From 71be27aeaacaeb1bc21ce483d56f0e1434062b09 Mon Sep 17 00:00:00 2001
From: cegvinoth <cegvinoth@gmail.com>
Date: Fri, 2 Feb 2018 09:34:19 +0100
Subject: [PATCH] Bug 1409706 - Files added for CSP WPT for
 worker-src,child-src,script-src,default fallback behaviour, r=ckerschb

--HG--
extra : rebase_source : 3b28f1396b168873cf98d772b1ac5e93bae5fe2f
---
 testing/web-platform/meta/MANIFEST.json       | 147 ++++++++++++++++++
 .../support/dedicated-worker-helper.js        |   2 +
 .../support/service-worker-helper.js          |   2 +
 .../support/shared-worker-helper.js           |   2 +
 ...dicated-worker-src-child-fallback.sub.html |   9 ++
 ...cated-worker-src-default-fallback.sub.html |   8 +
 ...icated-worker-src-script-fallback.sub.html |   8 +
 ...edicated-worker-src-self-fallback.sub.html |   9 ++
 ...e-worker-src-child-fallback.https.sub.html |   9 ++
 ...worker-src-default-fallback.https.sub.html |   8 +
 ...-worker-src-script-fallback.https.sub.html |   8 +
 ...ce-worker-src-self-fallback.https.sub.html |   9 ++
 .../shared-worker-src-child-fallback.sub.html |   9 ++
 ...hared-worker-src-default-fallback.sub.html |   8 +
 ...shared-worker-src-script-fallback.sub.html |   8 +
 .../shared-worker-src-self-fallback.sub.html  |   9 ++
 16 files changed, 255 insertions(+)
 create mode 100644 testing/web-platform/tests/content-security-policy/support/dedicated-worker-helper.js
 create mode 100644 testing/web-platform/tests/content-security-policy/support/service-worker-helper.js
 create mode 100644 testing/web-platform/tests/content-security-policy/support/shared-worker-helper.js
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-child-fallback.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-default-fallback.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-script-fallback.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-child-fallback.https.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-default-fallback.https.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-script-fallback.https.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-self-fallback.https.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-child-fallback.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-default-fallback.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-script-fallback.sub.html
 create mode 100644 testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-self-fallback.sub.html

diff --git a/testing/web-platform/meta/MANIFEST.json b/testing/web-platform/meta/MANIFEST.json
index 272495480040..f6c9f9342ae1 100644
--- a/testing/web-platform/meta/MANIFEST.json
+++ b/testing/web-platform/meta/MANIFEST.json
@@ -210492,6 +210492,11 @@
      {}
     ]
    ],
+   "content-security-policy/support/dedicated-worker-helper.js": [
+    [
+     {}
+    ]
+   ],
    "content-security-policy/support/document-write-alert-fail.js": [
     [
      {}
@@ -210617,6 +210622,16 @@
      {}
     ]
    ],
+   "content-security-policy/support/service-worker-helper.js": [
+    [
+     {}
+    ]
+   ],
+   "content-security-policy/support/shared-worker-helper.js": [
+    [
+     {}
+    ]
+   ],
    "content-security-policy/support/siblingPath.js": [
     [
      {}
@@ -305160,6 +305175,30 @@
      {}
     ]
    ],
+   "content-security-policy/worker-src/dedicated-worker-src-child-fallback.sub.html": [
+    [
+     "/content-security-policy/worker-src/dedicated-worker-src-child-fallback.sub.html",
+     {}
+    ]
+   ],
+   "content-security-policy/worker-src/dedicated-worker-src-default-fallback.sub.html": [
+    [
+     "/content-security-policy/worker-src/dedicated-worker-src-default-fallback.sub.html",
+     {}
+    ]
+   ],
+   "content-security-policy/worker-src/dedicated-worker-src-script-fallback.sub.html": [
+    [
+     "/content-security-policy/worker-src/dedicated-worker-src-script-fallback.sub.html",
+     {}
+    ]
+   ],
+   "content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub.html": [
+    [
+     "/content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub.html",
+     {}
+    ]
+   ],
    "content-security-policy/worker-src/service-child.https.sub.html": [
     [
      "/content-security-policy/worker-src/service-child.https.sub.html",
@@ -305190,6 +305229,30 @@
      {}
     ]
    ],
+   "content-security-policy/worker-src/service-worker-src-child-fallback.https.sub.html": [
+    [
+     "/content-security-policy/worker-src/service-worker-src-child-fallback.https.sub.html",
+     {}
+    ]
+   ],
+   "content-security-policy/worker-src/service-worker-src-default-fallback.https.sub.html": [
+    [
+     "/content-security-policy/worker-src/service-worker-src-default-fallback.https.sub.html",
+     {}
+    ]
+   ],
+   "content-security-policy/worker-src/service-worker-src-script-fallback.https.sub.html": [
+    [
+     "/content-security-policy/worker-src/service-worker-src-script-fallback.https.sub.html",
+     {}
+    ]
+   ],
+   "content-security-policy/worker-src/service-worker-src-self-fallback.https.sub.html": [
+    [
+     "/content-security-policy/worker-src/service-worker-src-self-fallback.https.sub.html",
+     {}
+    ]
+   ],
    "content-security-policy/worker-src/shared-child.sub.html": [
     [
      "/content-security-policy/worker-src/shared-child.sub.html",
@@ -305220,6 +305283,30 @@
      {}
     ]
    ],
+   "content-security-policy/worker-src/shared-worker-src-child-fallback.sub.html": [
+    [
+     "/content-security-policy/worker-src/shared-worker-src-child-fallback.sub.html",
+     {}
+    ]
+   ],
+   "content-security-policy/worker-src/shared-worker-src-default-fallback.sub.html": [
+    [
+     "/content-security-policy/worker-src/shared-worker-src-default-fallback.sub.html",
+     {}
+    ]
+   ],
+   "content-security-policy/worker-src/shared-worker-src-script-fallback.sub.html": [
+    [
+     "/content-security-policy/worker-src/shared-worker-src-script-fallback.sub.html",
+     {}
+    ]
+   ],
+   "content-security-policy/worker-src/shared-worker-src-self-fallback.sub.html": [
+    [
+     "/content-security-policy/worker-src/shared-worker-src-self-fallback.sub.html",
+     {}
+    ]
+   ],
    "cookie-store/cookieStore_delete_arguments.tentative.window.js": [
     [
      "/cookie-store/cookieStore_delete_arguments.tentative.window.html",
@@ -412737,6 +412824,10 @@
    "06b0c4f4a36a7bd4d323d1920a1a3e2caa9b52dc",
    "support"
   ],
+  "content-security-policy/support/dedicated-worker-helper.js": [
+   "c2ee371b1ca6b56d4579032db79470d38dc7fad9",
+   "support"
+  ],
   "content-security-policy/support/document-write-alert-fail.js": [
    "55f9e74adccef83969d5da859a05bf670f711671",
    "support"
@@ -412837,6 +412928,14 @@
    "e6e5eb285a3988173c49a116b1ae8a76f9f7ab1a",
    "support"
   ],
+  "content-security-policy/support/service-worker-helper.js": [
+   "dada4b697830bd56b771e02de8460dffcb3a494e",
+   "support"
+  ],
+  "content-security-policy/support/shared-worker-helper.js": [
+   "7e7b17341425d222d440f2f4607ee40ff020efe6",
+   "support"
+  ],
   "content-security-policy/support/siblingPath.js": [
    "1743309038e2aef21670a82973c1cea2fbc01253",
    "support"
@@ -412957,6 +413056,22 @@
    "ec579a530ae0f44e387ed400d5b923cdb8203dc7",
    "testharness"
   ],
+  "content-security-policy/worker-src/dedicated-worker-src-child-fallback.sub.html": [
+   "1206a6f00c5cf43da1327625fb7c97ce9f63a868",
+   "testharness"
+  ],
+  "content-security-policy/worker-src/dedicated-worker-src-default-fallback.sub.html": [
+   "abc576c3a0adc9e3a68b5449aeb1477f6b50f6b1",
+   "testharness"
+  ],
+  "content-security-policy/worker-src/dedicated-worker-src-script-fallback.sub.html": [
+   "a5a34c8184397fc38b1949e798f23e0799aade1a",
+   "testharness"
+  ],
+  "content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub.html": [
+   "8fee6e7d738c6cc9a22883cde366e395f346f5d4",
+   "testharness"
+  ],
   "content-security-policy/worker-src/service-child.https.sub.html": [
    "0ccf56794d55c4ea8800cbe8f0805fd02450549f",
    "testharness"
@@ -412977,6 +413092,22 @@
    "561c9a2ce0d4c1b9e148cad2ca5bad4b17517e9e",
    "testharness"
   ],
+  "content-security-policy/worker-src/service-worker-src-child-fallback.https.sub.html": [
+   "90d70a062e718daf5013f3b12662066b6edb1692",
+   "testharness"
+  ],
+  "content-security-policy/worker-src/service-worker-src-default-fallback.https.sub.html": [
+   "0a115336d748892edd4afc99467ae558080789f4",
+   "testharness"
+  ],
+  "content-security-policy/worker-src/service-worker-src-script-fallback.https.sub.html": [
+   "c770ac48a17b74d54bcde8a8f721fd506da81a6b",
+   "testharness"
+  ],
+  "content-security-policy/worker-src/service-worker-src-self-fallback.https.sub.html": [
+   "ee7276b72994909e0c504f5d3ef0fe526f898e7a",
+   "testharness"
+  ],
   "content-security-policy/worker-src/shared-child.sub.html": [
    "1bc3004b63255bdb75f6660ab81870d08b96e74c",
    "testharness"
@@ -412997,6 +413128,22 @@
    "ff4d7ca289ea20fa00bca535fdcf929876a2278b",
    "testharness"
   ],
+  "content-security-policy/worker-src/shared-worker-src-child-fallback.sub.html": [
+   "8cc98872cd4fe0ed2e411d74ba4c79684fb1b312",
+   "testharness"
+  ],
+  "content-security-policy/worker-src/shared-worker-src-default-fallback.sub.html": [
+   "7ff188d280b8b5af15da54a75201ed5e68804c42",
+   "testharness"
+  ],
+  "content-security-policy/worker-src/shared-worker-src-script-fallback.sub.html": [
+   "d1a3d6e2848bd03fb46ad4be6e312ddc501e9f5c",
+   "testharness"
+  ],
+  "content-security-policy/worker-src/shared-worker-src-self-fallback.sub.html": [
+   "599143e3733f0ea7dc3cbaa6b03de0a7b8e93acf",
+   "testharness"
+  ],
   "cookie-store/OWNERS": [
    "9e68d9eb0784e10786bd8b0c6009afb42516acdc",
    "support"
diff --git a/testing/web-platform/tests/content-security-policy/support/dedicated-worker-helper.js b/testing/web-platform/tests/content-security-policy/support/dedicated-worker-helper.js
new file mode 100644
index 000000000000..c1ed208e931e
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/support/dedicated-worker-helper.js
@@ -0,0 +1,2 @@
+var url = new URL("../support/ping.js", document.baseURI).toString();
+assert_worker_is_loaded(url, document.getElementById("foo").getAttribute("data-desc-fallback"));
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/support/service-worker-helper.js b/testing/web-platform/tests/content-security-policy/support/service-worker-helper.js
new file mode 100644
index 000000000000..4e8f8b5f5d2e
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/support/service-worker-helper.js
@@ -0,0 +1,2 @@
+var url = new URL("../support/ping.js", document.baseURI).toString();
+assert_service_worker_is_loaded(url, document.getElementById("foo").getAttribute("data-desc-fallback"));
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/support/shared-worker-helper.js b/testing/web-platform/tests/content-security-policy/support/shared-worker-helper.js
new file mode 100644
index 000000000000..d0637ec47171
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/support/shared-worker-helper.js
@@ -0,0 +1,2 @@
+var url = new URL("../support/ping.js", document.baseURI).toString();
+assert_shared_worker_is_loaded(url, document.getElementById("foo").getAttribute("data-desc-fallback"));
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-child-fallback.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-child-fallback.sub.html
new file mode 100644
index 000000000000..9c37dfb63014
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-child-fallback.sub.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for dedicated worker allowed by child-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
+<meta http-equiv="Content-Security-Policy" content="child-src 'self'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
+<script src="../support/dedicated-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin dedicated worker allowed by child-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-default-fallback.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-default-fallback.sub.html
new file mode 100644
index 000000000000..5bded3f59a05
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-default-fallback.sub.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for dedicated worker allowed by default-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<meta http-equiv="Content-Security-Policy" content="default-src 'self'">
+<script src="../support/dedicated-worker-helper.js" id="foo" data-desc-fallback="Same-origin dedicated worker allowed by default-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-script-fallback.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-script-fallback.sub.html
new file mode 100644
index 000000000000..ca922076762c
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-script-fallback.sub.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for dedicated worker allowed by script-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<meta http-equiv="Content-Security-Policy" content="script-src 'self'; default-src 'none'; ">
+<script src="../support/dedicated-worker-helper.js" id="foo" data-desc-fallback="Same-origin dedicated worker allowed by script-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub.html
new file mode 100644
index 000000000000..06e79db00628
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/dedicated-worker-src-self-fallback.sub.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for dedicated worker allowed by worker-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
+<meta http-equiv="Content-Security-Policy" content="worker-src 'self'; child-src 'none'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
+<script src="../support/dedicated-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin dedicated worker allowed by worker-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-child-fallback.https.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-child-fallback.https.sub.html
new file mode 100644
index 000000000000..0053b1098aa0
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-child-fallback.https.sub.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for service worker allowed by child-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
+<meta http-equiv="Content-Security-Policy" content="child-src 'self'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
+<script src="../support/service-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin service worker allowed by child-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-default-fallback.https.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-default-fallback.https.sub.html
new file mode 100644
index 000000000000..f9df743909f3
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-default-fallback.https.sub.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for service worker allowed by default-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<meta http-equiv="Content-Security-Policy" content="default-src 'self'">
+<script src="../support/service-worker-helper.js" id="foo" data-desc-fallback="Same-origin service worker allowed by default-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-script-fallback.https.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-script-fallback.https.sub.html
new file mode 100644
index 000000000000..ce03f24f176b
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-script-fallback.https.sub.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for service worker allowed by script-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<meta http-equiv="Content-Security-Policy" content="script-src 'self'; default-src 'none'; ">
+<script src="../support/service-worker-helper.js" id="foo" data-desc-fallback="Same-origin service worker allowed by script-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-self-fallback.https.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-self-fallback.https.sub.html
new file mode 100644
index 000000000000..58bc8cdb7a7a
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/service-worker-src-self-fallback.https.sub.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for service worker allowed by worker-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
+<meta http-equiv="Content-Security-Policy" content="worker-src 'self'; child-src 'none'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
+<script src="../support/service-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin service worker allowed by worker-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-child-fallback.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-child-fallback.sub.html
new file mode 100644
index 000000000000..53510852ef0d
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-child-fallback.sub.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for shared worker allowed by child-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
+<meta http-equiv="Content-Security-Policy" content="child-src 'self'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
+<script src="../support/shared-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin shared worker allowed by child-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-default-fallback.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-default-fallback.sub.html
new file mode 100644
index 000000000000..4a07db76aaeb
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-default-fallback.sub.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for shared worker allowed by default-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<meta http-equiv="Content-Security-Policy" content="default-src 'self'">
+<script src="../support/shared-worker-helper.js" id="foo" data-desc-fallback="Same-origin shared worker allowed by default-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-script-fallback.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-script-fallback.sub.html
new file mode 100644
index 000000000000..0a854da3ad22
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-script-fallback.sub.html
@@ -0,0 +1,8 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for shared worker allowed by script-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<meta http-equiv="Content-Security-Policy" content="script-src 'self'; default-src 'none'; ">
+<script src="../support/shared-worker-helper.js" id="foo" data-desc-fallback="Same-origin shared worker allowed by script-src 'self'."></script>
\ No newline at end of file
diff --git a/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-self-fallback.sub.html b/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-self-fallback.sub.html
new file mode 100644
index 000000000000..353a3a0d51b3
--- /dev/null
+++ b/testing/web-platform/tests/content-security-policy/worker-src/shared-worker-src-self-fallback.sub.html
@@ -0,0 +1,9 @@
+<!doctype html>
+<meta charset=utf-8>
+<title>Web platform test for shared worker allowed by worker-src self</title>
+<script src=/resources/testharness.js></script>
+<script src=/resources/testharnessreport.js></script>
+<script src="../support/testharness-helper.js"></script>
+<!-- Ideally we would use "script-src 'none'" alone but we have to whitelist the actual script that spawns the workers, hence the nonce.-->
+<meta http-equiv="Content-Security-Policy" content="worker-src 'self'; child-src 'none'; script-src 'none' 'nonce-foo'; default-src 'none'; ">
+<script src="../support/shared-worker-helper.js" nonce="foo" id="foo" data-desc-fallback="Same-origin shared worker allowed by worker-src 'self'."></script>
\ No newline at end of file