Bug 1693515 [wpt PR 27674] - Make SubresourceWebBundles feature available only in Secure Context, a=testonly

Automatic update from web-platform-tests
Make SubresourceWebBundles feature available only in Secure Context

We are developing the SubresourceWebBundles feature behind the feature
flag. This feature is enabled when
--enable-features=SubresourceWebBundles or
chrome://flags/#enable-experimental-web-platform-features is enabled
even when the page is non-Secure Context.

But according to this doc, we should make powerful new features
available only to secure origins.
https://www.chromium.org/Home/chromium-security/prefer-secure-origins-for-powerful-new-features

So this CL makes the SubresourceWebBundles feature available only in
Secure Context by:
 (1) Add [SecureContext] extended attribute to `resources` and `scopes`
     attribute of HTMLLinkElement in html_link_element.idl.
 (2) Check IsSecureContext() also when we check
     RuntimeEnabledFeatures::SubresourceWebBundlesEnabled().

Note: this restriction doesn’t affect Origin Trial of this feature,
because Origin Trials are only enabled for secure origins.

Bug: 1082020
Change-Id: Ifa533f99f64c83015d293946084395a5af59cfba
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2703194
Commit-Queue: Tsuyoshi Horo <horo@chromium.org>
Commit-Queue: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Reviewed-by: Kunihiko Sakamoto <ksakamoto@chromium.org>
Reviewed-by: Hayato Ito <hayato@chromium.org>
Cr-Commit-Position: refs/heads/master@{#856177}

--

wpt-commits: 4fc6cf99aedf93fab4516c19372f937e636059f7
wpt-pr: 27674

testing/web-platform/tests/web-bundle/resources/cross-origin-no-cors.har

@@ -4,7 +4,7 @@
       {
         "request": {
           "method": "GET",
-          "url": "https://web-platform.test:8444/web-bundle/resources/wbn/no-cors/resource.cors.js",
+          "url": "https://www1.web-platform.test:8444/web-bundle/resources/wbn/no-cors/resource.cors.js",
           "headers": []
         },
         "response": {
@@ -27,7 +27,7 @@
       {
         "request": {
           "method": "GET",
-          "url": "https://web-platform.test:8444/web-bundle/resources/wbn/no-cors/resource.no-cors.js",
+          "url": "https://www1.web-platform.test:8444/web-bundle/resources/wbn/no-cors/resource.no-cors.js",
           "headers": []
         },
         "response": {
@@ -45,4 +45,4 @@
       }
     ]
   }
-}
+}

testing/web-platform/tests/web-bundle/resources/cross-origin.har

@@ -4,7 +4,7 @@
       {
         "request": {
           "method": "GET",
-          "url": "https://web-platform.test:8444/web-bundle/resources/wbn/cors/resource.cors.js",
+          "url": "https://www1.web-platform.test:8444/web-bundle/resources/wbn/cors/resource.cors.js",
           "headers": []
         },
         "response": {
@@ -27,7 +27,7 @@
       {
         "request": {
           "method": "GET",
-          "url": "https://web-platform.test:8444/web-bundle/resources/wbn/cors/resource.no-cors.js",
+          "url": "https://www1.web-platform.test:8444/web-bundle/resources/wbn/cors/resource.no-cors.js",
           "headers": []
         },
         "response": {
@@ -45,4 +45,4 @@
       }
     ]
   }
-}
+}

testing/web-platform/tests/web-bundle/resources/generate-test-wbns.sh

@@ -11,55 +11,55 @@ fi
 
 # TODO: Stop hard-coding "web-platform.test" when generating Web Bundles on the
 # fly.
-wpt_test_https_origin=https://web-platform.test:8444
-wpt_test_http_origin=http://web-platform.test:8001
+wpt_test_origin=https://web-platform.test:8444
+wpt_test_remote_origin=https://www1.web-platform.test:8444
 
 gen-bundle \
   -version b1 \
-  -baseURL $wpt_test_https_origin/web-bundle/resources/wbn/ \
-  -primaryURL $wpt_test_https_origin/web-bundle/resources/wbn/location.html \
+  -baseURL $wpt_test_origin/web-bundle/resources/wbn/ \
+  -primaryURL $wpt_test_origin/web-bundle/resources/wbn/location.html \
   -dir location/ \
   -o wbn/location.wbn
 
 gen-bundle \
   -version b1 \
-  -baseURL $wpt_test_http_origin/web-bundle/resources/wbn/ \
-  -primaryURL $wpt_test_http_origin/web-bundle/resources/wbn/root.js \
+  -baseURL $wpt_test_origin/web-bundle/resources/wbn/ \
+  -primaryURL $wpt_test_origin/web-bundle/resources/wbn/root.js \
   -dir subresource/ \
   -o wbn/subresource.wbn
 
 gen-bundle \
   -version b1 \
-  -baseURL $wpt_test_http_origin/web-bundle/resources/wbn/static-element/ \
-  -primaryURL $wpt_test_http_origin/web-bundle/resources/wbn/static-element/resources/style.css \
+  -baseURL $wpt_test_origin/web-bundle/resources/wbn/static-element/ \
+  -primaryURL $wpt_test_origin/web-bundle/resources/wbn/static-element/resources/style.css \
   -dir static-element/ \
   -o wbn/static-element.wbn
 
 gen-bundle \
   -version b1 \
-  -baseURL $wpt_test_http_origin/web-bundle/resources/wbn/dynamic/ \
-  -primaryURL $wpt_test_http_origin/web-bundle/resources/wbn/dynamic/resource1.js \
+  -baseURL $wpt_test_origin/web-bundle/resources/wbn/dynamic/ \
+  -primaryURL $wpt_test_origin/web-bundle/resources/wbn/dynamic/resource1.js \
   -dir dynamic1/ \
   -o wbn/dynamic1.wbn
 
 gen-bundle \
   -version b1 \
-  -baseURL $wpt_test_http_origin/web-bundle/resources/wbn/dynamic/ \
-  -primaryURL $wpt_test_http_origin/web-bundle/resources/wbn/dynamic/resource1.js \
+  -baseURL $wpt_test_origin/web-bundle/resources/wbn/dynamic/ \
+  -primaryURL $wpt_test_origin/web-bundle/resources/wbn/dynamic/resource1.js \
   -dir dynamic2/ \
   -o wbn/dynamic2.wbn
 
 gen-bundle \
   -version b1 \
-  -baseURL $wpt_test_https_origin/web-bundle/resources/wbn/dynamic/ \
-  -primaryURL $wpt_test_https_origin/web-bundle/resources/wbn/dynamic/resource1.js \
+  -baseURL $wpt_test_remote_origin/web-bundle/resources/wbn/dynamic/ \
+  -primaryURL $wpt_test_remote_origin/web-bundle/resources/wbn/dynamic/resource1.js \
   -dir dynamic1/ \
   -o wbn/dynamic1-crossorigin.wbn
 
 gen-bundle \
   -version b1 \
-  -baseURL $wpt_test_http_origin/web-bundle/resources/ \
-  -primaryURL $wpt_test_http_origin/web-bundle/resources/wbn/resource.js \
+  -baseURL $wpt_test_origin/web-bundle/resources/ \
+  -primaryURL $wpt_test_origin/web-bundle/resources/wbn/resource.js \
   -dir path-restriction/ \
   -o wbn/path-restriction.wbn
 
@@ -67,8 +67,8 @@ gen-bundle \
 cp -a wbn/subresource.wbn nested/nested-sub.wbn
 gen-bundle \
   -version b1 \
-  -baseURL $wpt_test_http_origin/web-bundle/resources/wbn/ \
-  -primaryURL $wpt_test_http_origin/web-bundle/resources/wbn/resource.js \
+  -baseURL $wpt_test_origin/web-bundle/resources/wbn/ \
+  -primaryURL $wpt_test_origin/web-bundle/resources/wbn/resource.js \
   -dir nested/ \
   -o wbn/nested-main.wbn
 
@@ -81,11 +81,11 @@ gen-bundle \
 gen-bundle \
   -version b1 \
   -har cross-origin.har \
-  -primaryURL $wpt_test_https_origin/web-bundle/resources/wbn/cors/resource.cors.js \
+  -primaryURL $wpt_test_remote_origin/web-bundle/resources/wbn/cors/resource.cors.js \
   -o wbn/cors/cross-origin.wbn
 
 gen-bundle \
   -version b1 \
   -har cross-origin-no-cors.har \
-  -primaryURL $wpt_test_https_origin/web-bundle/resources/wbn/no-cors/resource.cors.js \
+  -primaryURL $wpt_test_remote_origin/web-bundle/resources/wbn/no-cors/resource.cors.js \
   -o wbn/no-cors/cross-origin.wbn

testing/web-platform/tests/web-bundle/subresource-loading/link-web-bundle-no-secure.tentative.html

@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<title>A link element with rel="webbundle" in no secure context</title>
+<link
+  rel="help"
+  href="https://github.com/WICG/webpackage/blob/master/explainers/subresource-loading.md"
+/>
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<body>
+  <link id="link_empty" />
+  <link id="link_web_bundle_1" rel="webbundle" />
+  <link id="link_web_bundle_2" rel="webbundle" resources="foo" />
+  <link id="link_web_bundle_3" rel="webbundle" scopes="bar" />
+  <script>
+    test(() => {
+      assert_false(
+        "resources" in Element.prototype,
+        "resources must not be defined on Element prototype"
+      );
+      assert_false(
+        "resources" in HTMLLinkElement.prototype,
+        "resources must not be defined on HTMLLinkElement prototype"
+      );
+    }, "resources must not be defined on HTMLLinkElement prototype in no secure context");
+
+    test(() => {
+      assert_false(
+        "scopes" in Element.prototype,
+        "scopes must not be defined on Element prototype"
+      );
+      assert_false(
+        "scopes" in HTMLLinkElement.prototype,
+        "scopes must not be defined on HTMLLinkElement prototype"
+      );
+    }, "scopes must not be defined on HTMLLinkElement prototype in no secure context");
+
+    test(() => {
+      const link = document.createElement("link");
+      assert_false(link.relList.supports("webbundle"));
+    }, "webbundle must not be a supported token of a link element's relList");
+
+    test(() => {
+      const link_web_bundle = document.querySelector("#link_web_bundle_1");
+      assert_equals(
+        link_web_bundle.getAttribute("rel"),
+        "webbundle",
+        "rel attribute must return webbundle"
+      );
+      assert_true(
+        link_web_bundle.relList.contains("webbundle"),
+        "relList must contain webbundle for <link rel=webbundle>."
+      );
+      assert_false(
+        document.querySelector("#link_empty").relList.contains("webbundle"),
+        "relList must not contain webbundle for <link>"
+      );
+    }, "relList must contain webbundle if rel attribute contains it");
+
+    test(() => {
+      assert_equals(
+        document.querySelector("#link_web_bundle_1").getAttribute("resources"),
+        null,
+        "resources attribute must return null when the attribute is not given"
+      );
+      assert_equals(
+        document.querySelector("#link_web_bundle_2").getAttribute("resources"),
+        "foo",
+        "resources attribute must return the specified value"
+      );
+      assert_equals(
+        document.querySelector("#link_web_bundle_2").getAttribute("scopes"),
+        null,
+        "scopes attribute must return null when the attribute is not given"
+      );
+      assert_equals(
+        document.querySelector("#link_web_bundle_3").getAttribute("scopes"),
+        "bar",
+        "scopes attribute must return the specified value"
+      );
+    }, "resoruces and scopes attribute must return null or specified value");
+
+    test(() => {
+      const link = document.createElement("link");
+      assert_equals(link.resources, undefined);
+    }, "resources must be undefined");
+
+    test(() => {
+      const link = document.createElement("link");
+      assert_equals(link.scopes, undefined);
+    }, "scopes must be undefined");
+  </script>
+</body>

testing/web-platform/tests/web-bundle/subresource-loading/link-web-bundle.https.tentative.html

@@ -78,7 +78,7 @@
         "scopes attribute must return the specified value"
       );
       // TODO: Test more variant of resoruces attribute values.
-    }, "resoruces attribute must return null or specified value");
+    }, "resoruces and scopes attribute must return null or specified value");
 
     test(() => {
       const link = document.createElement("link");

testing/web-platform/tests/web-bundle/subresource-loading/subresource-loading-cors-error.https.tentative.html

@@ -13,11 +13,11 @@
 <script src="../resources/test-helpers.js"></script>
 <body>
   <!--
-       This wpt should run on an origin different from https://web-platform.test:8444/,
+       This wpt should run on an origin different from https://www1.web-platform.test:8444/,
        from where cross-orign WebBundles are served.
 
        This test uses a cross-origin WebBundle,
-       https://web-platform.test:8444/web-bundle/resources/wbn/no-cors/cross-origin.wbn,
+       https://www1.web-platform.test:8444/web-bundle/resources/wbn/no-cors/cross-origin.wbn,
        which is served *without* an Access-Control-Allow-Origin response header.
 
        `cross-origin.wbn` includes two subresources:
@@ -27,7 +27,7 @@
   <script>
     promise_test(async () => {
       const prefix =
-        "https://web-platform.test:8444/web-bundle/resources/wbn/no-cors/";
+        "https://www1.web-platform.test:8444/web-bundle/resources/wbn/no-cors/";
       const resources = [
         prefix + "resource.cors.js",
         prefix + "resource.no-cors.js",

testing/web-platform/tests/web-bundle/subresource-loading/subresource-loading-cors.https.tentative.html

@@ -1,23 +1,18 @@
 <!DOCTYPE html>
 <title>Cross origin WebBundle subresource loading</title>
-<link
-  rel="help"
-  href="https://github.com/WICG/webpackage/blob/master/explainers/subresource-loading.md"
-/>
-<link
-  rel="help"
-  href="https://html.spec.whatwg.org/multipage/#cors-settings-attribute"
-/>
+<link rel="help" href="https://github.com/WICG/webpackage/blob/master/explainers/subresource-loading.md" />
+<link rel="help" href="https://html.spec.whatwg.org/multipage/#cors-settings-attribute" />
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
 <script src="../resources/test-helpers.js"></script>
+
 <body>
   <!--
-       This wpt should run on an origin different from https://web-platform.test:8444/,
+       This wpt should run on an origin different from https://www1.web-platform.test:8444/,
        from where cross-orign WebBundles are served.
 
        This test uses a cross-origin WebBundle,
-       https://web-platform.test:8444/web-bundle/resources/wbn/cors/cross-origin.wbn,
+       https://www1.web-platform.test:8444/web-bundle/resources/wbn/cors/cross-origin.wbn,
        which is served with an Access-Control-Allow-Origin response header.
 
        `cross-origin.wbn` includes two subresources:
@@ -27,7 +22,7 @@
   <script>
     promise_test(async () => {
       const prefix =
-        "https://web-platform.test:8444/web-bundle/resources/wbn/cors/";
+        "https://www1.web-platform.test:8444/web-bundle/resources/wbn/cors/";
       const resources = [
         prefix + "resource.cors.js",
         prefix + "resource.no-cors.js",

testing/web-platform/tests/web-bundle/subresource-loading/subresource-loading-credential.https.tentative.sub.html

@@ -30,7 +30,7 @@
     // Make sure to set a cookie for a cross-origin domain from where a cross
     // origin bundle is served.
     const setCookiePromise = fetch(
-      "http://{{domains[www2]}}:{{ports[http][0]}}/cookies/resources/set-cookie.py?name=milk&path=/web-bundle/subresource-loading/",
+      "https://{{domains[www1]}}:{{ports[https][0]}}/cookies/resources/set-cookie.py?name=milk&path=/web-bundle/subresource-loading/",
       {
         mode: "no-cors",
         credentials: "include",
@@ -38,7 +38,7 @@
     );
 
     const same_origin_bundle = "./check-cookie-and-return-bundle.py";
-    const cross_origin_bundle = "http://{{domains[www2]}}:{{ports[http][0]}}/web-bundle/subresource-loading/check-cookie-and-return-bundle.py";
+    const cross_origin_bundle = "https://{{domains[www1]}}:{{ports[https][0]}}/web-bundle/subresource-loading/check-cookie-and-return-bundle.py";
 
     promise_test(async () => {
       const link = document.createElement("link");

testing/web-platform/tests/web-bundle/subresource-loading/subresource-loading-from-web-bundle.https.tentative.html

@@ -1,30 +1,27 @@
 <!DOCTYPE html>
 <title>Subresource loading with link rel="webbundle"</title>
-<link
-  rel="help"
-  href="https://github.com/WICG/webpackage/blob/master/explainers/subresource-loading.md"
-/>
+<link rel="help" href="https://github.com/WICG/webpackage/blob/master/explainers/subresource-loading.md" />
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
+
 <body>
-  <link id="link-web-bundle" rel="webbundle" href="../resources/wbn/subresource.wbn"
-        resources="http://web-platform.test:8001/web-bundle/resources/wbn/root.js
-                   http://web-platform.test:8001/web-bundle/resources/wbn/submodule.js" />
+  <link id="link-web-bundle" rel="webbundle" href="../resources/wbn/subresource.wbn" resources="https://web-platform.test:8444/web-bundle/resources/wbn/root.js
+                   https://web-platform.test:8444/web-bundle/resources/wbn/submodule.js" />
   <script>
     promise_test(async () => {
-      const module = await import('http://web-platform.test:8001/web-bundle/resources/wbn/root.js');
+      const module = await import('https://web-platform.test:8444/web-bundle/resources/wbn/root.js');
       assert_equals(module.result, 'OK');
     }, "Subresource loading with WebBundle");
 
     promise_test(async () => {
-      const response = await fetch('http://web-platform.test:8001/web-bundle/resources/wbn/root.js');
+      const response = await fetch('https://web-platform.test:8444/web-bundle/resources/wbn/root.js');
       const text = await response.text();
       assert_equals(text, "export * from './submodule.js';\n");
     }, "Subresource loading with WebBundle (Fetch API)");
 
     promise_test(t => {
       const url =
-          '/common/redirect.py?location=http://web-platform.test:8001/web-bundle/resources/wbn/root.js';
+        '/common/redirect.py?location=https://web-platform.test:8444/web-bundle/resources/wbn/root.js';
       return promise_rejects_js(t, TypeError, import(url));
     }, "Subresource loading with WebBundle shouldn't affect redirect");
 
@@ -32,35 +29,35 @@
       const link = document.createElement("link");
       link.rel = "webbundle";
       link.href = "../resources/wbn/dynamic1.wbn";
-      link.resources.add('http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/resource1.js',
-                         'http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/resource2.js',
-                         'http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/resource4.js');
+      link.resources.add('https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource1.js',
+        'https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource2.js',
+        'https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource4.js');
       document.body.appendChild(link);
 
-      const module = await import('http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/resource1.js');
+      const module = await import('https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource1.js');
       assert_equals(module.result, 'resource1 from dynamic1.wbn');
 
       link.href = "../resources/wbn/dynamic2.wbn";
-      const module2 = await import('http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/resource2.js');
+      const module2 = await import('https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource2.js');
       assert_equals(module2.result, 'resource2 from dynamic2.wbn');
 
       // A resource not specified in the resources attribute, but in the bundle.
-      const module3 = await import('http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/resource3.js');
+      const module3 = await import('https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource3.js');
       assert_equals(module3.result, 'resource3 from network');
 
       document.body.removeChild(link);
-      const module4 = await import('http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/resource4.js');
+      const module4 = await import('https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource4.js');
       assert_equals(module4.result, 'resource4 from network');
 
       // Module scripts are stored to the Document's module map once loaded.
       // So import()ing the same module script will reuse the previously loaded
       // script.
-      const module_second = await import('http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/resource1.js');
+      const module_second = await import('https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource1.js');
       assert_equals(module_second.result, 'resource1 from dynamic1.wbn');
     }, 'Dynamically adding / updating / removing "<link rel=webbundle>"');
 
     promise_test(async () => {
-      const classic_script_url = 'http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/classic_script.js';
+      const classic_script_url = 'https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/classic_script.js';
       const link = document.createElement("link");
       link.rel = "webbundle";
       link.href = "../resources/wbn/dynamic1.wbn";
@@ -83,8 +80,8 @@
     }, 'Dynamically loading classic script from web bundle with link.resources');
 
     promise_test(async () => {
-      const classic_script_url = 'http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/classic_script.js';
-      const scope = 'http://web-platform.test:8001/web-bundle/resources/wbn/dynamic/';
+      const classic_script_url = 'https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/classic_script.js';
+      const scope = 'https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/';
       const link = document.createElement("link");
       link.rel = "webbundle";
       link.href = "../resources/wbn/dynamic1.wbn";
@@ -129,7 +126,7 @@
       const link = document.createElement('link');
       link.rel = 'webbundle';
       link.href = '../resources/wbn/dynamic1-crossorigin.wbn';
-      link.resources = 'https://web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource1.js';
+      link.resources = 'https://www1.web-platform.test:8444/web-bundle/resources/wbn/dynamic/resource1.js';
       document.body.appendChild(link);
       const module = await import(link.resources);
       assert_equals(module.result, 'resource1 from network');
@@ -158,11 +155,11 @@
     }, 'Subresource loading with urn:uuid: URL with link.scopes');
 
     promise_test(async () => {
-      const wbn_url = 'http://web-platform.test:8001/web-bundle/resources/wbn/subresource.wbn?test-resources-update';
-      const resource_url = 'http://web-platform.test:8001/web-bundle/resources/wbn/submodule.js';
+      const wbn_url = 'https://web-platform.test:8444/web-bundle/resources/wbn/subresource.wbn?test-resources-update';
+      const resource_url = 'https://web-platform.test:8444/web-bundle/resources/wbn/submodule.js';
       const link = await addLinkAndWaitForLoad(wbn_url);
       link.resources.add(resource_url);
-      const resp = await fetch(resource_url, {cache: 'no-store'});
+      const resp = await fetch(resource_url, { cache: 'no-store' });
       assert_true(resp.ok);
       assert_equals(performance.getEntriesByName(wbn_url).length, 1);
     }, 'Updating resource= attribute should not reload the bundle');
@@ -191,9 +188,9 @@
 
     async function loadScriptAndWaitReport(script_url) {
       const result_promise = new Promise((resolve) => {
-          // This function will be called from script.js
-          window.report_result = resolve;
-        });
+        // This function will be called from script.js
+        window.report_result = resolve;
+      });
 
       const script = document.createElement('script');
       script.src = script_url;
@@ -201,4 +198,4 @@
       return result_promise;
     }
   </script>
-</body>
+</body>

testing/web-platform/tests/web-bundle/subresource-loading/subresource-loading-nested-bundle.https.tentative.html

@@ -1,32 +1,27 @@
 <!DOCTYPE html>
 <title>A nested bundle is not supported</title>
-<link
-  rel="help"
-  href="https://github.com/WICG/webpackage/blob/master/explainers/subresource-loading.md"
-/>
+<link rel="help" href="https://github.com/WICG/webpackage/blob/master/explainers/subresource-loading.md" />
 <script src="/resources/testharness.js"></script>
 <script src="/resources/testharnessreport.js"></script>
+
 <body>
-  <link
-    rel="webbundle"
-    href="http://web-platform.test:8001/web-bundle/resources/wbn/nested-main.wbn"
-    resources="http://web-platform.test:8001/web-bundle/resources/wbn/nested-sub.wbn"
-  />
+  <link rel="webbundle" href="https://web-platform.test:8444/web-bundle/resources/wbn/nested-main.wbn"
+    resources="https://web-platform.test:8444/web-bundle/resources/wbn/nested-sub.wbn" />
   <script>
     promise_test(async () => {
       const response = await fetch(
-        "http://web-platform.test:8001/web-bundle/resources/wbn/nested-sub.wbn"
+        "https://web-platform.test:8444/web-bundle/resources/wbn/nested-sub.wbn"
       );
       assert_true(response.ok);
     }, "A nested bundle can be fetched");
 
     promise_test(async () => {
       await addLinkAndWaitForError(
-        "http://web-platform.test:8001/web-bundle/resources/wbn/nested-sub.wbn",
-        "http://web-platform.test:8001/web-bundle/resources/wbn/root.js"
+        "https://web-platform.test:8444/web-bundle/resources/wbn/nested-sub.wbn",
+        "https://web-platform.test:8444/web-bundle/resources/wbn/root.js"
       );
       const response = await fetch(
-        "http://web-platform.test:8001/web-bundle/resources/wbn/root.js"
+        "https://web-platform.test:8444/web-bundle/resources/wbn/root.js"
       );
       assert_false(response.ok);
     }, "Subresources in a nested bundle should not be loaded");
@@ -43,4 +38,4 @@
       });
     }
   </script>
-</body>
+</body>

testing/web-platform/tests/web-bundle/subresource-loading/subresource-loading-path-restriction.https.tentative.html

@@ -10,18 +10,18 @@
   <link
     rel="webbundle"
     href="../resources/wbn/path-restriction.wbn"
-    resources="http://web-platform.test:8001/web-bundle/resources/wbn/resource.js
-                   http://web-platform.test:8001/web-bundle/resources/wbn/sub/resource.js
-                   http://web-platform.test:8001/web-bundle/resources/wbn-resource.js
-                   http://web-platform.test:8001/web-bundle/resources/wbn1/resource.js
-                   http://web-platform.test:8001/web-bundle/resources/other/resource.js
-                   http://web-platform.test:8001/web-bundle/resources/resource.js"
+    resources="https://web-platform.test:8444/web-bundle/resources/wbn/resource.js
+                   https://web-platform.test:8444/web-bundle/resources/wbn/sub/resource.js
+                   https://web-platform.test:8444/web-bundle/resources/wbn-resource.js
+                   https://web-platform.test:8444/web-bundle/resources/wbn1/resource.js
+                   https://web-platform.test:8444/web-bundle/resources/other/resource.js
+                   https://web-platform.test:8444/web-bundle/resources/resource.js"
   />
   <script>
     promise_test(async () => {
       const resources = [
-        "http://web-platform.test:8001/web-bundle/resources/wbn/resource.js",
-        "http://web-platform.test:8001/web-bundle/resources/wbn/sub/resource.js",
+        "https://web-platform.test:8444/web-bundle/resources/wbn/resource.js",
+        "https://web-platform.test:8444/web-bundle/resources/wbn/sub/resource.js",
       ];
       for (const resource of resources) {
         const response = await fetch(resource);
@@ -31,10 +31,10 @@
 
     promise_test(async () => {
       const resources = [
-        "http://web-platform.test:8001/web-bundle/resources/wbn-resource.js",
-        "http://web-platform.test:8001/web-bundle/resources/wbn1/resource.js",
-        "http://web-platform.test:8001/web-bundle/resources/other/resource.js",
-        "http://web-platform.test:8001/web-bundle/resources/resource.js",
+        "https://web-platform.test:8444/web-bundle/resources/wbn-resource.js",
+        "https://web-platform.test:8444/web-bundle/resources/wbn1/resource.js",
+        "https://web-platform.test:8444/web-bundle/resources/other/resource.js",
+        "https://web-platform.test:8444/web-bundle/resources/resource.js",
       ];
       for (const resource of resources) {
         const response = await fetch(resource);

testing/web-platform/tests/web-bundle/subresource-loading/subresource-loading-static-element-with-base.https.tentative.html

@@ -12,11 +12,11 @@
   rel="webbundle"
   href="../static-element.wbn"
   resources="
-  http://web-platform.test:8001/web-bundle/resources/wbn/static-element/resources/script.js
-  http://web-platform.test:8001/web-bundle/resources/wbn/static-element/resources/style.css
-  http://web-platform.test:8001/web-bundle/resources/wbn/static-element/resources/style-imported-from-file.css
-  http://web-platform.test:8001/web-bundle/resources/wbn/static-element/resources/style-imported-from-tag.css"
-  scopes="http://web-platform.test:8001/web-bundle/resources/wbn/static-element/scopes/"
+  https://web-platform.test:8444/web-bundle/resources/wbn/static-element/resources/script.js
+  https://web-platform.test:8444/web-bundle/resources/wbn/static-element/resources/style.css
+  https://web-platform.test:8444/web-bundle/resources/wbn/static-element/resources/style-imported-from-file.css
+  https://web-platform.test:8444/web-bundle/resources/wbn/static-element/resources/style-imported-from-tag.css"
+  scopes="https://web-platform.test:8444/web-bundle/resources/wbn/static-element/scopes/"
 />
   <style type="text/css">
     @import 'resources/style-imported-from-tag.css';

testing/web-platform/tests/web-bundle/subresource-loading/subresource-loading-static-element.https.tentative.html

@@ -11,11 +11,11 @@
   rel="webbundle"
   href="../resources/wbn/static-element.wbn"
   resources="
-  http://web-platform.test:8001/web-bundle/resources/wbn/static-element/resources/script.js
-  http://web-platform.test:8001/web-bundle/resources/wbn/static-element/resources/style.css
-  http://web-platform.test:8001/web-bundle/resources/wbn/static-element/resources/style-imported-from-file.css
-  http://web-platform.test:8001/web-bundle/resources/wbn/static-element/resources/style-imported-from-tag.css"
-  scopes="http://web-platform.test:8001/web-bundle/resources/wbn/static-element/scopes/"
+  https://web-platform.test:8444/web-bundle/resources/wbn/static-element/resources/script.js
+  https://web-platform.test:8444/web-bundle/resources/wbn/static-element/resources/style.css
+  https://web-platform.test:8444/web-bundle/resources/wbn/static-element/resources/style-imported-from-file.css
+  https://web-platform.test:8444/web-bundle/resources/wbn/static-element/resources/style-imported-from-tag.css"
+  scopes="https://web-platform.test:8444/web-bundle/resources/wbn/static-element/scopes/"
 />
   <style type="text/css">
     @import '../resources/wbn/static-element/resources/style-imported-from-tag.css';