
|
||||
}
|
||||
|
||||
SpecialPowers.pushPrefEnv(
|
||||
{'set':[["security.csp.speccompliant", true]]},
|
||||
function () {
|
||||
document.getElementById('xsltframe').addEventListener('load', checkAllowed, false);
|
||||
document.getElementById('xsltframe').src = 'file_CSP_bug663567_allows.xml';
|
||||
|
||||
document.getElementById('xsltframe2').addEventListener('load', checkBlocked, false);
|
||||
document.getElementById('xsltframe2').src = 'file_CSP_bug663567_blocks.xml';
|
||||
}
|
||||
);
|
||||
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
Загрузка…
Ссылка в новой задаче