diff --git a/testing/web-platform/tests/trusted-types/support/set-inner-html.js b/testing/web-platform/tests/trusted-types/support/set-inner-html.js
new file mode 100644
index 000000000000..45053d43e362
--- /dev/null
+++ b/testing/web-platform/tests/trusted-types/support/set-inner-html.js
@@ -0,0 +1,3 @@
+function setInnerHtml(element, value) {
+  element.innerHTML = value;
+}
diff --git a/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.tentative.html b/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.tentative.html
new file mode 100644
index 000000000000..61adb2993431
--- /dev/null
+++ b/testing/web-platform/tests/trusted-types/trusted-types-source-file-path.tentative.html
@@ -0,0 +1,76 @@
+<!DOCTYPE html>
+<head>
+  <title>
+    Check the reported TrustedType violation's sourceFile.
+  </title>
+  <script src="/resources/testharness.js"></script>
+  <script src="/resources/testharnessreport.js"></script>
+  <script src="/common/get-host-info.sub.js"></script>
+  <meta http-equiv="Content-Security-Policy"
+        content="require-trusted-types-for 'script'; trusted-types id">
+  </head>
+<body>
+
+<script id="to-be-modified"></script>
+<script>
+let toBeModified = document.querySelector("#to-be-modified");
+
+let id_policy = trustedTypes.createPolicy("id", {
+  createHTML: x => x,
+  createScriptURL: x => x,
+  createScript: x => x,
+});
+
+function futureViolation() {
+  return new Promise(r => addEventListener("securitypolicyviolation", r), {
+    once: true
+  });
+}
+
+function futureScript(url) {
+  return new Promise(r => {
+    let script = document.createElement("script");
+    script.src = id_policy.createScriptURL(url);
+    script.onload = r;
+    document.body.appendChild(script);
+  });
+}
+
+promise_test(async t => {
+  let future_violation = futureViolation();
+  assert_throws_js(TypeError, () => {
+    document.getElementById("to-be-modified").innerHTML = "'test'";
+  });
+  let violation = await future_violation;
+  assert_equals(violation.sourceFile, location.href)
+}, "same-document script")
+
+promise_test(async t => {
+  let script_origin = get_host_info().HTTP_ORIGIN;
+  let script_src = script_origin +
+    "/trusted-types/support/set-inner-html.js";
+  let script = await futureScript(script_src);
+  let future_violation = futureViolation();
+  assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'"));
+  let violation = await future_violation;
+  assert_equals(violation.sourceFile, script_src);
+}, "same-origin script")
+
+promise_test(async t => {
+  let script_origin = get_host_info().HTTP_REMOTE_ORIGIN;
+  let script_src = script_origin +
+    "/trusted-types/support/set-inner-html.js";
+  let script = await futureScript(script_src);
+  let future_violation = futureViolation();
+  assert_throws_js(TypeError, () => setInnerHtml(toBeModified, "'test'"));
+  let violation = await future_violation;
+  // TODO(https://crbug.com/1113163): Consider exposing the full path of the
+  // cross-origin script here instead of just its origin.
+  assert_equals(violation.sourceFile, script_origin);
+}, "cross-origin script")
+
+// TODO(arthursonzogni): Check what happens with redirects. Do we report the
+// request's URL or the response's URL?
+
+</script>
+</body>
