mozilla
/
gecko-dev
зеркало из https://github.com/mozilla/gecko-dev.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Bug 1223743 - Test CSP enforcement for multipart channels (r=sicking)

This commit is contained in:
Christoph Kerschbaumer 2015-12-14 10:06:47 -08:00
Родитель 9666152c0e
Коммит 93de65860e
3 изменённых файлов: 86 добавлений и 0 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

50
dom/security/test/csp/file_multipart_testserver.sjs Normal file
Просмотреть файл

@ -0,0 +1,50 @@
// SJS file specifically for the needs of bug
// Bug 1223743 - CSP: Check baseChannel for CSP when loading multipart channel
var CSP = "script-src 'unsafe-inline', img-src 'none'";
var BOUNDARY = "fooboundary"
// small red image
const IMG_BYTES = atob(
"iVBORw0KGgoAAAANSUhEUgAAAAUAAAAFCAYAAACNbyblAAAAHElEQVQI12" +
"P4//8/w38GIAXDIBKE0DHxgljNBAAO9TXL0Y4OHwAAAABJRU5ErkJggg==");
var RESPONSE = `
<script>
var myImg = new Image;
myImg.src = "file_multipart_testserver.sjs?img";
myImg.onerror = function(e) {
window.parent.postMessage("img-blocked", "*");
};
myImg.onload = function() {
window.parent.postMessage("img-loaded", "*");
};
document.body.appendChild(myImg);
</script>
`;
var myTimer;
function handleRequest(request, response)
{
// avoid confusing cache behaviors
response.setHeader("Cache-Control", "no-cache", false);
if (request.queryString == "doc") {
response.setHeader("Content-Security-Policy", CSP, false);
response.setHeader("Content-Type", "multipart/x-mixed-replace; boundary=" + BOUNDARY, false);
response.write(BOUNDARY + "\r\n");
response.write(RESPONSE);
response.write(BOUNDARY + "\r\n");
return;
}
if (request.queryString == "img") {
response.setHeader("Content-Type", "image/png");
response.write(IMG_BYTES);
return;
}
// we should never get here - return something unexpected
response.write("d'oh");
}

2
dom/security/test/csp/mochitest.ini
Просмотреть файл

@ -152,6 +152,7 @@ support-files =
file_doccomment_meta.html
file_docwrite_meta.css
file_docwrite_meta.js
file_multipart_testserver.sjs
[test_base-uri.html]
[test_blob_data_schemes.html]
@ -226,3 +227,4 @@ skip-if = buildapp == 'b2g' #investigate in bug 1222904
[test_meta_element.html]
[test_meta_header_dual.html]
[test_docwrite_meta.html]
[test_multipartchannel.html]

34
dom/security/test/csp/test_multipartchannel.html Normal file
Просмотреть файл

@ -0,0 +1,34 @@
<!DOCTYPE HTML>
<html>
<head>
<meta charset="utf-8">
<title>Bug 1223743 - CSP: Check baseChannel for CSP when loading multipart channel</title>
<!-- Including SimpleTest.js so we can use waitForExplicitFinish !-->
<script type="text/javascript" src="/tests/SimpleTest/SimpleTest.js"></script>
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
</head>
<body>
<iframe style="width:100%;" id="testframe"></iframe>
<script class="testbody" type="text/javascript">
SimpleTest.waitForExplicitFinish();
/* Description of the test:
* We apply a CSP to a multipart channel and then try to load an image
* within a segment making sure the image is blocked correctly by CSP.
*/
window.addEventListener("message", receiveMessage, false);
function receiveMessage(event) {
is(event.data, "img-blocked", "image should be blocked");
window.removeEventListener("message", receiveMessage, false);
SimpleTest.finish();
}
// start the test
document.getElementById("testframe").src = "file_multipart_testserver.sjs?doc";
</script>
</body>
</html>