зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1251152 - Part 3: Test case. r=franziskus
This commit is contained in:
Henry Chang
Родитель
a4d43fbbf9
Коммит
dc7cba21ef
|
|
@ -3,6 +3,8 @@ support-files =
|
|||
file_contentserver.sjs
|
||||
file_about_newtab.html
|
||||
file_about_newtab_bad.html
|
||||
file_about_newtab_bad_csp.html
|
||||
file_about_newtab_bad_csp_signature
|
||||
file_about_newtab_good_signature
|
||||
file_about_newtab_bad_signature
|
||||
file_about_newtab_broken_signature
|
||||
|
|
|
|||
|
|
@ -36,6 +36,7 @@ const URI_BROKEN_SIG = BASE + "sig=broken&key=good&file=good&header=good";
|
|||
const URI_BAD_KEY = BASE + "sig=good&key=bad&file=good&header=good";
|
||||
const URI_BAD_FILE = BASE + "sig=good&key=good&file=bad&header=good";
|
||||
const URI_BAD_ALL = BASE + "sig=bad&key=bad&file=bad&header=bad";
|
||||
const URI_BAD_CSP = BASE + "sig=bad-csp&key=good&file=bad-csp&header=good";
|
||||
|
||||
const URI_BAD_FILE_CACHED = BASE + "sig=good&key=good&file=bad&header=good&cached=true";
|
||||
|
||||
|
|
@ -54,6 +55,11 @@ const SCRIPT_WITHOUT_SRI_BLOCKED = "Script without SRI blocked";
|
|||
const SCRIPT_WITH_SRI_BLOCKED = "Script with SRI blocked";
|
||||
const SCRIPT_WITH_SRI_LOADED = "Script with SRI loaded";
|
||||
|
||||
const CSP_TEST_SUCCESS_STRING = "CSP violation test succeeded.";
|
||||
|
||||
// Needs to sync with pref "security.signed_content.CSP.default".
|
||||
const SIGNED_CONTENT_CSP = `{"csp-policies":[{"report-only":false,"script-src":["https://example.com","'unsafe-inline'"],"style-src":["https://example.com"]}]}`;
|
||||
|
||||
const TESTS = [
|
||||
// { newtab (aboutURI) or regular load (url) : url,
|
||||
// testStrings : expected strings in the loaded page }
|
||||
|
|
@ -76,6 +82,7 @@ const TESTS = [
|
|||
SCRIPT_WITHOUT_SRI_BLOCKED,
|
||||
SCRIPT_WITH_SRI_LOADED,
|
||||
]},
|
||||
{ "aboutURI" : URI_BAD_CSP, "testStrings" : [CSP_TEST_SUCCESS_STRING] },
|
||||
{ "url" : URI_CLEANUP, "testStrings" : [CLEANUP_DONE] },
|
||||
];
|
||||
|
||||
|
|
@ -113,6 +120,14 @@ function doTest(aExpectedStrings, reload, aUrl, aNewTabPref) {
|
|||
"Me1+f7wRmkNrCUojZR1ZKmYM2BeiUOMlMoqk2O7+uwsn1DwNQSYP58TkvZt6"
|
||||
]);
|
||||
|
||||
if (aNewTabPref === URI_BAD_CSP) {
|
||||
// Use stricter CSP to test CSP violation.
|
||||
yield pushPrefs(["security.signed_content.CSP.default", "script-src 'self'; style-src 'self'"]);
|
||||
} else {
|
||||
// Use weaker CSP to test normal content.
|
||||
yield pushPrefs(["security.signed_content.CSP.default", "script-src 'self' 'unsafe-inline'; style-src 'self'"]);
|
||||
}
|
||||
|
||||
// start the test
|
||||
yield BrowserTestUtils.withNewTab({
|
||||
gBrowser,
|
||||
|
|
@ -132,6 +147,16 @@ function doTest(aExpectedStrings, reload, aUrl, aNewTabPref) {
|
|||
is(aboutNewTabService.newTabURL, aNewTabPref,
|
||||
"sanity check: default URL for about:newtab should return the new URL");
|
||||
}
|
||||
|
||||
// Every valid remote newtab page must have built-in CSP.
|
||||
let shouldHaveCSP = ((aUrl === ABOUT_NEWTAB_URI) &&
|
||||
(aNewTabPref === URI_GOOD || aNewTabPref === URI_SRI));
|
||||
|
||||
if (shouldHaveCSP) {
|
||||
is(browser.contentDocument.nodePrincipal.cspJSON, SIGNED_CONTENT_CSP,
|
||||
"Valid remote newtab page must have built-in CSP.");
|
||||
}
|
||||
|
||||
yield ContentTask.spawn(
|
||||
browser, aExpectedStrings, function * (aExpectedStrings) {
|
||||
for (let expectedString of aExpectedStrings) {
|
||||
|
|
|
|||
|
|
@ -0,0 +1,14 @@
|
|||
<!DOCTYPE HTML>
|
||||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<title>Testpage for CSP violation (inline script)</title>
|
||||
</head>
|
||||
<body>
|
||||
CSP violation test succeeded.
|
||||
<script>
|
||||
// This inline script would override the success string if loaded.
|
||||
document.body.innerHTML = "CSP violation test failed.";
|
||||
</script>
|
||||
</body>
|
||||
</html>
|
||||
|
|
@ -0,0 +1 @@
|
|||
8qXVAqzuF3TsF6C750u_v_JiRu90WJXf_0xT9x0S4Fgmvolgtfu-KSWq3lYpmk2dxO8u64zaHM3iguZdWAqcSL82RFtV7OPiprt16omCbHCKfVi-Bt_rXILRlexgmRl_
|
||||
|
|
@ -24,6 +24,9 @@ const badKeyId = "OldRemoteNewTabKey";
|
|||
const sriFile = path + "file_about_newtab_sri.html";
|
||||
const sriSignature = path + "file_about_newtab_sri_signature";
|
||||
|
||||
const badCspFile = path + "file_about_newtab_bad_csp.html";
|
||||
const badCspSignature = path + "file_about_newtab_bad_csp_signature";
|
||||
|
||||
const tempFileNames = [goodFileName, scriptFileName, cssFileName];
|
||||
|
||||
// we copy the file to serve as newtab to a temp directory because
|
||||
|
|
@ -195,11 +198,15 @@ function handleRequest(request, response) {
|
|||
signature = brokenSignature;
|
||||
} else if (signatureType == "sri") {
|
||||
signature = sriSignature;
|
||||
} else if (signatureType == "bad-csp") {
|
||||
signature = badCspSignature;
|
||||
}
|
||||
if (fileType == "bad") {
|
||||
file = getFileName(badFile, "CurWorkD");
|
||||
} else if (fileType == "sri") {
|
||||
file = getFileName(sriFile, "CurWorkD");
|
||||
} else if (fileType == "bad-csp") {
|
||||
file = getFileName(badCspFile, "CurWorkD");
|
||||
}
|
||||
|
||||
if (headerType == "good") {
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче