зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1721410 - HTTPS-First: Add test for HSTS redirection. r=ckerschb
Differential Revision: https://phabricator.services.mozilla.com/D120361
This commit is contained in:
lyavor
Родитель
66b55bf012
Коммит
a154e109a7
|
|
@ -0,0 +1,87 @@
|
||||||
|
"use strict";
|
||||||
|
|
||||||
|
// redirection uri
|
||||||
|
const REDIRECT_URI =
|
||||||
|
"https://example.com/tests/dom/security/test/https-first/file_multiple_redirection.sjs?redirect";
|
||||||
|
const REDIRECT_URI_HTTP =
|
||||||
|
"http://example.com/tests/dom/security/test/https-first/file_multiple_redirection.sjs?verify";
|
||||||
|
const REDIRECT_URI_HTTPS =
|
||||||
|
"https://example.com/tests/dom/security/test/https-first/file_multiple_redirection.sjs?verify";
|
||||||
|
|
||||||
|
const RESPONSE_ERROR = "unexpected-query";
|
||||||
|
|
||||||
|
// An onload postmessage to window opener
|
||||||
|
const RESPONSE_HTTPS_SCHEME = `
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<script type="application/javascript">
|
||||||
|
window.opener.postMessage({result: 'scheme-https'}, '*');
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>`;
|
||||||
|
|
||||||
|
const RESPONSE_HTTP_SCHEME = `
|
||||||
|
<html>
|
||||||
|
<body>
|
||||||
|
<script type="application/javascript">
|
||||||
|
window.opener.postMessage({result: 'scheme-http'}, '*');
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>`;
|
||||||
|
|
||||||
|
function sendRedirection(query, response) {
|
||||||
|
// send a redirection to an http uri
|
||||||
|
if (query.includes("test1")) {
|
||||||
|
response.setHeader("Location", REDIRECT_URI_HTTP, false);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
// send a redirection to an https uri
|
||||||
|
if (query.includes("test2")) {
|
||||||
|
response.setHeader("Location", REDIRECT_URI_HTTPS, false);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
// send a redirection to an http uri with hsts header
|
||||||
|
if (query.includes("test3")) {
|
||||||
|
response.setHeader("Strict-Transport-Security", "max-age=60");
|
||||||
|
response.setHeader("Location", REDIRECT_URI_HTTP, false);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
function handleRequest(request, response) {
|
||||||
|
response.setHeader("Cache-Control", "no-cache", false);
|
||||||
|
const query = request.queryString;
|
||||||
|
|
||||||
|
// if the query contains a test query start first test
|
||||||
|
if (query.startsWith("test")) {
|
||||||
|
// send a 302 redirection
|
||||||
|
response.setStatusLine(request.httpVersion, 302, "Found");
|
||||||
|
response.setHeader("Location", REDIRECT_URI + query, false);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
// Send a redirection
|
||||||
|
if (query.includes("redirect")) {
|
||||||
|
response.setStatusLine(request.httpVersion, 302, "Found");
|
||||||
|
sendRedirection(query, response);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
// Reset the HSTS policy, prevent influencing other tests
|
||||||
|
if (request.queryString === "reset") {
|
||||||
|
response.setHeader("Strict-Transport-Security", "max-age=0");
|
||||||
|
let response_content =
|
||||||
|
request.scheme === "https" ? RESPONSE_HTTPS_SCHEME : RESPONSE_HTTP_SCHEME;
|
||||||
|
response.setStatusLine(request.httpVersion, 200, "OK");
|
||||||
|
response.write(response_content);
|
||||||
|
}
|
||||||
|
// Check if scheme is http:// or https://
|
||||||
|
if (query == "verify") {
|
||||||
|
let response_content =
|
||||||
|
request.scheme === "https" ? RESPONSE_HTTPS_SCHEME : RESPONSE_HTTP_SCHEME;
|
||||||
|
response.setStatusLine(request.httpVersion, 200, "OK");
|
||||||
|
response.write(response_content);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
|
||||||
|
// We should never get here, but just in case ...
|
||||||
|
response.setStatusLine(request.httpVersion, 500, "OK");
|
||||||
|
response.write("unexepcted query");
|
||||||
|
}
|
||||||
|
|
@ -26,6 +26,9 @@ support-files= file_referrer_policy.sjs
|
||||||
[test_break_endless_upgrade_downgrade_loop.html]
|
[test_break_endless_upgrade_downgrade_loop.html]
|
||||||
support-files =
|
support-files =
|
||||||
file_break_endless_upgrade_downgrade_loop.sjs
|
file_break_endless_upgrade_downgrade_loop.sjs
|
||||||
|
[test_multiple_redirection.html]
|
||||||
|
support-files =
|
||||||
|
file_multiple_redirection.sjs
|
||||||
[test_form_submission.html]
|
[test_form_submission.html]
|
||||||
support-files =
|
support-files =
|
||||||
file_form_submission.sjs
|
file_form_submission.sjs
|
||||||
|
|
|
||||||
|
|
@ -0,0 +1,76 @@
|
||||||
|
<!DOCTYPE HTML>
|
||||||
|
<html>
|
||||||
|
<!--
|
||||||
|
https://bugzilla.mozilla.org/show_bug.cgi?id=1721410
|
||||||
|
Test multiple redirects using https-first and ensure the entire redirect chain is using https
|
||||||
|
-->
|
||||||
|
|
||||||
|
<head>
|
||||||
|
<title>HTTPS-First-Mode - Test for multiple redirections</title>
|
||||||
|
<script src="/tests/SimpleTest/SimpleTest.js"></script>
|
||||||
|
<link rel="stylesheet" type="text/css" href="/tests/SimpleTest/test.css" />
|
||||||
|
</head>
|
||||||
|
|
||||||
|
<body>
|
||||||
|
|
||||||
|
<script class="testbody" type="text/javascript">
|
||||||
|
"use strict";
|
||||||
|
|
||||||
|
SimpleTest.waitForExplicitFinish();
|
||||||
|
|
||||||
|
const testCase = [
|
||||||
|
// test 1: https-first upgrades http://example.com/test1 -> https://example.com/test1
|
||||||
|
// that's redirect to https://example.com/.../redirect which then redirects
|
||||||
|
// to http://example.com/../verify. Since the last redirect is http, and the
|
||||||
|
// the redirection chain contains already example.com we expect https-first
|
||||||
|
// to downgrade the request.
|
||||||
|
{name: "test last redirect HTTP", result: "scheme-http", query: "test1" },
|
||||||
|
// test 2: https-first upgrades http://example.com/test2 -> https://example.com/test2
|
||||||
|
// that's redirect to https://example.com/.../redirect which then redirects
|
||||||
|
// to https://example.com/../verify. Since the last redirect is https, we
|
||||||
|
// expect to reach an https website.
|
||||||
|
{name: "test last redirect HTTPS", result: "scheme-https", query: "test2"},
|
||||||
|
// test 3: https-first upgrades http://example.com/test3 -> https://example.com/test3
|
||||||
|
// that's redirect to https://example.com/.../hsts which then sets an hsts header
|
||||||
|
// and redirects to http://example.com/../verify. Since an hsts header was set
|
||||||
|
// we expect that to reach an https site
|
||||||
|
{name: "test last redirect HSTS", result: "scheme-https", query: "test3"},
|
||||||
|
// reset: reset hsts header for example.com
|
||||||
|
{name: "reset HSTS header", result: "scheme-https", query: "reset"},
|
||||||
|
]
|
||||||
|
let currentTest = 0;
|
||||||
|
let testWin;
|
||||||
|
window.addEventListener("message", receiveMessage);
|
||||||
|
|
||||||
|
// receive message from loaded site verifying the scheme of
|
||||||
|
// the loaded document.
|
||||||
|
async function receiveMessage(event) {
|
||||||
|
let test = testCase[currentTest];
|
||||||
|
is(event.data.result,
|
||||||
|
test.result,
|
||||||
|
"same-origin redirect results in " + test.name
|
||||||
|
);
|
||||||
|
testWin.close();
|
||||||
|
if (++currentTest < testCase.length) {
|
||||||
|
startTest();
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
window.removeEventListener("message", receiveMessage);
|
||||||
|
SimpleTest.finish();
|
||||||
|
}
|
||||||
|
|
||||||
|
async function startTest() {
|
||||||
|
const test = testCase[currentTest];
|
||||||
|
// Load an http:// window which gets upgraded to https://
|
||||||
|
let uri =
|
||||||
|
`http://example.com/tests/dom/security/test/https-first/file_multiple_redirection.sjs?${test.query}`;
|
||||||
|
testWin = window.open(uri);
|
||||||
|
}
|
||||||
|
|
||||||
|
// Set preference and start test
|
||||||
|
SpecialPowers.pushPrefEnv({ set: [
|
||||||
|
["dom.security.https_first", true],
|
||||||
|
]}, startTest);
|
||||||
|
</script>
|
||||||
|
</body>
|
||||||
|
</html>
|
||||||
Загрузка…
Ссылка в новой задаче