зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1578708 [wpt PR 18833] - [Trusted Types] Block eval if the policy rejects a source., a=testonly
Automatic update from web-platform-tests [Trusted Types] Block eval if the policy rejects a source. Bug: 993372, 992424 Change-Id: I23bd70836fd70ef1fa98de797f04b4a7f7d1546e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1782851 Commit-Queue: Stefano Sanfilippo <ssanfilippo@chromium.org> Reviewed-by: Mike West <mkwst@chromium.org> Reviewed-by: Daniel Vogelheim <vogelheim@chromium.org> Cr-Commit-Position: refs/heads/master@{#693162} -- wpt-commits: 2b5f6b2e34545e20b6c502c38817067f695be1c6 wpt-pr: 18833
This commit is contained in:
Stefano Sanfilippo
James Graham
Родитель
8163706a44
Коммит
bfe2674b93
|
|
@ -12,19 +12,19 @@
|
|||
<script nonce="abc">
|
||||
let p = createScript_policy(window, 1);
|
||||
test(t => {
|
||||
let a = 0;
|
||||
assert_throws(new EvalError(), _ => {
|
||||
eval('"hello there"') });
|
||||
}, "eval with plain string throws.");
|
||||
eval('a="hello there"')
|
||||
});
|
||||
assert_equals(a, 0);
|
||||
}, "eval with plain string throws (both block).");
|
||||
|
||||
test(t => {
|
||||
let s = eval(p.createScript('"Hello transformed string"'));
|
||||
assert_equals(s, "Hello a cat string");
|
||||
}, "eval with TrustedScript works.");
|
||||
|
||||
TrustedTypes.createPolicy("default", { createScript: createScriptJS }, true);
|
||||
test(t => {
|
||||
let s = eval('"Hello transformed untrusted string"');
|
||||
assert_equals(s, "Hello a cat untrusted string");
|
||||
}, "eval obeys default policy.");
|
||||
let a = 0;
|
||||
assert_throws(new EvalError(), _ => {
|
||||
eval(p.createScript('a="Hello transformed string"'));
|
||||
});
|
||||
assert_equals(a, 0);
|
||||
}, "eval with TrustedScript throws (script-src blocks).");
|
||||
</script>
|
||||
|
||||
|
|
|
|||
|
|
@ -13,9 +13,12 @@
|
|||
<script nonce="abc">
|
||||
let p = createScript_policy(window, 1);
|
||||
test(t => {
|
||||
let s = eval('"hello there"');
|
||||
assert_equals(s, "hello there");
|
||||
}, "eval with plain string with Trusted Types and permissive CSP works.");
|
||||
let a = 0;
|
||||
assert_throws(new EvalError(), _ => {
|
||||
eval('a="hello there"');
|
||||
});
|
||||
assert_equals(a, 0);
|
||||
}, "eval with plain string with Trusted Types and permissive CSP throws (no type).");
|
||||
|
||||
test(t => {
|
||||
let s = eval(p.createScript('"Hello transformed string"'));
|
||||
|
|
|
|||
|
|
@ -0,0 +1,115 @@
|
|||
<!DOCTYPE html>
|
||||
<head>
|
||||
<script nonce="123" src="/resources/testharness.js"></script>
|
||||
<script nonce="123"src="/resources/testharnessreport.js"></script>
|
||||
<script nonce="123"src="/content-security-policy/support/testharness-helper.js"></script>
|
||||
</head>
|
||||
<body>
|
||||
<script nonce="123">
|
||||
// CSP insists the "trusted-types: ..." directives are deliverd as headers
|
||||
// (rather than as "<meta http-equiv" tags). This test assumes the following
|
||||
// headers are set in the .headers file:
|
||||
//
|
||||
// Content-Security-Policy: trusted-types *
|
||||
// Content-Security-Policy: script-src 'unsafe-inline'; report-uri ...
|
||||
// Content-Security-Policy: plugin-types bla/blubb
|
||||
//
|
||||
// The last rule is there so we can provoke a CSP violation report at will.
|
||||
// The intent is that in order to test that a violation has *not* been thrown
|
||||
// (and without resorting to abominations like timeouts), we force a *another*
|
||||
// CSP violation (by violating the img-src rule) and when that event is
|
||||
// processed we can we sure that an earlier event - if it indeed occurred -
|
||||
// must have already been processed.
|
||||
|
||||
// Return function that returns a promise that resolves on the given
|
||||
// violation report.
|
||||
// how_many - how many violation events are expected.
|
||||
// filter_arg - iff function, call it with the event object.
|
||||
// Else, string-ify and compare against event.originalPolicy.
|
||||
function promise_violation(filter_arg) {
|
||||
return _ => new Promise((resolve, reject) => {
|
||||
function handler(e) {
|
||||
let matches = (filter_arg instanceof Function)
|
||||
? filter_arg(e)
|
||||
: (e.originalPolicy.includes(filter_arg));
|
||||
if (matches) {
|
||||
document.removeEventListener("securitypolicyviolation", handler);
|
||||
e.stopPropagation();
|
||||
resolve(e);
|
||||
}
|
||||
}
|
||||
document.addEventListener("securitypolicyviolation", handler);
|
||||
});
|
||||
}
|
||||
|
||||
// Like assert_throws, but we don't care about the exact error. We just want
|
||||
// to run the code and continue.
|
||||
function expect_throws(fn) {
|
||||
try { fn(); assert_unreached(); } catch (err) { /* ignore */ }
|
||||
}
|
||||
|
||||
// A sample policy we use to test TrustedTypes.createPolicy behaviour.
|
||||
const id = x => x;
|
||||
const a_policy = {
|
||||
createHTML: id,
|
||||
createScriptURL: id,
|
||||
createURL: id,
|
||||
createScript: id,
|
||||
};
|
||||
|
||||
const scriptyPolicy = TrustedTypes.createPolicy('allowEval', a_policy);
|
||||
|
||||
// Provoke/wait for a CSP violation, in order to be sure that all previous
|
||||
// CSP violations have been delivered.
|
||||
function promise_flush() {
|
||||
return promise_violation("plugin-types bla/blubb");
|
||||
}
|
||||
function flush() {
|
||||
expect_throws(_ => {
|
||||
var o = document.createElement('object');
|
||||
o.type = "application/x-shockwave-flash";
|
||||
document.body.appendChild(o);
|
||||
});
|
||||
}
|
||||
|
||||
window.script_run_beacon = 'never_overwritten';
|
||||
|
||||
promise_test(t => {
|
||||
let p = Promise.resolve()
|
||||
.then(promise_violation("trusted-types *"))
|
||||
.then(promise_flush());
|
||||
expect_throws(_ => eval('script_run_beacon="should not run"'));
|
||||
assert_equals(script_run_beacon, 'never_overwritten');
|
||||
flush();
|
||||
return p;
|
||||
}, "Trusted Type violation report: evaluating a string violates both script-src and trusted-types.");
|
||||
|
||||
promise_test(t => {
|
||||
let p = Promise.resolve()
|
||||
.then(promise_violation("script-src"))
|
||||
.then(promise_flush());
|
||||
expect_throws(_ => eval('script_run_beacon="should not run"'));
|
||||
// TODO(ssanfilippo) This should throw, but doesn't yet. See crbug.com/992424.
|
||||
eval(scriptyPolicy.createScript('script_run_beacon="i ran"'));
|
||||
flush();
|
||||
assert_not_equals(script_run_beacon, 'i ran'); // Code did not run.
|
||||
return p;
|
||||
}, "Trusted Type violation report: evaluating a Trusted Script violates script-src.");
|
||||
|
||||
promise_test(t => {
|
||||
TrustedTypes.createPolicy('default', {
|
||||
createScript: s => s.replace('payload', 'default policy'),
|
||||
}, true);
|
||||
let p = Promise.resolve()
|
||||
.then(promise_violation((e) =>
|
||||
e.effectiveDirective.includes('script-src') &&
|
||||
e.sample.includes("default policy")))
|
||||
.then(promise_flush());
|
||||
expect_throws(_ => eval('script_run_beacon="payload"')); // script-src will block.
|
||||
assert_not_equals(script_run_beacon, 'default policy'); // Code did not run.
|
||||
flush();
|
||||
return p;
|
||||
}, "Trusted Type violation report: script-src restrictions apply after the default policy runs.");
|
||||
|
||||
</script>
|
||||
</body>
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
Content-Security-Policy: trusted-types *
|
||||
Content-Security-Policy: script-src http: https: 'nonce-123' 'report-sample'
|
||||
Content-Security-Policy: plugin-types bla/blubb
|
||||
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
<!DOCTYPE html>
|
||||
<head>
|
||||
<script nonce="123" src="/resources/testharness.js"></script>
|
||||
<script nonce="123"src="/resources/testharnessreport.js"></script>
|
||||
<script nonce="123"src="/content-security-policy/support/testharness-helper.js"></script>
|
||||
</head>
|
||||
<body>
|
||||
<script nonce="123">
|
||||
// CSP insists the "trusted-types: ..." directives are deliverd as headers
|
||||
// (rather than as "<meta http-equiv" tags). This test assumes the following
|
||||
// headers are set in the .headers file:
|
||||
//
|
||||
// Content-Security-Policy: trusted-types *
|
||||
// Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval'; report-uri ...
|
||||
// Content-Security-Policy: plugin-types bla/blubb
|
||||
//
|
||||
// The last rule is there so we can provoke a CSP violation report at will.
|
||||
// The intent is that in order to test that a violation has *not* been thrown
|
||||
// (and without resorting to abominations like timeouts), we force a *another*
|
||||
// CSP violation (by violating the img-src rule) and when that event is
|
||||
// processed we can we sure that an earlier event - if it indeed occurred -
|
||||
// must have already been processed.
|
||||
|
||||
// Return function that returns a promise that resolves on the given
|
||||
// violation report.
|
||||
//
|
||||
// filter_arg - iff function, call it with the event object.
|
||||
// Else, string-ify and compare against event.originalPolicy.
|
||||
function promise_violation(filter_arg) {
|
||||
return _ => new Promise((resolve, reject) => {
|
||||
function handler(e) {
|
||||
let matches = (filter_arg instanceof Function)
|
||||
? filter_arg(e)
|
||||
: (e.originalPolicy.includes(filter_arg));
|
||||
if (matches) {
|
||||
document.removeEventListener("securitypolicyviolation", handler);
|
||||
e.stopPropagation();
|
||||
resolve(e);
|
||||
}
|
||||
}
|
||||
document.addEventListener("securitypolicyviolation", handler);
|
||||
});
|
||||
}
|
||||
|
||||
// Like assert_throws, but we don't care about the exact error. We just want
|
||||
// to run the code and continue.
|
||||
function expect_throws(fn) {
|
||||
try { fn(); assert_unreached(); } catch (err) { /* ignore */ }
|
||||
}
|
||||
|
||||
// A sample policy we use to test TrustedTypes.createPolicy behaviour.
|
||||
const id = x => x;
|
||||
const a_policy = {
|
||||
createHTML: id,
|
||||
createScriptURL: id,
|
||||
createURL: id,
|
||||
createScript: id,
|
||||
};
|
||||
|
||||
const scriptyPolicy = TrustedTypes.createPolicy('allowEval', a_policy);
|
||||
|
||||
// Provoke/wait for a CSP violation, in order to be sure that all previous
|
||||
// CSP violations have been delivered.
|
||||
function promise_flush() {
|
||||
return promise_violation("plugin-types bla/blubb");
|
||||
}
|
||||
function flush() {
|
||||
expect_throws(_ => {
|
||||
var o = document.createElement('object');
|
||||
o.type = "application/x-shockwave-flash";
|
||||
document.body.appendChild(o);
|
||||
});
|
||||
}
|
||||
|
||||
window.script_run_beacon = 'vanilla';
|
||||
|
||||
promise_test(t => {
|
||||
let p = Promise.resolve()
|
||||
.then(promise_violation("trusted-types *"))
|
||||
.then(promise_flush());
|
||||
eval('script_run_beacon="report-only-does-not-stop"');
|
||||
assert_equals(script_run_beacon, 'report-only-does-not-stop');
|
||||
flush();
|
||||
return p;
|
||||
}, "Trusted Type violation report: evaluating a string.");
|
||||
|
||||
promise_test(t => {
|
||||
let p = promise_flush()();
|
||||
eval(scriptyPolicy.createScript('script_run_beacon="trusted-script-ok"'));
|
||||
flush();
|
||||
assert_equals(script_run_beacon, 'trusted-script-ok');
|
||||
return p;
|
||||
}, "Trusted Type violation report: evaluating a Trusted Script.");
|
||||
|
||||
promise_test(t => {
|
||||
TrustedTypes.createPolicy('default', {
|
||||
createScript: s => s.replace('payload', 'default policy'),
|
||||
}, true);
|
||||
let p = promise_flush()();
|
||||
eval('script_run_beacon="payload"');
|
||||
assert_equals(script_run_beacon, 'default policy');
|
||||
flush();
|
||||
return p;
|
||||
}, "Trusted Type violation report: default policy runs in report-only mode.");
|
||||
|
||||
</script>
|
||||
</body>
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
Content-Security-Policy-Report-Only: trusted-types *
|
||||
Content-Security-Policy: script-src http: https: 'nonce-123' 'unsafe-eval'
|
||||
Content-Security-Policy: plugin-types bla/blubb
|
||||
|
||||
|
|
@ -0,0 +1,107 @@
|
|||
<!DOCTYPE html>
|
||||
<head>
|
||||
<script nonce="123" src="/resources/testharness.js"></script>
|
||||
<script nonce="123"src="/resources/testharnessreport.js"></script>
|
||||
<script nonce="123"src="/content-security-policy/support/testharness-helper.js"></script>
|
||||
</head>
|
||||
<body>
|
||||
<script nonce="123">
|
||||
// CSP insists the "trusted-types: ..." directives are deliverd as headers
|
||||
// (rather than as "<meta http-equiv" tags). This test assumes the following
|
||||
// headers are set in the .headers file:
|
||||
//
|
||||
// Content-Security-Policy: trusted-types *
|
||||
// Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval'; report-uri ...
|
||||
// Content-Security-Policy: plugin-types bla/blubb
|
||||
//
|
||||
// The last rule is there so we can provoke a CSP violation report at will.
|
||||
// The intent is that in order to test that a violation has *not* been thrown
|
||||
// (and without resorting to abominations like timeouts), we force a *another*
|
||||
// CSP violation (by violating the img-src rule) and when that event is
|
||||
// processed we can we sure that an earlier event - if it indeed occurred -
|
||||
// must have already been processed.
|
||||
|
||||
// Return function that returns a promise that resolves on the given
|
||||
// violation report.
|
||||
//
|
||||
// filter_arg - iff function, call it with the event object.
|
||||
// Else, string-ify and compare against event.originalPolicy.
|
||||
function promise_violation(filter_arg) {
|
||||
return _ => new Promise((resolve, reject) => {
|
||||
function handler(e) {
|
||||
let matches = (filter_arg instanceof Function)
|
||||
? filter_arg(e)
|
||||
: (e.originalPolicy.includes(filter_arg));
|
||||
if (matches) {
|
||||
document.removeEventListener("securitypolicyviolation", handler);
|
||||
e.stopPropagation();
|
||||
resolve(e);
|
||||
}
|
||||
}
|
||||
document.addEventListener("securitypolicyviolation", handler);
|
||||
});
|
||||
}
|
||||
|
||||
// Like assert_throws, but we don't care about the exact error. We just want
|
||||
// to run the code and continue.
|
||||
function expect_throws(fn) {
|
||||
try { fn(); assert_unreached(); } catch (err) { /* ignore */ }
|
||||
}
|
||||
|
||||
// A sample policy we use to test TrustedTypes.createPolicy behaviour.
|
||||
const id = x => x;
|
||||
const a_policy = {
|
||||
createHTML: id,
|
||||
createScriptURL: id,
|
||||
createURL: id,
|
||||
createScript: id,
|
||||
};
|
||||
|
||||
const scriptyPolicy = TrustedTypes.createPolicy('allowEval', a_policy);
|
||||
|
||||
// Provoke/wait for a CSP violation, in order to be sure that all previous
|
||||
// CSP violations have been delivered.
|
||||
function promise_flush() {
|
||||
return promise_violation("plugin-types bla/blubb");
|
||||
}
|
||||
function flush() {
|
||||
expect_throws(_ => {
|
||||
var o = document.createElement('object');
|
||||
o.type = "application/x-shockwave-flash";
|
||||
document.body.appendChild(o);
|
||||
});
|
||||
}
|
||||
|
||||
window.script_run_beacon = 'never_overwritten';
|
||||
|
||||
promise_test(t => {
|
||||
let p = Promise.resolve()
|
||||
.then(promise_violation("trusted-types *"))
|
||||
.then(promise_flush());
|
||||
expect_throws(_ => eval('script_run_beacon="should not run"'));
|
||||
assert_equals(script_run_beacon, 'never_overwritten');
|
||||
flush();
|
||||
return p;
|
||||
}, "Trusted Type violation report: evaluating a string.");
|
||||
|
||||
promise_test(t => {
|
||||
let p = promise_flush()();
|
||||
eval(scriptyPolicy.createScript('script_run_beacon="i ran"'));
|
||||
flush();
|
||||
assert_equals(script_run_beacon, 'i ran');
|
||||
return p;
|
||||
}, "Trusted Type violation report: evaluating a Trusted Script.");
|
||||
|
||||
promise_test(t => {
|
||||
TrustedTypes.createPolicy('default', {
|
||||
createScript: s => s.replace('payload', 'default policy'),
|
||||
}, true);
|
||||
let p = promise_flush()();
|
||||
eval('script_run_beacon="payload"');
|
||||
assert_equals(script_run_beacon, 'default policy');
|
||||
flush();
|
||||
return p;
|
||||
}, "Trusted Type violation report: default policy transforms the script before CSP checks runs.");
|
||||
|
||||
</script>
|
||||
</body>
|
||||
|
|
@ -0,0 +1,4 @@
|
|||
Content-Security-Policy: trusted-types *
|
||||
Content-Security-Policy: script-src http: https: 'nonce-123' 'unsafe-eval'
|
||||
Content-Security-Policy: plugin-types bla/blubb
|
||||
|
||||
Загрузка…
Ссылка в новой задаче